hxxps://storage[.]googleapis[.]com/midfielders/midfielders[.]html?act=cl&pid=12873_md&uid=2&vid=380835&ofid=335&lid=560&cid=1447697

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
132s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/midfielders/midfielders.html?act=cl&pid=12873_md&uid=2&vid=380835&ofid=335&lid=560&cid=1447697
Sample260905-w4e9aazfre

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2120	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331065237888584"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{44584071-CAA0-47A7-AF6D-EAECB02042DF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2604	560	msedge.exe	80
PID 560 wrote to memory of 3252	560	msedge.exe	82
PID 560 wrote to memory of 2120	560	msedge.exe	81
PID 560 wrote to memory of 3252	560	msedge.exe	82
PID 560 wrote to memory of 3252	560	msedge.exe	82
PID 560 wrote to memory of 5108	560	msedge.exe	83
PID 560 wrote to memory of 5108	560	msedge.exe	83
PID 560 wrote to memory of 1368	560	msedge.exe	84
PID 560 wrote to memory of 1368	560	msedge.exe	84
PID 560 wrote to memory of 4188	560	msedge.exe	85
PID 560 wrote to memory of 1368	560	msedge.exe	84
PID 560 wrote to memory of 4188	560	msedge.exe	85
PID 560 wrote to memory of 4188	560	msedge.exe	85
PID 560 wrote to memory of 4956	560	msedge.exe	88
PID 560 wrote to memory of 4956	560	msedge.exe	88
PID 560 wrote to memory of 4956	560	msedge.exe	88
PID 560 wrote to memory of 416	560	msedge.exe	89
PID 560 wrote to memory of 5088	560	msedge.exe	90
PID 560 wrote to memory of 416	560	msedge.exe	89
PID 560 wrote to memory of 416	560	msedge.exe	89
PID 560 wrote to memory of 5088	560	msedge.exe	90
PID 560 wrote to memory of 5088	560	msedge.exe	90
PID 560 wrote to memory of 3108	560	msedge.exe	91
PID 560 wrote to memory of 3108	560	msedge.exe	91
PID 560 wrote to memory of 3108	560	msedge.exe	91
PID 560 wrote to memory of 4960	560	msedge.exe	93
PID 560 wrote to memory of 4960	560	msedge.exe	93
PID 560 wrote to memory of 4960	560	msedge.exe	93
PID 560 wrote to memory of 3920	560	msedge.exe	94
PID 560 wrote to memory of 3920	560	msedge.exe	94
PID 560 wrote to memory of 3920	560	msedge.exe	94
PID 560 wrote to memory of 3132	560	msedge.exe	95
PID 560 wrote to memory of 3100	560	msedge.exe	96
PID 560 wrote to memory of 3132	560	msedge.exe	95
PID 560 wrote to memory of 3100	560	msedge.exe	96
PID 560 wrote to memory of 4696	560	msedge.exe	97
PID 560 wrote to memory of 5000	560	msedge.exe	99
PID 4696 wrote to memory of 4504	4696	msedge.exe	100
PID 560 wrote to memory of 4644	560	msedge.exe	101
PID 560 wrote to memory of 4644	560	msedge.exe	101
PID 560 wrote to memory of 4644	560	msedge.exe	101
PID 560 wrote to memory of 1956	560	msedge.exe	102
PID 560 wrote to memory of 3372	560	msedge.exe	103
PID 560 wrote to memory of 5052	560	msedge.exe	104
PID 560 wrote to memory of 1668	560	msedge.exe	105
PID 560 wrote to memory of 1668	560	msedge.exe	105
PID 560 wrote to memory of 1084	560	msedge.exe	107
PID 560 wrote to memory of 4180	560	msedge.exe	108
PID 560 wrote to memory of 4180	560	msedge.exe	108
PID 560 wrote to memory of 4180	560	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/midfielders/midfielders.html?act=cl&pid=12873_md&uid=2&vid=380835&ofid=335&lid=560&cid=1447697
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7ffa347ec188,0x7ffa347ec194,0x7ffa347ec1a0
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2144101911286617294,8172184383119068998,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,6043478699615338601,9188737483567282267,262144 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,13582185716366496522,12545575746317667661,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11213668393735176819,5864270682671313145,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,11288373038193728687,4640864157018728321,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,10149010008207452067,15307252556754229004,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,2689450514808614144,3939455034222811738,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,15641509119629172186,6436390413304409098,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4400,i,16940191360395431021,10603011294405951393,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3488,i,4874305563411668372,3573181949510836036,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3440,i,2115559256600334685,12612633955950902810,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,7274253529552087244,4502046520958940561,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9761925691660704401,11612188233130410257,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,398183416520878732,12033914036132093061,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16106870470915089904,7808270468719977506,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16106870470915089904,7808270468719977506,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5044,i,6359582071557382990,15041054725944366653,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,2553844525223183071,10071267590893887186,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,13777620173705143016,4096465628923149476,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10774921985096886477,635224165104028835,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,12011550221548491474,4828629985744079648,524288 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6636,i,9406222154082519187,7043754735577128623,262144 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5536,i,1891704510358514891,4623715131921160840,2097152 --field-trial-handle=1948,i,10249848504906919818,302274368429232861,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5ce5c4e9f096b0a60e9d73a21e065d9a950291342740ebb9bd49438307acdfea
MD5 0a0d2f344a8ca5a98526c9861da7782d
SHA1 ac0a240405580b65d845b7ad69fb3528f69d53ba
SHA512 ae8c1c318961c61752cb84454fd104c2fb4cbf13c9902465927166ac792244760be69205b4d9a6db971cce039c7b42ba6c80563a53a673ff4b5a39c5c3d63f0b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7F:fwUQC5VwBIiElEd2K57P7F
TLSH
T100B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a02c7b872003dda3a438c48bd119eff41676b6263683c49791c7443f1bc9c834
MD5 3d8fc1289f29fe8104c28c2cf21a11d3
SHA1 66b4eac46e4764796655751917f4879545c0e4eb
SHA512 b394f3e93dbbff85c32f13455c1829a33327baa97f88a5378bf3766ac042aabe24976d7b4bd1f0f5ae256e3d3403d1f6df8fe258696e4805a7eed57de72b23c3
TLSH
T1527138284A6639D0F3A9023CB3E10A07F873C0F909BF5E6782C4973434E2B7B19E4408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f72c5f5f7c817799b15aafd4a6b234ef69a4b92d7b5012c686351d3a45fd62af
MD5 1efe0c7e136ca8425b7b454e69d078b6
SHA1 4628ee3faa6ded9e663e5852ae2218bb926dcac7
SHA512 837b8a4023daddad9d0384c6e33e8d6ba829b9e47cbea4faf23cbcdfc02386e050c6f2362448d812dd59e3e744add3788d87e96cd0e0b31e8f1155829d7cb3d5
TLSH
T19D7129294A6679D0F7A9027CB7D10907F873C0E909BF5E6782C4977574E2B7B19E0408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58754a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58754a.TMP
Size 3KB
SHA256 0e62314955e11513e8532f22bb53de69554c3a45b2aef78bb35a82591ee625a9
MD5 6ba016c76732398dc121b07e948288fa
SHA1 86c577513b774b53e022179d1acfd40e30ca8b5e
SHA512 dcfdc1598527301d24dc74082da6d59b57cf585527d6ef4b5df5333cb7b1086180e92c869eba96703dcef1b6322d6fb428af12c274d6391f6d96074d885929a1
TLSH
T16F7127294A6A79D0F3A9027CB3E0194BF873C4FA09BF5E6782D45B3474E273B19E4408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b44ed410cd9b9d272b2f090840b2ffed9075ed6fc77d36a3b38425fa5ee3b48a
MD5 c6c199131359d55aa32982950977b69c
SHA1 5b66a218ff90c8452af8d32a37fcdfedd7e9007f
SHA512 5f3049a98e4bf235604a7e97d32af431bda9b91929fff7e95ece26dca8690420f2bc7439cefb8ca2fbd7af718a1d4ad377a13cda3561d1bb1278c18be28ef0ce
TLSH
T1C151ACA38AD9CB6ECD414AF09B547E1BCE2D0A14425C3C558AD4BF5B93D2071D11265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 960e66f4b437849a84aebba6faf8a2001148b88a8045d78b0d13e47a00370136
MD5 1f91076594ede5f294ca3a900843c427
SHA1 15b2bee869c53048099e69f0bb0c053b8be7b358
SHA512 383fee6a42af682e6f6c39a8aebb93d950a6a21ae2e55e2ca72bc5420561742c04b230487bba4ed31061c7a9eb61dac714ce95109e95c00e54aa1159e8e4bd8a
SSDEEP 192:sxZfRdyM/jK1Ml8UQEFJ/f4s/ODnIdpIi/r/6+WN5C+oo3Y0szvI5UIg56J:sxZfzqSJ/f4sGDoj/A51l35Ax0
TLSH
T1F752D712AA346977CCDBD319F955BF53D6F90472D2900E44AAFC8A1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 e999bff3ca7015df987f3407f7466ff48fdb07ca389c643d920d2789fdbe996a
MD5 138577a0ba8bbac18447cc6dfd858980
SHA1 e40b09295294d305bb09c2c214d80d1dc606d3a4
SHA512 e12b49d0afbecfe89219fd0a3c58069a92b02623e2db4e268140defb90463afbd03e1f9d7b71ec5345720eaa57e73cc35b2fba0523f223b712452075c7ee7069
SSDEEP 768:m9/Xh8dF27kWRmwcQZw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601tFroPd:m9/Xh8dF27kWRmwcQZwu1jaKmjLpkD1w
TLSH
T15FE22A3F280CC77E4F844E5DEC26AF966EE801CBA6584D5447FA494C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ecccfa6181cebe943a38f71e83c4c72a90d5dd01b7fa1a97a9f54853509960c6
MD5 3ce7af292588625322e1d9f04f6abbc5
SHA1 26f0016d7b9f0b888c7cdf097b0a2dfb809d923e
SHA512 ae99d363177bdce6fbdf9761df4fa51201161351e5ad32ed75d1a5b7054a71017e903da72f96a0caf4f895e52c2ab449e17757eacd6c6bd3e2d6b7f0dcba9f8b
SSDEEP 24:Kdxf8nOardT/H4X7+eIjbHKiIffM9aidqa24qm+9Ijg2KiVha+21EImSm8MF8AnL:KU+IXK3lIlKW4wXypYIbKBKshNIZKmkl
TLSH
T1E291C29232BA02423D7F290D93969B1B1641B1633018F97B3BA840B65F67E635DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56f0fdf-0af6-481a-baa2-413f034af1b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e56f0fdf-0af6-481a-baa2-413f034af1b9.tmp
Size 13KB
SHA256 c4ea41aae021851beca67291d6325bbde3928ced93d90b33777e684dfad89c06
MD5 5db717cccbdc232b5992b6cd16a8ce86
SHA1 25c91539d1b7f4af26404fe0da214b49939f095b
SHA512 de2d3d29c586bbe65b5660f558db7c7281d4fafaf8b64e80e6c223ad9482776c2107d8335b6616bc5d445f887b1697350b8b2a543c715f19bcb931888168a26b
SSDEEP 192:sxZfRdyM/jK1Ml8MFJ/f4s+OGbIdpC+/W6+WN5CiR/Y0sHvjUIgrJ:sxZfzdJ/f4s3GEZ/b5N/5z9
TLSH
T1A552E8026B346A77CCDBD309F955BF53D6F91472D2900E44AAFC8A1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fc2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fc2e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c7b98d191905cd4ca14196741ac36d50693a453f3636fd05648ab04d048b257a
MD5 166f313b98990d2122c37f8516f80b02
SHA1 b2c8ea3c4a48a84fe014618abf6a6e61314cbdef
SHA512 495938e7e7f7c7a2cc6f37dacbfca4f03088109adf8aa185d56bf7bce500b8c51687b9c8a65ea1b1081a008efb468c76bca06dcfb2a9f8cd5186ff00a06ee489
SSDEEP 384:43yFaeO878NrN8XiZLor/E5N/5qRdTMyP6hE:43Izh7sy/EfAdTMyCu
TLSH
T1A1826B7178B8BDAB9D62A541F80B36139F7850ABD7D51F88C5EE5F2E0ACE2CC1306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3c39f18390a715d3c7f60922b15954285017c23f27c76f554685f11e6a37af75
MD5 dd2fbc82003bec8e24f51cf92b8772a5
SHA1 25a5239ff7064fdde0f57125c36f765d6dfc1831
SHA512 a3ef6886c3d742d5f5c66510841c504cead0acfa562fa16946894df01899f15217e33d686ce6004d635d9597f2db1a8684972cae93c61dad1c7666cbf8d53525
SSDEEP 384:9iF63yFaeO8N8N18TUNTUlIlm8XiuLor/E5N/5qSdTMyP6hE:0F63IzhNcwgLy/EfFdTMyCu
TLSH
T148A26C7268A8E9BF9D669A41F80A3213DFB440ABC6D59F94D3DE5E2E06CB1CC1307D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 704bc4848c70025ada31586439ef64b124bbcec4934cac295e1f845dcddc403d
MD5 874e7dfc79bd072e08b29f4ee1a930fa
SHA1 b1d66c49bc152eb803291c11edeb85f0accfcd41
SHA512 8b1087a072fd8e504fdbd3fb7276247cad36ebb5a2f8347e1332fdc82373b1c5c43f35be3ef5fd0b0c7c4fd6aa267ae37fd9bd24dcf5c2dfb8024ba65bec0083
SSDEEP 384:L3yFaeO878Nrh8XiuLor/E5N/5qBdTMyP6hE:L3Izh7ry/EfQdTMyCu
TLSH
T14C826C7178B8BDAB9D62A541F80B36139F7850ABD7D51F88C5EE5F2E06CE2CC1306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 372405bf038d6cdeb177a3faf3a02fadbc9624d6c2d788b969b2106e018dc7c9
MD5 ca1a20220e2c8773e8d9d2e5d5264a12
SHA1 174f63ae2f2c860b95fd06ef326bbdf57769710a
SHA512 08d530b6fea4b543e21bce8dfe31ce4a4a42d3a503665d854a4e6d383d1802d2bf2a0303c6d190ab218b509d3c44b4196a2fa15dd329f060dd7985cd65ae420d
SSDEEP 384:C3yFaeO878Nrm8XiuLor/E5N/5qBdTMyP6hE:C3Izh7Yy/EfQdTMyCu
TLSH
T113827C7178B8BDAB9D62A541F80B36139F7850ABD7D51F88C6EE5F2E06CE2CC1306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41bd42a663f81cfe369430921462802e0f84599a1463947cc8b03186cf6504b3
MD5 f71c29ece10bb6cf820d42303f0a86c2
SHA1 2c26fc4c15860b84350a04d9ca16a4a88fb1fc3a
SHA512 ebc984e6681ffa4a3cf42154794214c4d4e9bb85eed8b4aebacc63a4b9ed50527629978bcad8e25cc2ab1240a8c31651d22fc1f19b02d9a26ea2459390e520d3
SSDEEP 192:fGNO6t6H3cQmiUyH0u2Yq/rUH5m8/5q7/9nd2qXU6:fGNO6MXs82Yq/E5N/5q5dTU6
TLSH
T1BE12293578A8BCAB4D93AA50F44736138EA4517BEBC45F98D5EC2B2C01DF6DC5307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e87662f830dc20210600034aa8fd4a70e3797c59aeaccc577e5de1033e650a7e
MD5 191507c00350d4843328d460b328b6fe
SHA1 71a6a012634614faa9c041006f898c6ed7b6b1fa
SHA512 03c8b7d1c1a99d3e5c175f512b28160adaf0ed4fcf0a88942d9381a8cb7ff586daf0aac2519a171fecec4612a1386e3847976cfd78977c1c39283e725eed7446
SSDEEP 192:1GNx6t6H3BQmiUy0HBHu2Qq/rUH5m8/vD9MdNuU6:1GNx6MXfTY2Qq/E5N/KdwU6
TLSH
T1CE02FB3478A8ACBB8EA35E45F44777239FA4216FE7D05F88D9E81B1C01DB68C1302832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download