hxxp://Facebook[.]com

Analysis

user interaction
yes
max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Facebook.com
Sample260909-tk599agm2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1484	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334436952896864"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B8F6066D-D69E-42E0-9D5D-DDC3B41D765D}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1748	4536	msedge.exe	84
PID 4536 wrote to memory of 1484	4536	msedge.exe	85
PID 4536 wrote to memory of 5092	4536	msedge.exe	86
PID 4536 wrote to memory of 5092	4536	msedge.exe	86
PID 4536 wrote to memory of 5092	4536	msedge.exe	86
PID 4536 wrote to memory of 536	4536	msedge.exe	87
PID 4536 wrote to memory of 536	4536	msedge.exe	87
PID 4536 wrote to memory of 1800	4536	msedge.exe	89
PID 4536 wrote to memory of 1800	4536	msedge.exe	89
PID 4536 wrote to memory of 1800	4536	msedge.exe	89
PID 4536 wrote to memory of 4860	4536	msedge.exe	90
PID 4536 wrote to memory of 4860	4536	msedge.exe	90
PID 4536 wrote to memory of 4860	4536	msedge.exe	90
PID 4536 wrote to memory of 3868	4536	msedge.exe	91
PID 4536 wrote to memory of 3868	4536	msedge.exe	91
PID 4536 wrote to memory of 3868	4536	msedge.exe	91
PID 4536 wrote to memory of 2632	4536	msedge.exe	92
PID 4536 wrote to memory of 2632	4536	msedge.exe	92
PID 4536 wrote to memory of 2632	4536	msedge.exe	92
PID 4536 wrote to memory of 3364	4536	msedge.exe	95
PID 4536 wrote to memory of 3364	4536	msedge.exe	95
PID 4536 wrote to memory of 3364	4536	msedge.exe	95
PID 4536 wrote to memory of 1952	4536	msedge.exe	97
PID 4536 wrote to memory of 1952	4536	msedge.exe	97
PID 4536 wrote to memory of 4516	4536	msedge.exe	98
PID 4536 wrote to memory of 4516	4536	msedge.exe	98
PID 4536 wrote to memory of 1920	4536	msedge.exe	99
PID 4536 wrote to memory of 1920	4536	msedge.exe	99
PID 4536 wrote to memory of 4228	4536	msedge.exe	102
PID 4536 wrote to memory of 2920	4536	msedge.exe	117
PID 4536 wrote to memory of 4228	4536	msedge.exe	118
PID 4536 wrote to memory of 3000	4536	msedge.exe	119
PID 4536 wrote to memory of 1240	4536	msedge.exe	126
PID 4536 wrote to memory of 1240	4536	msedge.exe	126
PID 4536 wrote to memory of 3336	4536	msedge.exe	129
PID 4536 wrote to memory of 4540	4536	msedge.exe	130
PID 4536 wrote to memory of 4540	4536	msedge.exe	130
PID 4536 wrote to memory of 1140	4536	msedge.exe	131
PID 4536 wrote to memory of 1140	4536	msedge.exe	131
PID 4536 wrote to memory of 1344	4536	msedge.exe	132
PID 4536 wrote to memory of 1344	4536	msedge.exe	132
PID 4536 wrote to memory of 5100	4536	msedge.exe	135
PID 4536 wrote to memory of 5100	4536	msedge.exe	135
PID 4536 wrote to memory of 3392	4536	msedge.exe	136
PID 4536 wrote to memory of 3392	4536	msedge.exe	136
PID 4536 wrote to memory of 2324	4536	msedge.exe	137
PID 4536 wrote to memory of 2324	4536	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Facebook.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb546dc188,0x7ffb546dc194,0x7ffb546dc1a0
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6243754391887063488,2300245551776868385,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,13592171525656591057,14470622279596925505,262144 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,15977452743013275817,2353204288546226068,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11447601109131194775,4737445859220668958,2097152 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10341479746197160410,15145458639971617344,2097152 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,10210193788379529266,9007096692119941235,2097152 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,17853586993940374028,5601283136485719774,2097152 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5044,i,3652338638022409353,11421011096471202020,2097152 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,1974082388693761206,12609118906995591146,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,13730278304033620781,11050567766356540756,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16386127669196277337,8332445359087685101,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6854799735372714743,3874006527270423307,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6854799735372714743,3874006527270423307,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2903401053185266770,505649218480312178,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,7633335455121605965,1634740061896683469,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,3302311107671689364,11699118145953565442,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4072835974133447183,15319968923349821500,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4288,i,10311405598001924018,15022579603641658543,262144 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,1176894691342613029,16468749828016309291,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,17332785444552241809,10090470798630874519,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,15393126655401694272,848406377412317504,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,9366198305598930653,13449468475654048980,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17338974432803688557,12607991440306632804,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,6709820960431947993,12344871510076686686,524288 --field-trial-handle=2664,i,7846652801420804986,17565194801852610929,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 6f03f3dbee7270783d55e0634a360c2fea79fb585b7c5490399ae1d3ad78d5aa
MD5 9d0434d701c8a0af04164eb1ef0964f9
SHA1 657f218a8ff80287752687a09b466cd94795cf84
SHA512 1c8d35a5486a28ac298c60ebbb2690fd9ebc262957dc1165206c9586d7c6b3ba742524a6731b3e5a61a1c62d05de1f93deb179633f8aff2dfd7e16d77ead06ae
SSDEEP 192:Zjkv4LLLLLLLLLLLLLLLLLLLLLLLLLLLLLMVLO:Zjkv4LLLLLLLLLLLLLLLLLLLLLLLLLLj
TLSH
T127E1EF0746D8D69ACF5950CA4AB4AB8E00F03B4DEBDCD618674DA9CC324F4CEB5F16A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1526aa9b6e63f36c9b3781b332145a644cb780e10ec7871cc278118dc2fee7f6
MD5 0c52f4ae4ed4133ecbc3c0e6fa9a30dd
SHA1 49751f1ed1772f2b1e8ae15bdd48e518627a4061
SHA512 933e271a5ecd0379224053b945aea76d3a20df6dc74a09b7c525f75acceef52073cdb31be837fb1de7384b7a3e4b439ad07528db20eeb3b90b40d38c614b8d98
SSDEEP 192:2jcXgMMMMMMMMMMMMMMTTTTTTTTTTTTTTTMRLO:2jcXgMMMMMMMMMMMMMMTTTTTTTTTTTTv
TLSH
T189E1710B86D8DB5ADB09509B49B4779C00B03B4DEBECE608134E9ADE314F49EB5F56A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1741ff6899df4680514a0db580f33f8f86391cb1c77a5a1f083f5d5505dbadfd
MD5 389f324d722153dd43622758678c30ed
SHA1 ee2b5c40af7d1720e0fed4b87f0215b3a0ac0609
SHA512 7b9e2636a2b861884b6fc1f73a5a9131cc12d50a08b4e3f8bc13dc57074d14a2862b1f30fba39f3c0a17225ebc2b12f702b0e55b4dbca7213f96a2bf24a5d862
SSDEEP 192:LjwfVf0fofofofofofiZn00FkFkiRiRiRiRiR888888888888MQLO:Ljw5MIIIIIiZn00FkFkiRiRiRiRiR88+
TLSH
T111E1B20646D4EBAADF1910DB49B46B5D50B03F0BEBDCE608034D9FD9314E89EF4E26A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d4632ba1ef4b839532f3fa2fa29b9225907df66450fd1b2c85a1637f9896297b
MD5 83681dfb07458111b8a949b3886f3aef
SHA1 7d5a7e6d8b6ab34dfacfd66fa86b1fdadfee756a
SHA512 248576027c6e0fc570a59b80e9d0ad34f030702b8b4a229734f2f36314a54c6a79c4f3204f650af4015f9cb56be6f921027c6a3f7f939cf92687643b0bb4ab9c
TLSH
T1E96184340D418499E760CAF5A2F1F54F7B72FAF2F833CEE95042A4321A227B143D5188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59477f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59477f.TMP
Size 2KB
SHA256 b1a4854b89bdbf9032f20588d3e6d9ebb7e86e443f21bae792ede03520c0fce8
MD5 67a3647e1a5ba18e3a8f0ae9efc577f4
SHA1 3d4faa53cf0f2a5904208cf6a26340bdafebe249
SHA512 e29f02054f0d6e59c172bfb8393351933dcea525d15c753ae4570b3d0e0124af2a5f04a8ee071dccfddcac154c6ce954bc10ae93083f5aa3712c5939dd7b1814
TLSH
T1E951B5340D018865D760CAF1A2F0E24F7B70FAF6F873DEEA545354326A1273143D6298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 52c49920bfa7a02beb0dd6a9a177e7ba2d22ed6e78c4fdfb8ff135a6e3b13ef8
MD5 3a55d86f153bd2dc5aa27d988f86310f
SHA1 0a61018adcbce97d33351625a0d11cecf30d4e5c
SHA512 4b8f5d00057754ca33528bb0842a10bcacc6812f3ca5ee67027fbcf42f654826128efd6e93eaeada872b93d9ca8650c91789524a0765ca024199ebb1707877ec
TLSH
T177616CB6C3E5866DDC2156F0AB257E2BCE1D0915532C3C1E88E9AF67A3E2070E101A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d694de80698e854fe2dcfb33911d48f6ed9ef4a081c0fba20f42eee4abe974a0
MD5 4ec82662fd9922dc7f4e8e6f88a0c299
SHA1 96d9ae508ad271e7342cd0c38c02b3d38b9cc392
SHA512 9772ae5b9d5edc84feb99ad27b3492693f02c8bd06ed1ea778444e576a5c90e97f9c4b3f95e2b42e1ef411f6abadce22ad6aaf05b596b2da5b7944ab9413c4d6
TLSH
T1BD517BB643B1966DED2196F0AA15AE2FCF290811535C3C6D89D5AF63A7E2030E041F5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ca0c94c279c64e5ba906b845b86dac0e6c4cc442432a96f95d115da2e777c586
MD5 5515075a2daeb4eef2b46387c8871c8f
SHA1 ecf4a48e0ad30e859789c81ee31b28ab8a48ecdd
SHA512 0a07112d0179b516e267beaccbba286a39a385fe09177c13fb7315778332b0302baddaadb33ede6081bed70233be8e0c6298d744e641d169822452d627674729
TLSH
T15D5159BA43B1966DED2096F0AA05AE2FCF2D0811535C7D6D89D1AF63A7A2031E041F5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d8b1c706cc3a3acd5811e7638b7ac98093d78508035f24cc43938b5a9029689b
MD5 c1dd5c721ec0adb90b75ebad967c7c8f
SHA1 4d1aa81f8239eaa4d553b8e0f1beda4ec46f4cc6
SHA512 f79361360e32b970480d59f13c7ef20c1e631093d7ea4090dc940bf52537178b52c459c68954e812b88e3cb6161bdf8717d3b341c5e88a8942f69c8bb3f4b792
SSDEEP 192:sxZEhRsyM/jK1Ml8UQMWI/fQsB2qIdpfQKFO/W6+WN08LIXY9IbhL+UIg5tJ:sxZg6q3I/fQsB8D6b7IXxnB
TLSH
T1C352E816AA345A77CCEBD308F941BF53E6F4457296950E44A9FCCA1C00F6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff34d6dcec52e5c5d6bf54c6a56770c477ebbc2b2982ff1449afbb2b4143ee85
MD5 6edd55ffb80c1d292b86683a1da65854
SHA1 fbd4d0d633455eec61163ee54b3eef0158f5a68a
SHA512 b028a806c29b583909a154e04f601c69a32f8bb1caf78f919d65d71bbe7eb1102e0bd309ab80617359400cfa3bfcbcab389a36de7d031f15a45d1800999c6cd4
SSDEEP 192:sxZEhRsyM/jK1Ml8MWI/fQsx2qIdp5QKFO/W6+WN0Lg/Y9IHCL+UIgrJ:sxZg6uI/fQsx8p6bX/Gn9
TLSH
T1AA42F706AA346A77CCEBD308F941BB53D6F9457296950E44A9FCC91C04F6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c2610103e3f26f6d22d33dc58bd1f3baf89f1d6de6c4dc649f754f5961ada7ba
MD5 d7dc761ee4a5f28a1cb3ff8e89da76a6
SHA1 947a78dace69aeb99b885069104688eeff23acec
SHA512 3043ece822a78d64712f9d08ffbab995be8dee19a8bf1b7f6c1fcc3442870bb9cb9907922d4828b830a1af555799a05a36c416312669e15854b6c96d1c5eed3c
SSDEEP 768:rAcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNIrohg6JDp6:rAcv21wWvu+Z+u1jaeFLeRNzhG
TLSH
T1B9D20A2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ec2e93e-5d63-4ed0-ab40-e6749ed2110c\index-dir\the-real-index
Size 720B
SHA256 87e4d5f47389e74e71155c47d95ff4eb15698457ef5d9057cb0b717d2e0c06f0
MD5 dca50095c97e3db545ddc25d67d75a8f
SHA1 2d000bec452714a8ab7f0a241cb7b879eb115fe8
SHA512 ca35c703fad728e1ea5fcaaacdc44d0b6194a0e11adb0f9c98f1ada6d818908df1461d4e6f4d214bf5b7c4dcb74780133e9434d8d2aafecc9bbc917d659aae67
TLSH
T14E01C0466EB0496BF9924673187450E47371C9DC5326C027542C3A173C6630D75165D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d761d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ec2e93e-5d63-4ed0-ab40-e6749ed2110c\index-dir\the-real-index~RFe5d761d.TMP
Size 720B
SHA256 2458913ec02c1aca8fcde6788fef5301799670af0026c4125778a4852f275433
MD5 6afc03eb2e092d4279f95c83a4219f1a
SHA1 c1e546fb4a351d248292f285474a231ee67425cf
SHA512 484b54e175ba6a652704b5a54859a19de846bd0fd61557502614565b0922d7123a7d6c0d9b4555d954ed9412f57f730333825a0389007658919e30320d2fdf2b
TLSH
T11001058546914D1BD8914E76089110F47335C9106222E563607E292E5C3978859470CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 188ad5f69779adc1701705b1939f2a796d0ef5248c564fe0bd3eb451e6194af6
MD5 d8531618b454abf072f5ea317c5a9338
SHA1 166073312cbf4abc2e2b7b34ad337f2b4a7445db
SHA512 a0f24e550e2cad4a683941395530caae8926f01129473e8b931b4b7b2ad4651ce09944af6ca8430685ec1c274dd12a9478a912ee0367b0b074d0ef1fd58d9063
TLSH
T1DBE0C0BA2CFB2820FC6FC3D7247144E04003B848CDB5AD9F4469D6C720A6340752BCA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0d6ca0c06923b6eb30eba57360efa3a1f0e2c6b072a22b0ab0530696add7c672
MD5 53edaba88333899310928037656d8534
SHA1 0be371c340a16cfcd057108e38586318389c8af0
SHA512 d131a4b378e3c5fd4d1327ab85a0e18810c022fd5b524ad9e21e1ce68214df321597ac0d581bb852505427c23841884972bc29886ef4b680fffe3034ff7a8480
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygha+IOKb5azq/WbKni/kbTgYbyqomJCKb:mTdBJVng
TLSH
T161B1E535333B1252397D6948A2A58B374E8132633814E56F7BBD00A54EB7D216DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c47f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c47f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 61d0049fd76069a51f1e7b5f07701df0fd92e8646ef27130543033cccf9783da
MD5 2c728da5eae5bb2989a506a6db9c2034
SHA1 bad9a63f6e9479caa54841d61adff3012f218cb9
SHA512 14b4500a96c10ef9e7060a22d20d658a809d359397706498e9b9b962d843b57da911d9743f5c7b503a77d4e585439ba94c8e6a9bfd4a0d29f4970a98bb0f0942
SSDEEP 384:SZcIhsN9UzqTziNzTe+CLOztResa+VYtlOoB:ghgvayTOztRehg16
TLSH
T198827D716D745C7759F2A685F94736139EB880A7EAC93F80C5D8BF1C01DE6981307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b6d91caf8b37150d5417df0e461c8bc513e1e54eed2816bed2a73aaf79723e6b
MD5 1daef6b4e98a9b835f3b4ab424d1c992
SHA1 6cd3534bfe5c4a38a97234b7ef7f693df6d0185c
SHA512 68e469798a70695c4d97929baa8d790471267103b3eda2d77d7fc910e1c10c21f198c8d004919174b91859e1154f1d21e3709946ba725391f4cd785fc41a35f0
SSDEEP 384:9ZcIhsN9UaqTziN5Te+CLOztResa+VYtlOoB:lhDvUyTOztRehg16
TLSH
T116827C726D745C7B59F2A685F94736138EB880A7EAC93F80C5D8BF1C01DE6981306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 da1f457beb64ecf9024850e61d098801b3a6979ed859195f0dfec2b2f9c46ba0
MD5 a66141df21e3b79ad293738da2b4c595
SHA1 96e0d8bb8c885e982817a77680d25247b6a4b1cb
SHA512 98503347b7cacdea46d6cb9fb1e4c0c87c3e3b9ce66a1ead90e100cc6e19aad84554a62fd1b078522a19ad84c847cf9db62ac2c8e3430516aef0c1012fddf896
SSDEEP 384:DiFiZcIBsNu8TUNTUlIlzqTziNhcTe+CLOztyesa+VYtlOoB:uFQBvwgwvacyTOztyehg16
TLSH
T1E9C229F259D7487AD9AE4743E77E2D138EBCC0A7B5856940B3885A0CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3c3805e697feb1389110a136580aab1b323be20388bb4d8716ecb5785ecb3ca
MD5 350f0fd1d8ab363f8c56b5b51220384d
SHA1 a5dad5fb182cd2a6a4bdfef65956bc336b65f461
SHA512 cda3bfffef87c77138f376ea87f695d52a13b585eda0c98d8bfd723d7648206a356da2fcdfa01bc810b649216fb208f56aba95987b3e332035db410fe33e1758
SSDEEP 192:JONl6v+YLNQmiUyr2Zh+CGWOFmRMusDrU6:JONl6vz/TZh+CLORvU6
TLSH
T16302EA356D782C6B9FF2AE44F58737175FA8117BEA952F80D9D42E1C01D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 febe5febc575b971bae80f023d6c936345dc7c12aeadb04149790b94bf59bbbb
MD5 5f85f3bc2fb3e4349c617f571129ace9
SHA1 3ca8dd6fd9212d3de928fa55097f72f833307e13
SHA512 994b71400547117e3a9fa2a8df440432eb7a9d6f689ae8c938286b6cbe342ff2f1b4b5428cc601a54ddbc9ecf0489c18d993e5de837a178ef933b015160fee95
SSDEEP 192:OONn6v+YL0QmiUyA2Bh+CGWOFmRetZCHxqfU6:OONn6vz4cBh+CLOzteeU6
TLSH
T1C9121B35BD785C6B5EE2A944F48736139EA85177EE8A7F80C5CC3E1C02DF65C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f450b5e8-e523-4514-85c2-d326518ac813.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f450b5e8-e523-4514-85c2-d326518ac813.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ad817737a44d188fbaa8e08446b7b75d0f60bb6cbcb12281b490553cb9244962
MD5 1e7752e2f12ee26210f86137ae0dd78f
SHA1 9f91e0de2c7fc58eee521376a477170953542677
SHA512 f4378c82c20a0b415a6b47b5de4a54426a9a016d9e2651c726a6398a8b9421083119e3371e11d459e0a92a3befff9db8e6f0ae9d491dc54a1c5eeb0c0c88f99d
TLSH
T1D0410958B6FA1148B3777F5AABF6A96D487F78372E0AD49D00110E4F0627E40C861737
MD5 SHA1 SHA512 TLSH

Submit Download