hxxps://bazaar[.]abuse[.]ch/download/a3cf60a275c70b3b79a12f40ef477ceacc35b66209856fafe770df228df08de4/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bazaar.abuse.ch/download/a3cf60a275c70b3b79a12f40ef477ceacc35b66209856fafe770df228df08de4/
Sample260907-j2mt5afk6s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332422789218619"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{0D52623D-80BD-4AF0-8C49-311F2A84FE41}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{820478A3-34ED-4308-B961-1E8EA2C389C6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5716	msedge.exe
5716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2308	1672	msedge.exe	85
PID 1672 wrote to memory of 2368	1672	msedge.exe	86
PID 1672 wrote to memory of 860	1672	msedge.exe	87
PID 1672 wrote to memory of 860	1672	msedge.exe	87
PID 1672 wrote to memory of 860	1672	msedge.exe	87
PID 1672 wrote to memory of 1540	1672	msedge.exe	88
PID 1672 wrote to memory of 1540	1672	msedge.exe	88
PID 1672 wrote to memory of 4224	1672	msedge.exe	90
PID 1672 wrote to memory of 4224	1672	msedge.exe	90
PID 1672 wrote to memory of 4224	1672	msedge.exe	90
PID 1672 wrote to memory of 620	1672	msedge.exe	91
PID 1672 wrote to memory of 620	1672	msedge.exe	91
PID 1672 wrote to memory of 620	1672	msedge.exe	91
PID 1672 wrote to memory of 2396	1672	msedge.exe	92
PID 1672 wrote to memory of 2396	1672	msedge.exe	92
PID 1672 wrote to memory of 2396	1672	msedge.exe	92
PID 1672 wrote to memory of 5028	1672	msedge.exe	93
PID 1672 wrote to memory of 5028	1672	msedge.exe	93
PID 1672 wrote to memory of 5028	1672	msedge.exe	93
PID 1672 wrote to memory of 2808	1672	msedge.exe	96
PID 1672 wrote to memory of 2808	1672	msedge.exe	96
PID 1672 wrote to memory of 2808	1672	msedge.exe	96
PID 1672 wrote to memory of 3712	1672	msedge.exe	98
PID 1672 wrote to memory of 3712	1672	msedge.exe	98
PID 1672 wrote to memory of 1312	1672	msedge.exe	99
PID 1672 wrote to memory of 1312	1672	msedge.exe	99
PID 1672 wrote to memory of 3364	1672	msedge.exe	101
PID 1672 wrote to memory of 4444	1672	msedge.exe	114
PID 1672 wrote to memory of 4444	1672	msedge.exe	114
PID 1672 wrote to memory of 4444	1672	msedge.exe	114
PID 1672 wrote to memory of 564	1672	msedge.exe	115
PID 1672 wrote to memory of 2472	1672	msedge.exe	116
PID 1672 wrote to memory of 2472	1672	msedge.exe	116
PID 1672 wrote to memory of 5296	1672	msedge.exe	119
PID 1672 wrote to memory of 5304	1672	msedge.exe	120
PID 1672 wrote to memory of 5312	1672	msedge.exe	121
PID 1672 wrote to memory of 5380	1672	msedge.exe	128
PID 1672 wrote to memory of 5380	1672	msedge.exe	128
PID 1672 wrote to memory of 5716	1672	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bazaar.abuse.ch/download/a3cf60a275c70b3b79a12f40ef477ceacc35b66209856fafe770df228df08de4/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f8,0x7ffda0b1c188,0x7ffda0b1c194,0x7ffda0b1c1a0
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,12639770410865910445,6145697593175944292,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,15051951811607439816,13266474070166431175,262144 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,5188628154549133229,9922042229940102339,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12135815874688713096,1476311190540105633,2097152 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4970032501185832702,18185229556861352217,2097152 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,2198770973916366098,11153107735857196403,2097152 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,12791591896490778035,1434910305142059359,2097152 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,7561859951180804023,11030900131587975241,2097152 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,1114329288514443886,5952377619213875751,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,12325015920921171688,3048826040504948762,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6270450296243994993,17149959646433357948,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6270450296243994993,17149959646433357948,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4936,i,8026406050954054060,5932951023613704574,2097152 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6372825221870805478,2610941002182124065,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Modifies registry class
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3055629223963748636,8028395690594956692,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,13054009066700714267,17668148582369279278,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,1658742762049341618,10689093790274205998,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,10900611492177717804,10269229985752542463,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,16688387417616020224,14666245718016151025,524288 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,114663573335301759,1833053268481122754,262144 --field-trial-handle=2172,i,2951304873835127359,14694604682722086039,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7d53d162538c1bf2242c44feba932f16c6e2f24af43f72a8f6fd2aa7a636ae2a
MD5 371e4a92ed79d820e20814b9dcf4f79c
SHA1 eb6f42fbaa85c2561fe26dd002b73fa1f1202610
SHA512 d773e1c56e35eab229cf3cb23c2a410fd6e50d0677395519f1c26fb55573e910ca1beed6dd88c489bd356ebb480262c091d37fbd3ef102bdd721d09381e325f4
TLSH
T1F471F61735824375E322863063D13BCE3870439637E39D8613BCA9F60D1DB95B176638
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59068e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59068e.TMP
Size 3KB
SHA256 4953d8b3263e690a26fbaca1bf325eddaeb0f9a1b96e2fffd3808ca2be913c0b
MD5 e3949c7ddde48888bfce6eb35ce52394
SHA1 fefbd1c0aa013538a8d843a0044daa08a5105b64
SHA512 90952a46809de0d67e389062b607e1b01ee7366a2c98d1187b025e79dcddebc107acb3ded38a2291d998c6c39b2737bd0a98a4bfedc0fe27d12ac0eb19b10f3c
TLSH
T1BA61D61736821375E362867063D137CE3470479537E39D46137C69FA1E1DB91B176638
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9cc31e85fa6b61957716bcf1cbc5cb5c96caeb2528e27d4d28687eeb5c7c6a20
MD5 7bdd1b991e6a48490c1a076f55284332
SHA1 d8e87513b7cdbd88c7c16c0a6add4ff353d84935
SHA512 52f4ab80242da302348b992755a2a2f5ebdf2fb523c1d22fe4a69af7d1dc1a3fed5d021696e6e1f0fd6d70f62c32d2ac883952040753839ae4903dd3627e1633
TLSH
T13B51D0F3C3F48A6ED91256F4A628BE1BCE5E0906432C7C0A85E4AF4B97F2474D142D5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eafb3fbf503919759fae7e88a8606e5c49dfbdcfd53ef8304abfeb21040ea23d
MD5 58f8e2e7edd0a13e75fb5ac1d9b7708a
SHA1 e697fba33c490bc10989574b4688761ffb63591f
SHA512 ef1939fcb5106431b9ee5f9540b27c4227ee7a2e6e1a83a40548e4ce0e93fadbd02224742075d78bbb0d5d1c23a80682c87235fbe3b04424bea68746c11d7f04
SSDEEP 192:sxZgROyM/jK1Ml8UQ5kE/fesrkRJFOIdpiWHW6+WNI43XY9IgyiUklIg5PAJ:sxZgUq6E/fesYRvdHbHXuC
TLSH
T11E52E8166A389A77CCDBD209F945BF53D6F5157392900E48A9FCCA1C00E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b1479f1e1c8f111d70c332cc06b23822a163d743ccab4c73c17cd7131272d2f6
MD5 fcc6354d8d16094007b9a760d211f6c4
SHA1 d0435bfdbc32a4496531ed110e6659cc4a45bea6
SHA512 9810f264d629c63b242cd81ff12f3071c11235dc155cc5c23319e3ec898871278e22d121a9ab278aae8fa796f62ffedee424d4679e38d369eaeddf5272dcada1
SSDEEP 192:sxZgROyM/jK1Ml8MkE/fesUkGJFOIdpwWHW6+WNI9v/Y9I1LUklIgrJ:sxZgkME/fesTGvXHbC/V9
TLSH
T16F42F9116A38A977CCDBD209F955BF53D6F9057392900E44A9FCCA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6dccf9122a91d42dd203d5161016a3f5b9281fc96400acab0b8a096421bd562c
MD5 1f9701d5f21d14ef35ba9488ae0542e6
SHA1 911bcbcbfc54c03699b49507654bc304f560b763
SHA512 63cf9e4c3104ce37165a261da7ed869473c502cc4a1f0823a652387ffe4c6a17a36d70f3d9f2396617b6412cc54a1cfc1dbafc5fa59967a1331dbce22f84013b
SSDEEP 192:sxZgROyM/jK1Ml8MkE/fesrkRJFOIdpwWHW6+WNI43XY9Ic1UklIg5PAJ:sxZgUME/fesYRvXHbHXaC
TLSH
T1DC52E8116A386E77CCDBD209BA45BF53D6F9057392900E48A9FCCA1C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8ad5785862efa84d5677995c71a71d66309f8aa05301475256dbaaa9b101db20
MD5 00e9543ef5caee6ae8d6ae78e237ef92
SHA1 3024f96872374392c01b1739a329890bdeb6b8ef
SHA512 10be8af55d60b02f9942de3cd735d6808c673330cf597cc707bedc1c8881422f828128573921b078703f4fa5e39ecf510160ac62552a23843bcf9efd835a22c8
SSDEEP 768:QNcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNDrowg6+:QNcv21wWvu+Z+u1jaeFLeRNwwO
TLSH
T1FAD20A2B280CCB7E4F845E9CED2AAF866DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e00d0657240b36083af3eb2663cacda99f2d7deedacb6967615fec715efaffb
MD5 5b68462c4d6209ccfc5d5566bfeba92d
SHA1 3fb93c49c40ad31a4515e7dae7b11060208df2dd
SHA512 774bba4d11fdfc14695f3f207953b3ad9b57ad5fd5f4ec9a91431703197abceaf9434e56a47d4195c22b9ca85e2158175e36330b368fa83f01d20c5ae0a13a72
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDQP0bv91l2n169lv2KNTlp253PCZPnCyEKo:mTQP0bv91lO16vv/Tlpq3PCZPnfU
TLSH
T1BC917A117237468238BD690CABE196765E4535E3381DB6BF7B7800690E2BE191CFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\71586197-5589-42aa-b6da-373fc2913cc6\index-dir\the-real-index
Size 72B
SHA256 57388ecbc76e231aaa575d96ce746a4129b052075727c53dac61b877bd24700f
MD5 e346a52cba9fd7d12c8091ffb85538b8
SHA1 211f7fe5c8712a1ab54291de669847842bddf3e9
SHA512 b03a9f23571aa09d5872b180094ec078b78bc2ad6f70fec5c33bae544825557d2b7c59a6358a70a1a9fa4cbdec9f1d5f872b54f0bfbff80a687a3dcaafc12a60
TLSH
T1A8A0022183C51151E0201674A04A0BE13B11CC500752474354D4818C9C926ED5961425
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59095d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\71586197-5589-42aa-b6da-373fc2913cc6\index-dir\the-real-index~RFe59095d.TMP
Size 48B
SHA256 08053aa3864f53e15aa89b051cfe2008b4b4788147d18c97fe2ba368b740a792
MD5 47c7ccc06ab9c99cdaddcafda49cac59
SHA1 31e86e3728b7295a72b3f74363ba5126d298049a
SHA512 20373efe1ad340f1a8bacd92f9a9d3a4d7dbd773a8ff7cc9c5046d8775c42194d4fcfd84e479771a9544a24faf4ba4f37e3a2061f8a82e445c84e7872defd4f5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 88B
SHA256 5e027e8b964dc0a846f0c21a78f181e6efb3640354e3474ffe9a33901a7aa0f9
MD5 8579357a8fe3f0e471e719711252cd11
SHA1 6c91afae5b6be803cf635454ff356e2bc5aa89aa
SHA512 1bf2e9d1f0cd9aec03118f8338afafa4ae552ab5beaca05a679d1d55e643ed7003e453c6231a8a7e9c1d03cc8e51a979248828a4753bd99a41d9c4199bdd143c
TLSH
T14EB002BF044155F25EA134FB400531DDC43332D85DD0DA4C8475505436104BE5006C38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58bb3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58bb3d.TMP
Size 175B
SHA256 3044b58313dbde4e69fc2fe0fffc47e86ab43535c1c45b579201c3f06b629f69
MD5 d37c28951a26979776ae94beb3787af3
SHA1 276f6da1f414c0322c7095de5b4dce34832c2457
SHA512 88c71959973cae9d151b56ed5f1b901efb1452baa0785eea84b33229d5bbf0262320ced4d043ff0b8c331f2fe61388e6a9385138ee75ac7c7661a6bbfaf53df7
TLSH
T1CFC0807B004585727F9A14FB410531CAC932BFE85DC4D54C4431B00923308591502828
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594145.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594145.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 e6c7ce27154433bc396a6530c9712d589335c0d28b647bbafe79183cc1a621c1
MD5 9cc7da4e7fbf28494f3dba5bead181ae
SHA1 97bf6148d459d6b59c1b9595c85e913309c7388b
SHA512 99c120d56c67ee897bffe4d399f23aca88d7df6447938a7e877d97b7f568199952518785fa555dab51573200ed5fb2cbec61e936f499c90c226801660ff66ac1
SSDEEP 192:ubLsN/VhQRt+YLef/QmiU1Drb4e+CGfOYofSJrRHJi/Nhq0qva+4LcYLWAduK:IsN9hUtziZxEe+CGOYoaJryjsa+VYuK
TLSH
T11B623B3269B85C779EA39681F5473213AFF851A7D2CA2E94D6DC6F0C01DF29C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 dc0590511ba0dcdca4c4104a958099787bb706bf13b17ef812fc1d60e3f7d570
MD5 d3c1b5edac8ae35af9cf465124220931
SHA1 6e9f0b5640507400ed23f608e581dd676ce31f21
SHA512 cd55625fe3490702af5509ad42d718586f6716b0af469e56a10a72a81adb19c226d342b864c04f0ba89fe64e0f09549243951c9d8ad43e8cf1e4e15386cb9a36
SSDEEP 384:7iFFsNI8TUNTUlIlhUtziZHEe+CGOYoaJr3jsa+VYuK:WFFvwgw9KP+OVah3jhgK
TLSH
T18DA2F7F259D78876DAAE8743E77E2D039EBCC063B5856950B388590CCCDA1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 81183a733906bd865f66a15cc3f5782ea80c95aebe5d756e8c8bf18fef7cb7aa
MD5 fd6e1253867f8b8ea63a2082f6cdaba4
SHA1 c123f333d436fdaf223cb8719566759d670a5f0a
SHA512 48cef567a3f9b120ed1c50d3f4fe5f33618dad97eb43d86e900b3074ed553baa9920bf7b02d24acb4414dcdc198d59cac8287b9e3737fd5700e13a2b3915c2dc
SSDEEP 384:7iFFsNH8TUNTUlIlhUtziZHEe+CGOYoaJrjjsa+VYuK:WFFCwgw9KP+OVahjjhgK
TLSH
T118A2F7F259D7887ADAAE8743E77E2D039EBCC063B5856950B388590CCCDA1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ee7be06fd5ecc4250a770363832295ba30dfb77e1df562f4cba64a7f1d27892a
MD5 e3009bd9a1ff4e7c53999c78af203961
SHA1 bf31b7db36a598c2fe9647ecab6bbc576a3750df
SHA512 716fed2c832172b6aa1ae6616551eefd5d4e23cf72005ac03bf82dae454d3920f746a593f8e0d7dac498be95f89313d209a6fe38b12ce3a8bf0a9ada717f2987
SSDEEP 192:JON46v+YLNQmiUy/aZh+CGfOYmus/N251U6:JON46vz/LZh+CGOYI4LU6
TLSH
T1FC02F835AD782CBB9EF2AE05F48737175FE8213BE9962F80D5D82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fef1a63eba2937e5b37c1045e231bcc25da211609b235235049ba3f45117ef36
MD5 c2a5b1722b877b84614021cd5548ce6c
SHA1 74ff0aeecf45fccd2e3945c94a68d5b58e6ed6e0
SHA512 1537d7a7d8f1a23dd3c023920b5d93e51b4fd65b564b7029c07c9d3b2c2863bfe6316eb61d160f63a103c6adff96caab4b4ac8a61653d230d5545cdc48bb76c9
SSDEEP 192:MONDk6v+YLBQmiUybaEh+CGfOYofSJrKCH/Nhq0U6:MONg6vz7vEh+CGOYoaJrzjU6
TLSH
T11A120A3269785C7B5EE2A541F48736175FE85127EA8A7F90D1DC2E1C02EF69C230E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 3e362f2f105c2f5f61cd334eb7bdc9c4ef7f52b3401ae6d5127622ae19d2f18b
MD5 3337f5e8c16e6b96ed556e58c6282ead
SHA1 00d6afa33457b00c447458e9a50c7630f96e0654
SHA512 dd75666183b4f86bff8cd35d1a89f88fb219768ed53872ac1faa4fe3967f148d60c8388e78de547fab7780422a67f09b88929bb5f4f30aee11e185e2d1e5fc33
SSDEEP 192:u3LsN/V0QRt+YLef/QmiU1Drb4e+CGfOYofSJrRHJi/Nhq0qva+4LcYLWAduK:IsN90UtziZxEe+CGOYoaJryjsa+VYuK
TLSH
T1AF624B3279B85C779EA39681F4473213AFF851A7D2CA2E94D6DC6F0C01DF29C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2218b915a2ad647014e8abcb4e179e1ee946f56948f778248117886113e9033a
MD5 aa7d1b242b287ba962616f573e612332
SHA1 cf32087735e768fbe90580c2bc637342967e09d0
SHA512 4e89d77bb23898e5d9cdae0d30a7c201c9c378b745a38984360441e097589a8d016720f0190e6d6a68d65698fd38126c6d5bf1f640d05dea7b3f1589ea3f01af
TLSH
T15A41D95CA6FA1108B3B7AE5AAFF7A56D447EB8372E06D45D10110E4F0A67B40C862737
MD5 SHA1 SHA512 TLSH

Submit Download