hxxps://teams[.]microsoft[.]com/meetingOptions/?organizerId=0b558b98-ba13-438a-ad49-6df9994a5dc9&tenantId=d872658b-bcf1-4191-87cc-2dda7a48d87a&threadId=19_meeting_MDNkOTE0N2QtMDFhZi00YzcxLWIzZWEtNzU0NDQwOTViNTA4@thread[.]v2&messageId=0&language=en-US

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://teams.microsoft.com/meetingOptions/?organizerId=0b558b98-ba13-438a-ad49-6df9994a5dc9&tenantId=d872658b-bcf1-4191-87cc-2dda7a48d87a&threadId=19_meeting_MDNkOTE0N2QtMDFhZi00YzcxLWIzZWEtNzU0NDQwOTViNTA4@thread.v2&messageId=0&language=en-US
Sample260905-e3cnbsen2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330560609845247"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{E25E23A4-F772-45B4-A6A6-D8AA2C8BF640}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 880	2684	msedge.exe	81
PID 2684 wrote to memory of 3652	2684	msedge.exe	83
PID 2684 wrote to memory of 3384	2684	msedge.exe	84
PID 2684 wrote to memory of 3384	2684	msedge.exe	84
PID 2684 wrote to memory of 3384	2684	msedge.exe	84
PID 2684 wrote to memory of 1680	2684	msedge.exe	85
PID 2684 wrote to memory of 1680	2684	msedge.exe	85
PID 2684 wrote to memory of 1688	2684	msedge.exe	86
PID 2684 wrote to memory of 4956	2684	msedge.exe	87
PID 2684 wrote to memory of 1688	2684	msedge.exe	86
PID 2684 wrote to memory of 1688	2684	msedge.exe	86
PID 2684 wrote to memory of 4956	2684	msedge.exe	87
PID 2684 wrote to memory of 4956	2684	msedge.exe	87
PID 2684 wrote to memory of 2088	2684	msedge.exe	88
PID 2684 wrote to memory of 2088	2684	msedge.exe	88
PID 2684 wrote to memory of 2088	2684	msedge.exe	88
PID 2684 wrote to memory of 884	2684	msedge.exe	89
PID 2684 wrote to memory of 4808	2684	msedge.exe	90
PID 2684 wrote to memory of 884	2684	msedge.exe	89
PID 2684 wrote to memory of 884	2684	msedge.exe	89
PID 2684 wrote to memory of 4808	2684	msedge.exe	90
PID 2684 wrote to memory of 4808	2684	msedge.exe	90
PID 2684 wrote to memory of 4432	2684	msedge.exe	91
PID 2684 wrote to memory of 4432	2684	msedge.exe	91
PID 2684 wrote to memory of 4432	2684	msedge.exe	91
PID 2684 wrote to memory of 3020	2684	msedge.exe	94
PID 2684 wrote to memory of 4420	2684	msedge.exe	95
PID 2684 wrote to memory of 3020	2684	msedge.exe	94
PID 2684 wrote to memory of 4420	2684	msedge.exe	95
PID 2684 wrote to memory of 4280	2684	msedge.exe	97
PID 2684 wrote to memory of 2492	2684	msedge.exe	98
PID 4280 wrote to memory of 3896	4280	msedge.exe	99
PID 2684 wrote to memory of 4072	2684	msedge.exe	100
PID 2684 wrote to memory of 4072	2684	msedge.exe	100
PID 2684 wrote to memory of 4072	2684	msedge.exe	100
PID 2684 wrote to memory of 3156	2684	msedge.exe	101
PID 2684 wrote to memory of 3156	2684	msedge.exe	101
PID 2684 wrote to memory of 3156	2684	msedge.exe	101
PID 2684 wrote to memory of 4284	2684	msedge.exe	102
PID 2684 wrote to memory of 4284	2684	msedge.exe	102
PID 2684 wrote to memory of 4284	2684	msedge.exe	102
PID 2684 wrote to memory of 4424	2684	msedge.exe	103
PID 2684 wrote to memory of 4424	2684	msedge.exe	103
PID 2684 wrote to memory of 4424	2684	msedge.exe	103
PID 2684 wrote to memory of 1388	2684	msedge.exe	105
PID 2684 wrote to memory of 4708	2684	msedge.exe	106
PID 2684 wrote to memory of 4452	2684	msedge.exe	107
PID 2684 wrote to memory of 484	2684	msedge.exe	108
PID 2684 wrote to memory of 484	2684	msedge.exe	108
PID 2684 wrote to memory of 3620	2684	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teams.microsoft.com/meetingOptions/?organizerId=0b558b98-ba13-438a-ad49-6df9994a5dc9&tenantId=d872658b-bcf1-4191-87cc-2dda7a48d87a&threadId=19_meeting_MDNkOTE0N2QtMDFhZi00YzcxLWIzZWEtNzU0NDQwOTViNTA4@thread.v2&messageId=0&language=en-US
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x250,0x7ffea0a7c188,0x7ffea0a7c194,0x7ffea0a7c1a0
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,2337193978978640143,12825442289596487385,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,8856282261594898642,16412085353981617280,262144 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,6577172471058611270,1599398499740297160,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4099463287478548726,17569455009217407794,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,11239896858246849316,17601134311736574085,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,15732600900288240409,1507969135531389394,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,12446741543648911218,8266243354504589140,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4376,i,2656012690801105325,12451533096164540264,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4184,i,11995779827969061806,13666452562077836145,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,3813895508756180093,3214919120547363406,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,14694823125786628866,10148692254530522652,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,14873261238457283048,6825640338532803122,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,17181918360425679428,10859623023091589259,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,14873261238457283048,6825640338532803122,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6164,i,3992410867915518297,7085398576391682046,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4540,i,7864328951782768022,15502320238990097710,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6652,i,13796763513520435969,898307835221124369,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6236,i,12933216923968142114,7900567077054513286,2097152 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10321441615664906430,12250763655966908584,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,4148345905504147530,6748341750000173726,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,15782642171028716435,4179696699463923269,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,10575598911822814739,7630723797720825363,524288 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6572,i,14749029566060530200,9501878951372967490,262144 --field-trial-handle=2400,i,10815852427709841971,12749603858151904944,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f56e0223b8446d77c6bf2c2d3592a3bb1c430e2ccef8b83fa2cd4636053dc7e5
MD5 98cf5988a36ca614aa685be981530acf
SHA1 27e0943471d052678e5e9537f3ebc0015cf8865d
SHA512 5097aa304a27e06727ef5d83f19acf7a3b4c9205e23757b70d4dc77de69914c1bd82b12802db89913035b31feef25e921b8488d3f9afbf20201afd9122765581
TLSH
T105D09BA07D4DF011C15710F1ED0167515119C6652457A637D9A0454D6D55C58539B057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 8c7c9bb09396c58270e0b9add8724c29942045b0959bc0573430159ed8bb5540
MD5 0b86b2792c474d2c455f268082871590
SHA1 0834b968d57c1f048e0188220aa0075760213824
SHA512 610849e82cc641e4d0a980b68b4fc54e96c3a25c8c5958a5d440797f27287aa4cda6ef6415f58401d754efb3e5fe98ef7d9c67a47bdb89073bf4945a644d5d74
SSDEEP 48:q/uo96BYRc4gJh/ON+WFaYmeHHJMJjY0MlTZ7eoZvot2hDXJgamYsKdW8aIe6bhN:qx9XcKamiJj+nSgKcsKd6IVtf
TLSH
T1A991A3BBDA924482FB31E231B5CC1A07B57EB085CA5B0F271790E4BF79773A20855388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f35a958883611affbfd6eb7a61bcdc73d825503840684cbe8c23cc16f043c661
MD5 1d3c53361a7b74da10f14c9c74a8ed09
SHA1 9b3e7e9b09b363b84076035015ca3c9ea5d620e4
SHA512 84ed3e7ed5195e70bd042d47b0dcb47d5bafa95f2cb87b0bbda73a5f2e04409afef68f6c3833979a77e93cdbca471ae6e34ff0384201dbe435bf7fa76f074cb3
TLSH
T1B2517CF787A1856ECE1196F09A18DE2BEF2C0612431C781986D4EE27E7F3471E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 94523a1c96ccebed35997d62d536c4d8220d374e355ed6d536ab77cf4ddd55e9
MD5 8b8bc7735272c8a02f7fc6b768e07bfb
SHA1 e1a85dd359aafb0af67a4984e4d05ecc2438935f
SHA512 637dcaaa4d2ae7f4b93d1eacff474b9b72eacb8eed1698b61a09a1aa342d9e65cf98ce0e6f324a94d6cf21a34bb2273557a89eacf5008bdec5b5edb077fc4965
SSDEEP 192:sxZTRbyM/jK1Ml8UQCFI/fjs2DGUIdp5j0/W6+WNMKO9/Y05+SOl/Ig5aJ:sxZT9qII/fjs2DGNW/be/52dA
TLSH
T1D162C756AA745977CCDBD209B651BF93E6F8157292900F44A9FCCA1C04E7AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7ba91f8a851a3df984a4b1246319c7e52ac72abaa29ecfe39b7682757880a00f
MD5 8600db75272439dd78436b81bba6cef5
SHA1 e3a868b0bd97343150326bd59e80d698b6533e61
SHA512 2964bb46b5f90661cae19a08c5711d1ed6944501266ed3f88827d74a22ceb9993834d52061be1dc2b4ce0b7384d85cc898599b6bfefb684352e867fc761da91d
SSDEEP 192:sxZTRbyM/jK1Ml8MFI/fjsCiGUIdpfj0/W6+WNMKO9/Y05iJkl/IgrJ:sxZT9dI/fjsCiGNY/be/5ld9
TLSH
T13152E8166A346977CCDBD209FA15BF93D6F8157292900E44A9FCD91C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 1399de4a800f2f947078ffb9f0ff006b2f1db406b6c861f3c0700e441b15e3ce
MD5 3ddb69fe0ccb0ea3b474abc5275665cb
SHA1 6ec879fc76fd6f327efb682386b555b321ac1da6
SHA512 4975d925d3b1c0c3693ed9b64dbfd05b9401902ef3ae607556001938b09c8c9023e3793ce4755916dd41a7a1784af33f68b9ecceb47ddbf624f59b5c30e132df
SSDEEP 768:x8zXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hMyro0U:x8zXl8pZ221WRmsYQL0u1jaKu/Lpd8hM
TLSH
T10AE20B3F244CCB7E4F844EACEC266F966ED802CBA7984D5447FA494C03C67DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\acd1745f-ac85-44fe-a170-a8d2e1e7eaff\index-dir\the-real-index
Size 96B
SHA256 b60f9526f1e76bc82142174332f5f3af0b2f51b1bbc964bf7d2b1a0b99ca40bc
MD5 1cca1cc56683944d9dad995ceebad746
SHA1 3e93453093fec0746b46bd560bf046e18fd42c20
SHA512 b2690078256e37e2ada7fc646f8480eeb38f879ca57e31d392726577a19509c22cf2227d211d09ed3aee8c8f1c8631b22fc5714f95c3188c95551d151a9ffa87
TLSH
T16EB00217A6A1C053C7912AB098A55444F73F1E6E31411F0150D960A8DC1124556A1F10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584dec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\acd1745f-ac85-44fe-a170-a8d2e1e7eaff\index-dir\the-real-index~RFe584dec.TMP
Size 48B
SHA256 45e65f7ae6d0d743b8c26285f2313ea0d946bb124b220ab0b0c8a3f5886ff959
MD5 2546e71458458b1a372b998e7a08a21d
SHA1 8cd6543e7736ebc788e15853f6955217bde4063e
SHA512 30836215bb9c21c1afc03b446dc75895710bcb78d64a24c94b5445cdc8e913c40195e49040d23ddd31fc4d4da669330c5d758cec3b310663c12e745a1b80e2c5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 182B
SHA256 7dea0205ceeee774c2668c924e013aeac1db2e7c937a01cc187c9f8207029a60
MD5 b2de61ab5c4ed431a3edc3d8316bf85f
SHA1 ecd4a83cef8b47b60418674994c15a7aefdb965a
SHA512 67d76e6ce49a01455a1e0ae0f344bca97982c2468bbcdd0a875042cb7353f139daedf9239497772d2268222fb0d5a88243eb5cd6f16e56737930f3f0b856def5
TLSH
T118C0222E83100808F689C58041A0D823D02DE18B5848E86C81C00002242EAE2E4019BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5897e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe5897e6.TMP
Size 187B
SHA256 5b2ab6b673f9d559ba2f935d962d39a4c4cb11ffcbba276a197d28e973d20b94
MD5 7af9593af25f1c7a59acbac76443f33e
SHA1 8d02f38c8f772f8d0a9b9e922719d7724843b324
SHA512 122beb3bbf2f298ab55ddcc677734793118d33b8277184b34a4d2bdee299e707d8c16f7dd5ad17b4f66b47c8879953f466b3e88981a9b4b3e39d74e9d93e9a41
TLSH
T174C0222F43200818F689C48141A0D813903CEC8B5808E86C82C63002343EAE2E4019BA
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 38c3925ff8c67710db2d0fadbd6f1a56874e7673192e77be87febf98b279b8a1
MD5 4d9c84f17a87b1511be7bd5643fd231e
SHA1 d794348bebaeaedd0d2257ea216ab93d713bf2ca
SHA512 bef22bd5eec1678f320b2625acd406e1fb225e064c7152bc9e5ac9b948aa59c63acdd3bfd7e4818ce7b43ee0d1ffdb95b42e9ac652773b26c7bb06cb66a4839e
SSDEEP 96:KI5mKqU6kazY0KEAvXYhm5svKh+5mvNyapoa10xFjXDYfPqL1tYKN91rYJtN6rFj:sVkazY0KEA/Yh0si+5mlyapoa10xFjXT
TLSH
T181A1431531BB13917D3D290D8391876B5A4275A33058BA3B3FEC10A26E67E621DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5921a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5921a7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2a480af839bd15aa77b1ef6360e782c74dcc53a40940e68a7b98aec76c5ec3de
MD5 ca3b1eba718cf2046662841cfbab27fb
SHA1 7dfa611fd04394f488da969ba6fc7ab221ec7c8b
SHA512 e5afa592c3698b6e7976084f8944ae9237aac84afccd3aa574f911deb8d52bcc1e9f8e8d3519fc2e032ff5acac7fb6b69e54285c1aa385a07eca193fd7f09243
SSDEEP 384:OZcIU8No0B+4BJE9JHHK/Q+KmtQ7O6R2FeopljoM:sUIBWq/QAtQ7TRoX
TLSH
T105827C726CB89C3B5DA7E195F44A3A279EB8906797C85F50D1EC7B1D08CEAD81306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1e0ed24b69521cfc59ccb6803392bdf4b3ddf21ef5da3b91a1cbf4c547abb3a1
MD5 e10f2c42fa1372442904c4eaea5783bb
SHA1 96b09a216283d33fda6eeb91af5289bf03a69edd
SHA512 9b52a675c533253d7a266725d9899f736e50cdd175f59069fab0ff300ecf6b10e5db7356caa82bc7bdfc2cc4cddc7bcfce34e7a75aa910904bcfb9a408b74fdc
SSDEEP 384:IiF8ZcIx8No88TUNTUlIl8+4BJE93+I+UHHK/Q+KsZQ7O6R2FeopljoM:TFqxQwgwBs+I+Cq/Q6ZQ7TRoX
TLSH
T1B9C22AF258D7883AD9AE9747A73D3D168EBCC063B5855A50B3D86A1CCC8A5BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f61dd402ee2b5b6c2e68a237a0b287ffd7c737209a17762f0affd6c95097af01
MD5 0f5c935b8eeca772513269af7ef1c708
SHA1 25816fbe47ee6a26e92a5ee8e1c0495f802e8baf
SHA512 a47c3ada580514721bc7c3c0201d087479b3019946ad14dfee1d9bdc60f44be2fb7a6fd60891eb0d60a372aec518ffbbb93b05d62d1b6bd241deea719184ad62
SSDEEP 384:YZcIU8No0F+4BJE9JHHK/Q+KmtQ7O6R2FeopljoM:mUsBWq/QAtQ7TRoX
TLSH
T17B828D726CB89C7B5DA7E195F44A3A279EB8906797C85F40D1EC7B1D08CEAD81307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 be0ab14e0fe16aa6a09cc39dd82b29e93eac8ed30c723a26cb77c23019fa27d7
MD5 58b5d2435cd15792f1bb1d78f92c50b1
SHA1 c671e1dda8501b322911165987993282ae6a21fe
SHA512 ddb4c1bec66ff037cadc34cef4d61925dff7897cbb5c9de1f62785a0faf5b656f666ddc02eefe76b4be2e7b2ab6b1c57531f41ad6896899a480a1edd7df013dd
SSDEEP 384:+ZcIU8No08+4BJE9JHHK/Q+KmtQ7O6R2FeopljoM:8U9BWq/QAtQ7TRoX
TLSH
T1F4828C726CB89C3B5DA7E195F44A3A279EB8906797C85F50D1EC7B1D08CEAD81307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8d85371be518f48e7a5ab96f5ab825f92621254657818abac137b6a5128da3bf
MD5 afeca5952208224729a7556c301287d4
SHA1 31eb09948cc5861a5c46e9f965759be571ae97c3
SHA512 d0186778f5de5ffae21c978887ae620537c372dbea24c2cf636fcdcfb37999d73ff1ae1b449c01f59444705c6dedd624baa3db0a1a994cb843e6f29c60efab2a
SSDEEP 192:yGN8B6fN6QmiUywSZ1L/GPTr+Ki/V3ZNqZU6:yGN8B6129A1L/Q+KYLQU6
TLSH
T111120831B8A8AC3B4D92A555F08736279E655167EBC86F94C2EC2B1C09DF59C6307C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d31f4154595094595d4c1209b503cda4361bec4e1d981432c8140698d168815
MD5 cad166b24cdb4903979959af93297c5a
SHA1 4231ceb0db34735b96fc4a333e424e3943a4e0aa
SHA512 246907a97c53b929c4dfafb36d325ca836a47fb5995ff2a61e885b2af22f4df06a2be3dba1dbd8daecf5564278ac28cb653674e89de5a74d097eb147a80389ed
SSDEEP 192:7GNL6fNNQmiUytzHZPL/GPTr+uV7q6lU6:7GNL61LCz5PL/Q+uUaU6
TLSH
T1AE020A35ACB86C7B8EE2AE59F4473B279FA4203796D41F54C6E82B1C04D769C1346C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e724f107-553d-4a19-a4c9-5ac9eba1c808.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e724f107-553d-4a19-a4c9-5ac9eba1c808.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download