hxxps://support[.]office[.]com/en-us/article/join-a-meeting-in-teams-1613bb53-f3fa-431e-85a9-d6a91e3468c9?omkt=en-US

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://support.office.com/en-us/article/join-a-meeting-in-teams-1613bb53-f3fa-431e-85a9-d6a91e3468c9?omkt=en-US
Sample260905-eyrlpatsgx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3396	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330556854756679"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{00B4E570-ACE3-4F9A-95F8-209E1DC39711}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2408	2412	msedge.exe	81
PID 2412 wrote to memory of 3396	2412	msedge.exe	82
PID 2412 wrote to memory of 1812	2412	msedge.exe	83
PID 2412 wrote to memory of 1812	2412	msedge.exe	83
PID 2412 wrote to memory of 1812	2412	msedge.exe	83
PID 2412 wrote to memory of 1608	2412	msedge.exe	84
PID 2412 wrote to memory of 1608	2412	msedge.exe	84
PID 2412 wrote to memory of 1752	2412	msedge.exe	86
PID 2412 wrote to memory of 1752	2412	msedge.exe	86
PID 2412 wrote to memory of 4476	2412	msedge.exe	87
PID 2412 wrote to memory of 1752	2412	msedge.exe	86
PID 2412 wrote to memory of 4476	2412	msedge.exe	87
PID 2412 wrote to memory of 4476	2412	msedge.exe	87
PID 2412 wrote to memory of 1900	2412	msedge.exe	89
PID 2412 wrote to memory of 4640	2412	msedge.exe	90
PID 2412 wrote to memory of 3068	2412	msedge.exe	91
PID 2412 wrote to memory of 1900	2412	msedge.exe	89
PID 2412 wrote to memory of 1900	2412	msedge.exe	89
PID 2412 wrote to memory of 4640	2412	msedge.exe	90
PID 2412 wrote to memory of 4640	2412	msedge.exe	90
PID 2412 wrote to memory of 3068	2412	msedge.exe	91
PID 2412 wrote to memory of 3068	2412	msedge.exe	91
PID 2412 wrote to memory of 3228	2412	msedge.exe	92
PID 2412 wrote to memory of 3228	2412	msedge.exe	92
PID 2412 wrote to memory of 3228	2412	msedge.exe	92
PID 2412 wrote to memory of 1324	2412	msedge.exe	94
PID 2412 wrote to memory of 1228	2412	msedge.exe	95
PID 2412 wrote to memory of 1324	2412	msedge.exe	94
PID 2412 wrote to memory of 1228	2412	msedge.exe	95
PID 2412 wrote to memory of 4544	2412	msedge.exe	96
PID 4544 wrote to memory of 4948	4544	msedge.exe	98
PID 2412 wrote to memory of 5008	2412	msedge.exe	99
PID 2412 wrote to memory of 1164	2412	msedge.exe	100
PID 2412 wrote to memory of 1164	2412	msedge.exe	100
PID 2412 wrote to memory of 1164	2412	msedge.exe	100
PID 2412 wrote to memory of 3920	2412	msedge.exe	101
PID 2412 wrote to memory of 3920	2412	msedge.exe	101
PID 2412 wrote to memory of 3920	2412	msedge.exe	101
PID 2412 wrote to memory of 2464	2412	msedge.exe	102
PID 2412 wrote to memory of 2464	2412	msedge.exe	102
PID 2412 wrote to memory of 2464	2412	msedge.exe	102
PID 2412 wrote to memory of 1152	2412	msedge.exe	103
PID 2412 wrote to memory of 1152	2412	msedge.exe	103
PID 2412 wrote to memory of 1152	2412	msedge.exe	103
PID 2412 wrote to memory of 4232	2412	msedge.exe	104
PID 2412 wrote to memory of 4232	2412	msedge.exe	104
PID 2412 wrote to memory of 4232	2412	msedge.exe	104
PID 2412 wrote to memory of 4872	2412	msedge.exe	105
PID 2412 wrote to memory of 4872	2412	msedge.exe	105
PID 2412 wrote to memory of 4872	2412	msedge.exe	105
PID 2412 wrote to memory of 2572	2412	msedge.exe	106
PID 2412 wrote to memory of 2040	2412	msedge.exe	107
PID 2412 wrote to memory of 2856	2412	msedge.exe	108
PID 2412 wrote to memory of 4640	2412	msedge.exe	109
PID 2412 wrote to memory of 4640	2412	msedge.exe	109
PID 2412 wrote to memory of 3952	2412	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://support.office.com/en-us/article/join-a-meeting-in-teams-1613bb53-f3fa-431e-85a9-d6a91e3468c9?omkt=en-US
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd26e9c188,0x7ffd26e9c194,0x7ffd26e9c1a0
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17613384367138908995,8793737352798655024,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,13707457131960765575,14585790038125208705,262144 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,8987540255468023266,428854569098783820,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,1309504899230288764,12496878838148575405,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,17199117829337683611,17431214028977183830,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,14514276313796791916,3108801568325529574,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,1062002505741198813,13726836821435779028,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,11656148757366994684,1470890099343391868,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4352,i,17811363947003403182,18096877993138762984,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,3431063240143972128,558469411916521062,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,7475172137916861082,9023094559724371440,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,9974034262363452917,9432415452536686098,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,8821964470751187272,11597721382395516750,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,8821964470751187272,11597721382395516750,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6280,i,14664914425342830586,6097535447219776395,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3496,i,18120157269054836025,16795155039242371152,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6608,i,2239960304276456880,8628543083199749607,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6976,i,10481029686911151156,16233241178599895403,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4340,i,1391574738368051699,8370308454874313206,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4624,i,9005354858633212243,13986165578700617719,2097152 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1467726425660398486,15708372552699567672,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,604534577846940357,16020811484141225861,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6370343361077803782,3360543477422320947,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,13100135613592128062,13003411609228219466,524288 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7148,i,2151801673222948251,16419917086489474414,262144 --field-trial-handle=2156,i,7482089204905699554,9217418802500770021,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

572e8431-8644-485c-812d-a5bed9fc5ff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\572e8431-8644-485c-812d-a5bed9fc5ff8.tmp
Size 8KB
SHA256 8091d54c018e136e4295d8e04fa612331957cfb067eca1ed98f567f0bccea499
MD5 622df13eb3acf867682b91cfa6c1493c
SHA1 677d7491f020eeddd5e8860aaf33562353d46355
SHA512 314b2bd014ab23b384caf8677fdb20e8ac3a565bea1761eeeedce284e8101cfada355eb721896e3026d4160b82d281c50a7f8b83e0045ac97d9fcb9d789ee52a
SSDEEP 96:8bqGNkdQsjpfN2dYXOR95ih/cIPURHl8h4otop5p1ISDSBYP6vVjhLcgz05ngVvP:BGN96P2UOcQmiUyHIUyqGv0NyjwSrRU6
TLSH
T1A702EA396C786CBB8EB2AD45B48737135FE8107BEAA52F80D9E41E1C00DB65C2347936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 edcc8ba061856d3ff4167fddab141c3a57d85f9251e54e9dc95d515fcb56235b
MD5 0793ce1580b79e4299d8b0e010473beb
SHA1 055430ef6e1f80b14d71b6f3ee5f257422fab6ed
SHA512 6c025ba3506afd15b5b50c119a4529297bdad05a25c7ecf5ac10dc697a011556e0e3d9c7511e41365b02f1f3887ce9003c1f67626f1b99f631d8f0cc06977546
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T12EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 92db21cc08f23463f3cf460573568e12dd85efba08ce38b5a98fe7931c91f50d
MD5 4864400b1649e912916bc7889a1d3005
SHA1 3b018fc2e8b27ea9dc6b625ee1987338b66227ba
SHA512 094f3189d30bd54591bbf93c9f6d71c2f112283db9436244d052e54ddf03e52a5a03ad4cb0fe0730cfee58dd3af8732016f873a0939c84cd3027980fea3ced7a
TLSH
T183810861C956C4B7EBA602388AF24E0D3072C05835230FFFE286827A19EE7A4D5D2D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590eac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590eac.TMP
Size 3KB
SHA256 0caccd0e2011aaec0d01829299a7483d558b992ef8f98f66a4a212a27b893cbc
MD5 0332aeb179f7e6d003919cc97a0ec70e
SHA1 5b0c7e9e344487beae6430c8a45e372322b9f938
SHA512 f423583c3e17e55266f26b47267a872f7235d689040d86e6d36da2679e2a9ed5f31430c265d5d2822106656558348a7e7111d1b5ba3414ae5e8839320b24d1d2
TLSH
T1DE719535C252D5B3D7661271D9E20F4D3072C4993A231EEFC28446BA15DFB91C6D5D0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 60bdfcfc3be0dd385e6b9b2a526f71eecce1b437cab46c79fdad4f4f072e00e2
MD5 d161c1430e38b452df476e38655df070
SHA1 9ad5727243b12e48472033e7db2488970ea29ec5
SHA512 357466df4431ced6e6194953db4eced41055ddfe1471f889f44194164302586038b90d210e0ba35baac83795deefe3d65b0faaef2054c2ee20c546c4f0f4d04f
TLSH
T15E5159F747B0956E8E119AF09A18DF2FDF2C0226435C78658AD4BE23D7B3472E00665B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7b92680c2ba256aa6e09db1c484014f59bc70ebf0a768958f19c909dfb38e75f
MD5 5f8c66fff7b28c3b600b15d83c9b814e
SHA1 e36e017eda10d28bd0e5c6e7fc12d174d8d7f9fc
SHA512 cedf33a3a0fdeec72b98dda6f1dc9d47e7da968e3e79a89bcf25ae01342b86ddae11583b50a61da261afd0a1140126f80951433753a7dc4a27b450577d463e53
SSDEEP 192:sxZCRlyM/jK1Ml8MFT/f94s28KqIdpMYZ/W6+WNqUK/Y0ax+kX9IgrJ:sxZCpdT/f94s28Kjz/bU/5CV9
TLSH
T1AE52C715AA34A977CCDBD209FA45BF53D6F5447392900E44AAFC9A1C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 772a271c8022de96d7314e078a07177f01f6cf450ff0c171465a5bb833a015e5
MD5 63226e9f0acab0e8956efa0dc5d9a3cd
SHA1 2c46e274cf6126a1862949b6302e236084f6f048
SHA512 263a554cab0472d287a5dd385ee0928311282635f9ceb6269ba0a6a182d856f560349e8da5a66be34c3b6f7f15f78d55f1c23e9f3b0c304ae252b71085222a1d
SSDEEP 192:sxZCRlyM/jK1Ml8UQMFT/f94sf8oqIdpWYZ/W6+WNqUK/Y0axvvz9Ig5yLJ:sxZCLqaT/f94sf8oj9/bU/5CdAd
TLSH
T1BF52E816AA34A977DCDBD209F945BF53D6F5447392900E44AAFCDA1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 073bc40a5e04d1319cc2238666b28e1672e292b8b8e46ded9f0eb269b54f3c88
MD5 ea47b9bfeb719945f47c9b40947aa488
SHA1 d082586b13824a797be20c5cea39fd167d93ac8a
SHA512 579d21e6e7237285237b82a9972a8496663ff559f1fcd59c5dfb82ef4da4e9ccd9a50375d105601ba09343d617f9fc7fb066001d291c0df5dab12d4f0c912d9f
SSDEEP 192:sxZCRlyM/jK1Ml8MFT/f94sf8oqIdpMYZ/W6+WNqUK/Y0axxAX9Ig5yLJ:sxZCLdT/f94sf8ojz/bU/5CSAd
TLSH
T12E52E815AA34A977DCDBD209FA45BF53D6F5447392900E449AFCDA1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 50cf7af5866381a631e2c268ad6ffb3fa98887e2924cfb4710a2114fa660a17a
MD5 ede14a405b59426c387159f0c4481921
SHA1 c310b0ce343e10c096fb6d143eb2659853efc171
SHA512 3af0954a83493d585b9ee7307c2ed6fdfe1ee347f6690b698c39c02e8d8b50c90535ada70e40caa42abcde480dc535a7cd3a124385581216aad65d2be43c8042
SSDEEP 768:EH/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0Vrjro4F:EH/zh8dF2PkWRmEcQXwu1jaKWjLp2tV7
TLSH
T12DE2F93F284CCB7E4F844E9CEC266F966EE801CB66684D5447FA894C03C76DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2a5133472b241f867df643bae23bddcad7ce5adc300528e4da12e7331a16195f
MD5 1c734e71a4f5b4bc243b5ccaa39b0580
SHA1 d00f808cff2d0ae2ede7c4c9f441f1327967eba5
SHA512 79bf1768f4aa39175745c5cef63157ccf5f2b2ebd191b36e5c2bafaba05854ef20f284c62c98d2f6a75d8d074c062132c9a4a8f36b27809bc44e78488c17161d
SSDEEP 96:KEWgKvvNOKmwCaCYKzCUvCK4UOOxGKCsrHdH8H5HNHLHT:2uZHWJR0HdH8H5HNHLHT
TLSH
T14CD18E9633BA03427C7D751CA2A287374A81F5673118AA2B776C94B24D67E306CFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fa0cbca-ea50-4ad1-8a17-3787bc48b163.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0fa0cbca-ea50-4ad1-8a17-3787bc48b163.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 397863192cf74c6c6491c96f6ab7de55de4694ab033aea89b0d185251eca221b
MD5 878ade00e5467d8127a5079dcaeab219
SHA1 8b78186ca4666426e95a41326a495b69237bdce1
SHA512 8004e9841b1772a2fef508cafaf34f675aa29a28c1e7edf9aa04166411bd2e8b3c34faf85ab4c8efd0925d20d26640c61722035ba7c0105ae380582ac2293469
SSDEEP 384:vZcII8NWQ5xFuf28cnsM4cg7O6R2FeoJh7UB2on:nI6bF6kscg7TR8o2Q
TLSH
T134828D721CB89D776DB2D145F44A36138FF890A396C92E40E8DC6F2E04DFA99130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b253fc5941f73778af0a59f2e4e7e1735e57e827f1b3c50c04644a0fe5ab2c10
MD5 08e26eaf79378dac5a0617cf5d55b1c9
SHA1 b75eed0e998f435cbd6834fde0b4eba8966a4fb8
SHA512 2e2bda57137cfb0d7f0e8e1295aa4921a2697073d40893a0cd56f914e57d71551f116f9f59cfd459d1d81fd6d125de19934ce1a9db7e2c179be9a94375b4d384
SSDEEP 384:iZcII8NWc5xFuf28cnsM4cg7O6R2FeoJh7UB2on:QI6bF6kscg7TR8o2Q
TLSH
T1D0828D721CB89D7769B2D145F44A36139FF890A796C92E40E8DC6F1D04DFA99130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8d238a4da251a7e8411d635a522ddb5777ed89822748545593998616f559e228
MD5 ba32c55f78f0fa04239e3705b6e233e2
SHA1 2f5f896ed641abafe2ac61fe632578a116e912ca
SHA512 d6460d588e5c5eba3c93ed934f1bb0514912c814af5517a95dcf352706f7011406665a76fdbd72634e2bdf3b7b44660add23a9edec836e68d9ffb5c6987b98e6
SSDEEP 384:IiFBZcI48NW8TUNTUlIl55xFufl8cnsM4Vg7O6R2FeoJh7UB2on:TFJ4jwgHbFnksVg7TR8o2Q
TLSH
T1BAC24BF20CE7897AE9AE8747A73D2D128EBCC063B5855940B78C5A1DCC9A5BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2f94750dfae53cd99e3d80191e980a48b3598cfc70d55e81d64c92bf01cbf55
MD5 d1f8e4aa1a41b40840fa6bcad5a78d3f
SHA1 175bdd970ae597c1caca0b1249115067a85dc169
SHA512 403d0feb21ada2324208cfac99dbd440d43e541b04cb3fd1c2912f991b0453a5e91211638798526477635e6e5f74c35575a1d327ce8fa592639df0c12ec8bd1d
SSDEEP 192:0GNf6P2UkQmiUybEyMGv0NyW6l4j0BkqeU6:0GNf6ej69MGsM4EgU6
TLSH
T182122B366CB85C7B5DA2E444F48736135FB89167EA893F80E8DC3E1D01EF59C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ffc718944e0a5a82e7a8009986f6e73eb19010c43c0aa1e4b017d960b80facc2
MD5 f3cea1f8bb77710c3c4d18c4f468d04c
SHA1 a86a8c47b6ee43fdc8d7fce357bd5bb52f8ecc0f
SHA512 0d3f8055acb091b2d5667e71e7a6346ee4b04fb82b8af25ca55e11443fdb28fabdf7dbd0d3f4b53fb8e7b26058e572b5316074b67f2af97d9a6c8b265c8a2dae
SSDEEP 384:pZcII8NW55xFuf28cnsM4cg7O6R2FeoJh7UB2on:hIzbF6kscg7TR8o2Q
TLSH
T18A828D722CB89D7769B2D145F44A36139FF890A796C92E40E8DC6F1E04DFA99130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd57936d-180f-4233-b82f-04cbef923c29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fd57936d-180f-4233-b82f-04cbef923c29.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download