hxxp://datewheel[.]net/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://datewheel.net/
Sample260910-e43wxaxfqh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334882440282810"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7FE4CF37-1024-48E2-AE49-F887AF66F2AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2244	4396	msedge.exe	84
PID 4396 wrote to memory of 4284	4396	msedge.exe	85
PID 4396 wrote to memory of 2232	4396	msedge.exe	86
PID 4396 wrote to memory of 2232	4396	msedge.exe	86
PID 4396 wrote to memory of 2232	4396	msedge.exe	86
PID 4396 wrote to memory of 3656	4396	msedge.exe	88
PID 4396 wrote to memory of 3656	4396	msedge.exe	88
PID 4396 wrote to memory of 3724	4396	msedge.exe	89
PID 4396 wrote to memory of 4612	4396	msedge.exe	90
PID 4396 wrote to memory of 3724	4396	msedge.exe	89
PID 4396 wrote to memory of 3724	4396	msedge.exe	89
PID 4396 wrote to memory of 4612	4396	msedge.exe	90
PID 4396 wrote to memory of 4612	4396	msedge.exe	90
PID 4396 wrote to memory of 2300	4396	msedge.exe	91
PID 4396 wrote to memory of 2300	4396	msedge.exe	91
PID 4396 wrote to memory of 2300	4396	msedge.exe	91
PID 4396 wrote to memory of 3512	4396	msedge.exe	92
PID 4396 wrote to memory of 3512	4396	msedge.exe	92
PID 4396 wrote to memory of 3512	4396	msedge.exe	92
PID 4396 wrote to memory of 1008	4396	msedge.exe	95
PID 4396 wrote to memory of 1008	4396	msedge.exe	95
PID 4396 wrote to memory of 1008	4396	msedge.exe	95
PID 4396 wrote to memory of 2580	4396	msedge.exe	97
PID 4396 wrote to memory of 592	4396	msedge.exe	98
PID 4396 wrote to memory of 2580	4396	msedge.exe	97
PID 4396 wrote to memory of 592	4396	msedge.exe	98
PID 4396 wrote to memory of 4100	4396	msedge.exe	100
PID 4396 wrote to memory of 4624	4396	msedge.exe	109
PID 4396 wrote to memory of 4624	4396	msedge.exe	109
PID 4396 wrote to memory of 4624	4396	msedge.exe	109
PID 4396 wrote to memory of 3260	4396	msedge.exe	111
PID 4396 wrote to memory of 3260	4396	msedge.exe	111
PID 4396 wrote to memory of 3260	4396	msedge.exe	111
PID 4396 wrote to memory of 3404	4396	msedge.exe	112
PID 4396 wrote to memory of 3404	4396	msedge.exe	112
PID 4396 wrote to memory of 3404	4396	msedge.exe	112
PID 4396 wrote to memory of 5176	4396	msedge.exe	113
PID 4396 wrote to memory of 5176	4396	msedge.exe	113
PID 4396 wrote to memory of 5176	4396	msedge.exe	113
PID 4396 wrote to memory of 5368	4396	msedge.exe	114
PID 4396 wrote to memory of 5368	4396	msedge.exe	114
PID 4396 wrote to memory of 5368	4396	msedge.exe	114
PID 4396 wrote to memory of 5128	4396	msedge.exe	121
PID 4396 wrote to memory of 5132	4396	msedge.exe	122
PID 4396 wrote to memory of 5144	4396	msedge.exe	123
PID 4396 wrote to memory of 5564	4396	msedge.exe	126
PID 4396 wrote to memory of 5564	4396	msedge.exe	126
PID 4396 wrote to memory of 5080	4396	msedge.exe	128
PID 4396 wrote to memory of 5080	4396	msedge.exe	128
PID 4396 wrote to memory of 5640	4396	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://datewheel.net/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff871f1c188,0x7ff871f1c194,0x7ff871f1c1a0
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,9066581961768108562,18018416222286805737,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3392977024248107440,9166573076872558989,262144 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,4052267288276598308,1703161969442131782,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,11539643370110294584,13736450768932852682,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,4812908419148248997,13423980500448257270,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4579293572497130488,6622027136001890278,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11061343679332675816,3301719473279303010,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,6521584991988352306,15642877808588406192,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,8121120460094356215,152888053966721463,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,596605604358338228,7078237226331611014,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6965800669647723525,11723459665520562222,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6965800669647723525,11723459665520562222,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6412,i,13442200437305727743,10076418971802516044,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6528,i,17373289562482637086,4312030250322191475,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6392,i,13581243701909652576,4011424495952109662,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6700,i,5217284137685350063,11151024436260711569,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6732,i,14765206119252188133,3879888486571389880,2097152 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16536015761527817243,15602690618557073296,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,11171526057810117782,9116225254870983073,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,1540756301388854279,9041973046121941780,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10967703078604083628,17439056056016863005,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,14904466166200960414,11030643864835740479,524288 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6320,i,8999087742905624183,3956650609707631564,262144 --field-trial-handle=2260,i,11845043329113342628,5608113810768817869,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 81KB
SHA256 e345d5707ee07b227bc5946fc28335d81f77fdc1ecb00ab6154a916591238135
MD5 3d1e995706c0268d0519a58de3736f00
SHA1 b2ef726d9fdad426dc9ad48df2edb8bb6f68f987
SHA512 dfea528720410de45a80017174767a99d0eaed007d9fe5bfff77efdc8c807c02cda197769c0a22536ebdd08bffb859a89df0f8b7798bf17ee030baa26258e585
SSDEEP 1536:mcKpmT72kCVgIAQxIlokxAQRc1/FqiLLAg1XkdBJCQyeUdP4zFpD3W:mcKpjk2JA1xeEiLEMkf8nbkA
TLSH
T189830274AFCF1BE48D3086497A9B6EAF2ACEF3782CF45E6550766091711A0E5501ED03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a604e6d9a3ff1321_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a604e6d9a3ff1321_0
Size 303B
SHA256 9729776c32824f71d796cf22872040ba3a42c324c87c793b8261e2fcef2fbb6b
MD5 afb540b4781b282d642f3a28ea5aee85
SHA1 92c7ed3533702fa6ef079f89532ea722da7500d3
SHA512 df0ba49ad897b29c3ef905c8cace89eab7064c3f878942137597125d0b53dfb5c0da726dc61c20aa9621008051fc923f695cf18b89c132c97729cf07d1246a35
TLSH
T1E4E02BC736842575D01D8BFAD9AE155D46737A7C025CF08091D0D2638B840F1E15DB02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 021a1b3ab146a66fe6e68028f5bffcd4299267ca02807a7136ba987dfde13856
MD5 e9eed53a09cdbfbb23cb1d816b976ad4
SHA1 36f9551e20a9641b76763406c351430b486b4083
SHA512 9bc855ec869f63ff09be886a44db78f83e508a55ee0c97f13988293f017637b1a29df1231628581b60438475507d39b05b999c2e3d0859f4cd7fe400afd3660c
SSDEEP 48:RuX24khUxk1fsXiSTAWQSsN+2zEAyZwaVmWXtZKPff2hYXby9ZzHl2ckt67H6e89:m4bsSnWRspzEfOubZrVG+mq8rdU5i
TLSH
T1FDB15FB9418A8633E794187956B53A27F4FBC0D5F223AE0E152CCF242A26F91401C6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e74e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e74e.TMP
Size 3KB
SHA256 901b8d73e4c6aaae0047090a6e0118bafcfb6089ec6ac698fae2f837baac0df9
MD5 3832bf2e927158c0f8cbf9a5d3155599
SHA1 421168dfd3f6a45313780b1ce83f386246b8a1c9
SHA512 3b166b549a4523c0df25585e93940936eeda76fad5cab30f296c01d78ba1d44959964727a474069100665ac41d78074dd9ab4ee6d8ddda5c456b2c9d8719b040
TLSH
T1FB71A575064EC663E3A50A7252E13337F5FF89DAF6239E4A20544C762618F11861C7FC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 6923c64943f073e07cbaff1bf07da1a0eb91138fdf676f6495649f35759f4661
MD5 b97f36fab2812349f21c99350080bc93
SHA1 8ce2d8feb5f2ff8dc32c0227cc43cc201444d022
SHA512 435eda6afebf460c06418f68d109d2f06c88c7b244ee515add67a36a4b69afe805a75533bef0918a013801b8561c75e25d0c016d1d7b260204b747877ad9eac4
SSDEEP 384:DnHuOP4P5J+eHw8xJRflecvJSKkBewllBn8EbBkVrxAcGMFXfM4nrFLzlMBRrz08:knRWz+SkRsdrOuwp7KD
TLSH
T18862DFF2C7D4966EA89252F45B246F1FDE1E081A02187D16CDD8DE9FA3F24B2E10254F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 16cbfafe9cb0cdeaa34231f694c3c55ad1476e54d9dc6fdd897eb3b5c8d24286
MD5 0ecf3d8ce9497b6c1bbb9bf162776d1b
SHA1 ddb545e1bd92c22cd56030eab77cbc2fab3ba510
SHA512 73dea915c096b6f9043462c881b794b8038b1c6c6d86afdc1e1c2ac19ff7214216a56bbd35d1afa63780ef74eab6d2b1cfec0f293b2ce6264aecc42bfa130bce
SSDEEP 192:sxZCRHyM/jK1Ml8UQwWBW/fCsjBIdpj/HW6+WNG16/YIXKh9KIg59J:sxZCNqLBW/fCsjqDHb1/F5
TLSH
T1C152E516AA34A977CCDBD20DF951BF53D6F5157292900E44A9FCCA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ea0e1c58c1a0a0be4732007adf59e12cdb9a2e80bd4a859c54f08c1cef0d69e6
MD5 e7d51c491ce813b11a9d89cdd5ad71e8
SHA1 3706d5b4f23456f452f78897664ba64f337dd515
SHA512 64ac09254abe9dfd8fa893f526bcbc78145dc9b7a69a2643577b4b90b6e1a5a5afe5fb777fe4edac5fd7c3815c384766f92453af0b7fe4592e8b63ab0d202a14
SSDEEP 192:sxZCRHyM/jK1Ml8MWBW/fCsPBIdph/HW6+WNG16/YIBXy9KIgrJ:sxZCNuBW/fCsPqpHb1/X9
TLSH
T1E042E5116A34A97BCCDBD309F955BF53D6F91572A2900E44A9FCCA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 df4bd4717745f94dd934c171be33dc450c580f7da43b07b55300f1d59ad467ff
MD5 0aabccb14c20b6f939ee37fa6ba895df
SHA1 45d36197bcf2e0ed770ba1383c716d973b895229
SHA512 88fa0d2a32ea5ed05dfc3cde4071e57425abb44b6ecd827406042f694bf964446e39cb88fc2b300dc708c3418de2775203b23608152b222679f3bbc726819e0b
SSDEEP 768:M6sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9TroLPV:M6sqxXlWvJD6Tu1ja54LAs9gL9
TLSH
T1C1D21B3B694CCB7E4F840E5DEC266FD76ED801CB66988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c5743329f4b9cbba5a783e0b02441faedd469dc7f90ceea0840d88b80423eec7
MD5 f8284f2dd532ac6e6e2ddf5b546df83f
SHA1 2241495880f586b3b30a7fb8a2c580ad3ed54f83
SHA512 e79ef19c394c756c165a9f707554241768bdcb166ae1243c620e6a34e2808c13db60e2a82f784413b96af6103e535697613a6b61df55a5ecc2b525dde974527e
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTylDIRK4A0TyRCIfKPKcfyZ2IfKf6cj:KYbaKYIKeDaK4AKiCQKPKOK2gKf6U
TLSH
T15EC12006327A1652383D2998B26686770F423AA3301CF47F7FB964A54E67E124CFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

319198b0-0339-4f60-9b99-c5fe2e9a2e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\319198b0-0339-4f60-9b99-c5fe2e9a2e61.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 76a48202f0a1e97b372446f306a7c951b47f73eb21b631c19677831fac6c23d9
MD5 7a3a5ade6b350624614f96972f1f8910
SHA1 aa8a9472dcb343605513f2ffbd6cd9a7e120e5c9
SHA512 49f11e9a445b7bf184b931c521a50a88b6f6bc43a469846cc695f90671691581ed04897738082a203c664922cca27ad1df2e7d4ba8aca905455bb15f84346f02
SSDEEP 384:3iFiZcIasN18TUNTUlIlaNgbweBVRNzdTLPOOxuvzxV+MhdpEBXou:yFQacwgBnHzRbj4184pEFx
TLSH
T198C219F158D75C7AD9AE9743E77E2D034DBCD067B9886A40B3989A0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6cab203b72e917b133464a0f0b33595882315e1d65dda466fc53361cd3169e6e
MD5 086a3a239f9a2acdae44e9bf5ff84bc9
SHA1 8fff9cb8db1d1b01d071193695af01b5681c3f2b
SHA512 0ee818a622a3c9ffe1c92c7884ee0ae9b21dea06c4498aede14deb1ef59ae8a6106a784c81b61753b8b3b0333511846ffa6a00032bc1366a868f64475e135952
SSDEEP 384:DZcIhsNrrNgbw7BVRNzdTLgOOxuvzxV+MhdpEBXou:bhknHzR8j4184pEFx
TLSH
T1BE827E716C385CBB9DEAA145F84732034EB89167ABCD2F80D5EC9F1D01DB6A9131AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6137aee10a44491c1403d17cec61eaad742115c3f752985ec8fa61771fcda5cf
MD5 e84c2fb13bd05fbd4077275a65a22cd0
SHA1 2358e48e2860e49c4da896e183b3b5246b544b11
SHA512 4b64d84f0a532614e432b0b8022e664aea61bb6fe5239ea66af56f2a6a8ca24d64d4e3b0d3b3365cb0a4d2bc1f48fe97d2f83dc2d296a2f62331564fb2c4d69a
SSDEEP 192:tONx6JkRtQmiUyzRW+RNA+Fd10JoLkRh3HRRU6:tONx6UruW+RNzdTLMLU6
TLSH
T1AC02D8356D382CBB9EF26D0AF48B37135FE4216BAA852F84D6E81B0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad0a8ce73ceba61b1abae296100ee86d30aea19e8f243e9e66515b8115cb154d
MD5 ea533b27156f9beae4c6ccfd21b2b87c
SHA1 05db17739c314529731d6d19c727709a6aa408fd
SHA512 21d1b6c67403958984e0622e1e219d8e57dd98975399e04580071d72f3c45ff1831412ef745f504bf448139b32e71209db339f5233860ae83ad76750294bfa4b
SSDEEP 192:LONu6JkRcQmiUylRz+RNA+Fd10JoLkGwPCVcYqvoOU6:LONu6UsSz+RNzdTLCOOU6
TLSH
T14A12FA316C385C7B5EE26955F48735035EE4A12BEFC93F80D5EC5B1C01EBAAC131A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f825003b62e51408ba5b58f32973f69ccf6dec02227b10b286f690474159bf9c
MD5 c06b2850cdf28b8ec875c59d7c14f6d8
SHA1 c1e3d69aa125e056e2ab021c9697c82c5548329e
SHA512 ff7437dbd4500679ed26eee84a6d20756ba6aee549f641845c70c624f96ef9b60f82bc02b9426379b04aa502ab96106ce6ab33b742a3368bf8d71b389f304a66
SSDEEP 384:zZcIhsNraNgbw7BVRNzdTLgOOxuvzxV+MhdpEBXou:rh9nHzR8j4184pEFx
TLSH
T125827D716C385CBB9DEAE145F84732034EB89167ABCD2F80D5EC9F1D01DA6A9131AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

928f692d-08f5-4e42-a355-81da5572ef0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\928f692d-08f5-4e42-a355-81da5572ef0c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 898692211754661834e2c3db800e6e86c787c50d3dde66e10e087cf995fd6c70
MD5 cb94abe104a3e2b86057c25e5d3379f6
SHA1 a846f210cf3fa3eaa41decf6ec599fae7664e2e1
SHA512 17649999186ac107c34ea8aa6c83dece6282ed820e71f3cc615d652f388ab2005c73847af941185ddb482453646fe7822e5783a43b9fda180d93da50a3e827d4
TLSH
T1F341F858B6F90148F7B76F69ABF6A86D443ABD772E06C15E00110D4F0662F40C871737
MD5 SHA1 SHA512 TLSH

Submit Download