hxxps://normalsurvival[.]com/forum/index[.]php

Resubmissions

09/09/2026, 19:03

260909-xqf44assbv6

06/09/2026, 18:22

260906-w1brpacf698

Analysis

max time kernel
900s
max time network
734s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/09/2026, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://normalsurvival.com/forum/index.php
Sample260906-w1brpacf69

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
106	discord.com
107	discord.com
115	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3444	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331926847034726"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{BC8D916A-B400-4E2D-B02C-BF1D026B2065}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4344	716	msedge.exe	83
PID 716 wrote to memory of 4204	716	msedge.exe	85
PID 716 wrote to memory of 3444	716	msedge.exe	86
PID 716 wrote to memory of 4204	716	msedge.exe	85
PID 716 wrote to memory of 4204	716	msedge.exe	85
PID 716 wrote to memory of 3264	716	msedge.exe	87
PID 716 wrote to memory of 3264	716	msedge.exe	87
PID 716 wrote to memory of 3604	716	msedge.exe	88
PID 716 wrote to memory of 3604	716	msedge.exe	88
PID 716 wrote to memory of 3364	716	msedge.exe	89
PID 716 wrote to memory of 3604	716	msedge.exe	88
PID 716 wrote to memory of 3364	716	msedge.exe	89
PID 716 wrote to memory of 3364	716	msedge.exe	89
PID 716 wrote to memory of 2052	716	msedge.exe	90
PID 716 wrote to memory of 2052	716	msedge.exe	90
PID 716 wrote to memory of 2052	716	msedge.exe	90
PID 716 wrote to memory of 1912	716	msedge.exe	91
PID 716 wrote to memory of 1912	716	msedge.exe	91
PID 716 wrote to memory of 1912	716	msedge.exe	91
PID 716 wrote to memory of 1164	716	msedge.exe	95
PID 716 wrote to memory of 1164	716	msedge.exe	95
PID 716 wrote to memory of 4312	716	msedge.exe	96
PID 716 wrote to memory of 4312	716	msedge.exe	96
PID 716 wrote to memory of 460	716	msedge.exe	98
PID 716 wrote to memory of 460	716	msedge.exe	98
PID 716 wrote to memory of 460	716	msedge.exe	98
PID 716 wrote to memory of 4172	716	msedge.exe	100
PID 716 wrote to memory of 1880	716	msedge.exe	105
PID 716 wrote to memory of 1880	716	msedge.exe	105
PID 716 wrote to memory of 1880	716	msedge.exe	105
PID 716 wrote to memory of 3904	716	msedge.exe	110
PID 716 wrote to memory of 4004	716	msedge.exe	111
PID 716 wrote to memory of 4864	716	msedge.exe	112
PID 716 wrote to memory of 2424	716	msedge.exe	113
PID 716 wrote to memory of 2424	716	msedge.exe	113
PID 716 wrote to memory of 4348	716	msedge.exe	114
PID 716 wrote to memory of 2092	716	msedge.exe	116
PID 716 wrote to memory of 2092	716	msedge.exe	116
PID 716 wrote to memory of 2552	716	msedge.exe	117
PID 716 wrote to memory of 2552	716	msedge.exe	117
PID 716 wrote to memory of 4456	716	msedge.exe	118
PID 716 wrote to memory of 4456	716	msedge.exe	118
PID 716 wrote to memory of 3756	716	msedge.exe	119
PID 716 wrote to memory of 3756	716	msedge.exe	119
PID 716 wrote to memory of 2980	716	msedge.exe	120
PID 716 wrote to memory of 2980	716	msedge.exe	120
PID 716 wrote to memory of 1632	716	msedge.exe	121
PID 716 wrote to memory of 1632	716	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://normalsurvival.com/forum/index.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff3b8fc188,0x7fff3b8fc194,0x7fff3b8fc1a0
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,12185434544788609590,16101294589219730556,262144 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,12700805977333966520,11464746274655993738,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,3702089812859556722,5912530816994020346,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15792301217367647969,2035019558242196826,2097152 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16140541356480642410,8401980178268812036,2097152 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1710137074005814430,12524603719996552393,2097152 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,7099069578832574434,9539528066503631968,2097152 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,16078106727617683921,1621523817593323400,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8903652818269649879,11199719659363753404,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5760,i,14701409711851160535,15861182135213484906,2097152 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17871865941242262442,12615928303233684559,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17871865941242262442,12615928303233684559,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6420,i,3920238308149835804,8561509013512759477,2097152 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17561934322940536674,14859498031821417818,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,2444443916912901618,13857919333522704490,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,7296594178225800403,16073149642054236434,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3248,i,10789821389180133581,5572425074873549077,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,6874034674643017169,2056143674150194011,262144 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,18287564909531263299,10146441759093226470,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,9298705616515729987,9997859621695254364,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15838604561904128617,14782121575824281757,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,10587124095289943733,3204055526465233281,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,11433847543070673465,18136816461441961661,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4075200528402361265,15564306227167248390,524288 --field-trial-handle=2456,i,17568573952531271232,2926859980069235402,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 45446bc9071cecbe0332dcf8d1b255a9387ee24142c2d0b17d4175a9d7d76c15
MD5 9d565df7ddf4f1f46086df2fd9d7aeb4
SHA1 3f576cbc82d822880351c7b76433964e6a891664
SHA512 bffbbbcd383752f37371718a338e8d9d2b0796b634336ea667dfaadf76211a0c0d8e0cfe1c0f9bb117e79a5c334a51f7d819c2f41312575d83548aebe949139b
SSDEEP 192:ojS61k3kkll56ss9gggxmAAAAddddCCCC3M6LO:ojS61k3kkll56ss9gggxmAAAAddddCCM
TLSH
T162E1694282D4CB9FDB0A609A49A4639C44B03B0AEBDCD60C039D8DDD354F89BB9B56A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1f531c450dd8b73dded9fcade5586bff038f32574685e43d4fda85cf20de7a23
MD5 1bbd944e82f45cbef48ab9a25ee4f245
SHA1 f39fca83017d72da567293e39bac724693fcfeda
SHA512 2219c9505c414af34e2259c43daa3dbabd34d86819ca50db756ac3da114183094b2b21bebbf9b1a7b9180ae123aa26cd0a654bf91fb6fd3b8763ced914607d32
SSDEEP 192:njYhSz2d3/zJLsoeKKKhhhhhhhCCffrO1+FMxLO:njYhSz2d3/zJLsoeKKKhhhhhhhCCffrH
TLSH
T1EDE17F5382E9CB9FDB15208A49B4A39C02B13F0DEBDDD64C034D89DD344E99AA6F57A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74c60e88c2393e906703dc3f7babfd89fdca880896fc6b9710dea68692672dc2
MD5 8d024b432b393a0dbe3285caae72517b
SHA1 c4fb00c4b261ee66c8c1881e3b563c7433894e6b
SHA512 4b4aa8d88c4466558033ef07391bab02af0a27d9bb86dad8dee26c772b64ad648b7ee5403a9347743a4a2477dbc8da66beda4ed484f646b3fc97c0a79c25bd14
TLSH
T12C61512402711059EF930AB1B0C9261A3AB9CA97F7C75FB202B4E87DDA0D7F719D404A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5886de.TMP
Size 2KB
SHA256 b7c22d0a5968d02b057e864f7bdd429aaf84a19be27e1803111db43256efa3e1
MD5 6eea96cc2ce0d64d8e836a864add3a86
SHA1 ff26263baa186c9a6735abbc94fd2449cfaea122
SHA512 77eaacf97fb959addba19c239d6148ea1b2d9bddf6d5c1b647cb881df44f60721d934f4a540577e2e1d6b9c5f825bcd381e2ee4ec3eb27ddcfdd1c438cbaf0b9
TLSH
T1B5512D250271505AEF931BB1B0D9231976F9C297F7D35EB10270A8B9DA0D3F36DD015A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1163fd0ccc1df4d1318b10c0064848eb12b3cfaf34be5185b09f0319eea46848
MD5 804e3109784305c18f63a25aa619a400
SHA1 a3b430b7e1fd3220f5f126af4116b6ea41b2125d
SHA512 b238ada463a477bcf049c23746c917e4f13aec2bad242ac1948ea1d9f00f17580854c72e74c6bc9cc98a31f37cb71b7882d07e274283bf28745bc1dabdd80bf3
SSDEEP 96:D/O0yIzz9DJ/JzeSBJjJmzB2FBtDcMGOblGx2IhimNpdRL4PiFbqFPiPPiwKAGjs:DWLIzz9DJ/JiSBJjJm12FBtDcMGilY2K
TLSH
T1D1C188B753B983ADCB1192F0F50CBE1E9E1A1514436C3C8EC5E89E5AD3F1661F181A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9f4c44e6b1b693e67a9a8f0391fc03a6d4b16d57a97558d5e0402e4efc09989c
MD5 23a064ec45dccebafb82a76faee8d0ed
SHA1 1305d7fe3485f29da25193630ca24297ed7d63bf
SHA512 d4fcc7c1bd78e80ded6e7a5d5263ea588cf1768b87c90069dc6e4793323499da971acda66a913e65b68e8b95d4ff2a57800d63786210f32db685677360f191d4
SSDEEP 192:DDEk/fQSJWJRvPJF512FB2OkMUilTC2IhdHmiTL4PJ5cFP8PPiT:DDEk/fQKWJRvxF512FB2OkMU2TC2IjHx
TLSH
T141E196F7C2F983ADCA5252F4B61D7E1ECE1A0914526C3C4FC4E89E5AD3E1560E28190E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b78abdd2a9ccad563eab168a2905dd0915a09f7e4ac619aa0bea44b3d8648703
MD5 326bd9149705a49b6a7123dc60a57f81
SHA1 3d31eb3eb98cf62044f245b50cf04d38ee6659d8
SHA512 b81cbe3cafb2c7222f1a54a8c1466a329a1f1032d2d723109dbdd370bc7c3440e3fb411ca45d8859dcfd06ade7a00cab56a5939abc76a63f6439b0410a63407e
SSDEEP 192:sxZsR0yM/jK1Ml8UQxk//f9sE25bUpIdpTUHW6+WN1kmM/YrlZwxm6Ig5AJ:sxZseqC//f9sEcbVoHb1W/6INq
TLSH
T1DC52E712AA349977CCDBD209FA51BF53D6F5147296900E44AAFCCA1C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e3001db78902e350bfe74af06c5d3c1b2946577b5cc4dd69867b8fcdef3a4f39
MD5 1cbe2022781fb086e8d32caab96bbdcd
SHA1 26c4e8c35222328af06dbc29846b8645335c6866
SHA512 f9cd6a5653706177405aafcd2dce614e84e04ad5fca6d3dbc0485cd4452028e0645d0b05349c006c5c7d7def64d079895a9c0f414602d10af5998245c6968adb
SSDEEP 192:sxZsR0yM/jK1Ml8Mk//f9st0UpIdp5UHW6+WN1kmM/Yr5ZBum6IgrJ:sxZseM//f9st0VuHb1W/6KN9
TLSH
T14F52E7116A34A9778CDBD209FA55BB53D6F91472A6900E44A9FC8A1C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6cad2b1bc44db7353da9620a5b1f5df07e7fa0acc9e11a9947124b7004a0bf1d
MD5 9255a71b44d77498cf510433796e581d
SHA1 4ff8339049243358313facfb83f2d1ee741e3bcc
SHA512 66d43945221e95bc8d9779e48c43ef6cc5f7dae55404aa4dbcc7b13b5b175aea20033929252325f7505b845aeb1b3637b80e7daddfabd22438719a948d50fcaf
SSDEEP 768:WEHsgL6XeWviSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRHMroWZWTJGaS:TMgL6XeWviSnqu1jaSJL7+R3W0GaS
TLSH
T109E2093B690CCB7E4F840E5CED26AF876DE801CB6B984D5447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e4e25865-a059-4a18-bd2a-3d9ab115cc01\index-dir\the-real-index
Size 432B
SHA256 6f26fca0d4401c84179b8456663ff4dd89c403264e7a702d948a3ec8425b79df
MD5 369c0fcd1fa222a1331518d371fba97f
SHA1 608337d105157c5215951f7cfab589e8f2f498ca
SHA512 3447f236ffe2ffda1b7425d53d8c74622831b45741f816a6f0b06754412401649a23a9121d0f913c675c202cb33d9831153dd6974fd3a7c0479e09aca85ec800
TLSH
T1EFE07D514EE11C26E5240A7A2AB789E8B2B10FDCE344EC12357C486E7D1934825A72CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbacc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e4e25865-a059-4a18-bd2a-3d9ab115cc01\index-dir\the-real-index~RFe5cbacc.TMP
Size 432B
SHA256 e5dce4d7a70858e2660d88aa192fca829ebf97403ba4f6c539ccfd8cdda1e04d
MD5 c4126804088b4c45726ac9bbb6d452d6
SHA1 92ddc37ff339090b021ff1cb1aefda4547dbecd9
SHA512 292dcb78f067ac0a146ce7923790fcda5e531021eea26cb1a7d815b7ce6ad9882612e3da18812ac9825246da3746642b99847eb55ab8aae2410c1e577f419252
TLSH
T1ECE07D95C7D24821D458057B3DA788ADE2718A80A255F553353C582E5D2578456520CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bd5da10c6f02625fc5c6f3dcb9738df2bca642eacf0d778772528ec963586c61
MD5 9d796a8a5629299917db9e57e23f05ec
SHA1 9ec9fd8a6cbf03cb1970acbf33628f1310842858
SHA512 fe3a5e8d2bf6a5ade3ca9043fa75b23f19ca622a1072ff8de941792134feecf0fc8ad0ec5926379c85dccb49b3fcc962d8acc0655bb395715de2e7b06f5d7046
TLSH
T13AE068F72CEB0924ACBBC3D2143208A4814079948548ED4E9029928301B23092019C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a2d2d08c3e4924e5bf7cf0ec6377ef01d15741395444e700086ebe5ee86b96e
MD5 b3ed07f960aa40e767a044473fd04baf
SHA1 9cc6608916227b7fc90c3a5a0990a738c908230c
SHA512 a09b91fff03fb3a4d504b8d9bf2107e277f14180e364668c1eb1e196f02ac89158c946b6257dfc89ef5bba3ab1ac0ee2b543e9a809f25ba4666a199f277be40c
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ58xIJKCsELy93I5K0wE8c:KwX+KUsSx2KCsaW3iK0wjc
TLSH
T1CC916649323B420338BD250896EAA6779E4231777528E56F3FB910D64E27E116EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590555.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590555.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b346a0b354e797c7492d56e5f81a898e42144cad0364a6ffa2eae0b58f14a931
MD5 29a40a317dbb26290beb405c94ef6b36
SHA1 7ce132074cbd35f79806cceb03691d7fc7cfe125
SHA512 491dbc821201a74d483bad332b57ee81c0f40187dc1360546c5393baf4ceb23a84b035a5cde3e27bb31fed4a0bdf75a742739fca634a1ee4f98fd2c64dba09dc
SSDEEP 384:liFiZcIGsNe8TUNTUlIlkYVRg87Jb9uO8F++Yb3qsa+VY2jlGoX:sFQGXwgV3ZnSPYb3qhgjIc
TLSH
T169C22AF259D78836DDAE5783B77E2E024EBCC067B5846954B3C85A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8b86b835d3becf177a92187353bde591fdfb53b24929d10b96b940f01ac890a7
MD5 8d2537d021a6a0a86047063f5fa1818f
SHA1 14e50495057ae4dd2070de326662d86df6ef0fef
SHA512 1d485e3071624c32a2f3cbd1e9ec54ca4baa609f8689e4390a99bc789e6e235cce5682d98f6e29358891cd464b2a16a45a59dccddc8dd19913b07c3d182917a1
SSDEEP 384:BZcIhsNOk5VRg87Cb9uO8F++Ybuqsa+VY2jlGoX:JhQAZnSPYbuqhgjIc
TLSH
T18E826C766D689C779DF3A681F88736178FF48067A6C83E5495EC6F0C04DE688230692B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 856010b23fbe7f7ba4231ef0f52e8506ee28b6748c7c45f44b38e3119e642809
MD5 b214c99432d715f56465f5deb0c5c5d8
SHA1 6c76c0551dd1e27ff46e667eb6232e884cf6ce5a
SHA512 f18770259d417cf85ffa170a9cf43842eac6b1553be54d7011e40be915bb268fb9cc24e1aa670651927dc124d33a7044e48c741ca27b5a39e139d430a80b56bd
SSDEEP 192:YON16LCWtDQmiUyioILSuOCzLc2+jdsE7CU6:YON16mg10ImuO8F+7mU6
TLSH
T17F02EA3AA82C6C779EF36E45F4873B275FA4103BE5902F54DAE81F0C01DB68C2302926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b81f50bd3e180e58bafa9164adcaefcbce64cfbfbe7caf8bfe05e447c43e3465
MD5 0fdfbdeeee6410cb7c8f5ba7c63d225d
SHA1 4cb2aee9444ed2c41f49cf88d01a6318e3b2eacc
SHA512 4b9b3a23ba17b6aa40b5c5b8947cf97809e67accd78684117aa68209a61e1d325555e62001fa3ddef8bc5ba30460b137621aa38f8c4b42e03ab65530cca8733e
SSDEEP 384:2ZcIhsNOkYVRg87Cb9uO8F++Ybuqsa+VY2jlGoX:khdAZnSPYbuqhgjIc
TLSH
T118826C766D689C779DF3A681F98736178FF48027A6C83E5496EC6F0C04DE688130792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f649195d550bb0a05a191f7b394ac1bd9b9defd02ade53096b0ce1292d99165d
MD5 4041cb445fe3b28cf7cd595d1a2d99e3
SHA1 72199c2f07a73acc5a7ce60eb863e1e773058f5a
SHA512 8db07ddb0e34f6c3b81a123f923096e705c5ff7f87752598a871b88e590fc5621b44b500480877bb72381fccdada71f74648fa005901fe180e50d70da89b7d33
SSDEEP 192:/ONn6LCWtKQmiUy1o5LSuOCzLc2+jKYb/I/Uq0U6:/ONn6mgGl5muO8F++Yb2qU6
TLSH
T1CF120977A828AC67AEE27981B4873A175FB44137EA843F54D5DC2F1C09EF58C230A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9859ff5-9f31-48a5-a41e-bf112ad6fb9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d9859ff5-9f31-48a5-a41e-bf112ad6fb9b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a72d3b03f02cba25e75e0d10a7d38ce67e3349616c21a66bf6e046e44270dd85
MD5 7a1d495911bc149b1d67eb6017e68f53
SHA1 b5e5a87d59da959adfcb277a897538a002e8819b
SHA512 2dc78b656b61fab674d5a8b497b007e5f4bbf52002ff5dcdb882f6075a0e7031db2f5db4af089a24dfbf85c0bd786906d0c9e3299d3583b920be1dbcd35c22ad
TLSH
T12D412858A6F91108B3B7BF1A9BFAA87D887E7C621E06D45E00110D4F0A26B01C861737
MD5 SHA1 SHA512 TLSH

Submit Download