377f4a648211406d1f4af79ac44bc8db72fbae1dd19039069a310fed850de201

Analysis

geolocation tags

eueuropefrfrance
max time kernel
898s
max time network
730s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
seed-phrase-generator.html
Size 255KB
Sample260910-s5mg7ssajf
SHA256 377f4a648211406d1f4af79ac44bc8db72fbae1dd19039069a310fed850de201
MD5 d9ca6ce0812752002f2226ec30e23671
SHA1 987534567c960fd0f5a8b457fdd597dcdf5c7607
SHA512 690ad11d29353594c120e4e9414cca512a294c43e425005f01d8867b4e7f4801d375138b4c2cc4f06c76c455c34f25ffa6c4d573253a2c8c18d573ed5765698d
SSDEEP 6144:Bsb6UcYSbpAk0/2db+J/NitCvWdpw/OJEXPPUTKPqGj4UmQBXAal5TjtlIqkpza3:BsmUcYSbpAj/2db+J/NitCvWdpw/OJEl
TLSH
T1F144C7B1B075D23E059F138AF5B1AB50D397A69BD61669F2C03FC2A481C3C88F7A3195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	camo.githubusercontent.com
27	camo.githubusercontent.com
31	camo.githubusercontent.com
34	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4600	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335285675858087"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{4F710C0F-F614-4E46-B926-C71D8034C6B3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 4944	5164	msedge.exe	88
PID 5164 wrote to memory of 4228	5164	msedge.exe	89
PID 5164 wrote to memory of 4600	5164	msedge.exe	90
PID 5164 wrote to memory of 4228	5164	msedge.exe	89
PID 5164 wrote to memory of 4228	5164	msedge.exe	89
PID 5164 wrote to memory of 4588	5164	msedge.exe	91
PID 5164 wrote to memory of 4588	5164	msedge.exe	91
PID 5164 wrote to memory of 5108	5164	msedge.exe	93
PID 5164 wrote to memory of 5108	5164	msedge.exe	93
PID 5164 wrote to memory of 5108	5164	msedge.exe	93
PID 5164 wrote to memory of 5384	5164	msedge.exe	94
PID 5164 wrote to memory of 5384	5164	msedge.exe	94
PID 5164 wrote to memory of 5384	5164	msedge.exe	94
PID 5164 wrote to memory of 4748	5164	msedge.exe	95
PID 5164 wrote to memory of 2700	5164	msedge.exe	96
PID 5164 wrote to memory of 4748	5164	msedge.exe	95
PID 5164 wrote to memory of 4748	5164	msedge.exe	95
PID 5164 wrote to memory of 2700	5164	msedge.exe	96
PID 5164 wrote to memory of 2700	5164	msedge.exe	96
PID 5164 wrote to memory of 2772	5164	msedge.exe	99
PID 5164 wrote to memory of 2772	5164	msedge.exe	99
PID 5164 wrote to memory of 5920	5164	msedge.exe	100
PID 5164 wrote to memory of 5920	5164	msedge.exe	100
PID 5164 wrote to memory of 1012	5164	msedge.exe	102
PID 5164 wrote to memory of 4312	5164	msedge.exe	106
PID 5164 wrote to memory of 5716	5164	msedge.exe	107
PID 5164 wrote to memory of 2816	5164	msedge.exe	108
PID 5164 wrote to memory of 4868	5164	msedge.exe	109
PID 5164 wrote to memory of 4868	5164	msedge.exe	109
PID 5164 wrote to memory of 2924	5164	msedge.exe	111
PID 5164 wrote to memory of 2024	5164	msedge.exe	112
PID 5164 wrote to memory of 2024	5164	msedge.exe	112
PID 5164 wrote to memory of 4704	5164	msedge.exe	113
PID 5164 wrote to memory of 4704	5164	msedge.exe	113
PID 5164 wrote to memory of 4260	5164	msedge.exe	114
PID 5164 wrote to memory of 4260	5164	msedge.exe	114
PID 5164 wrote to memory of 4652	5164	msedge.exe	115
PID 5164 wrote to memory of 4652	5164	msedge.exe	115
PID 5164 wrote to memory of 5948	5164	msedge.exe	117
PID 5164 wrote to memory of 5948	5164	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\seed-phrase-generator.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff8cb41c188,0x7ff8cb41c194,0x7ff8cb41c1a0
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,12337226768263365161,6329397166306215110,262144 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,5224345332312276299,14158616406323069054,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,3811873162656581716,6916165207332574849,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,174270594858714919,7217787973518869323,2097152 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,12049302211309897380,5887042412679813986,2097152 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,3194691730285634885,10671765653644806006,2097152 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,11323693098750299844,5072488263995565259,2097152 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,5986125532536564781,17847469298179604634,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,5374187066400328435,10489615015184572803,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9654611453661898282,10680630276678361722,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9654611453661898282,10680630276678361722,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16050166333665574097,17008482806159711909,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,7204884102275650741,11897601529491061325,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4754146711121591561,9543807790927441557,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,15270805131265620582,4442868126441877093,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,11260265323514370400,16563970424164901473,262144 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11823334723041308548,17365087128358429603,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,7578418588988666212,88891142070180627,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1463611217347465010,1172716205467822317,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10028725419211007298,3416730386182548157,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,131140787126914825,574925757638565334,524288 --field-trial-handle=3020,i,10767215586547635051,12367164799252126268,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5056

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d8396eaee7ec49bbf9080fcfd5cf498dcd50d1729d58c5caa0931f77818e8d68
MD5 c938439c26d91993823ef532a396c250
SHA1 6c1d3a457c8cb8dc50a481f6cdb59f5695a72bd4
SHA512 0ddfa5eff70fc223609148e9b4fe564fb8defdb9ba74190f105a4ab95f2b7bf4f85d8f25d37b3265c38a6f05cfe8bfb746a9d5574f52c07c700a7b3e134a440d
TLSH
T1A4E0268417C8C2AFE24866C7426C674C83913B0A92CC7E9E2700CC847141644BFD2A99
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9e1f084074bfb49211b3711677530b40cc0f2b452768e754bafe7af9c19178cb
MD5 25c0adfcb4a9e52c8b2d69fb558d8731
SHA1 8ebc401ccb17e2830910861660d642821dd7d1ac
SHA512 9e878b08c8ebc84b8bc6ad5234a22c1f79875fec66725c1da0168830096810ee5d5ac2413eab713a2b32efaa1c0474a17ff841ea0db95a7124fc92d46184e8f5
TLSH
T17AE07D8407C8C26EF24C64C7C1786B8C83813B1ED2CD6A6A7F1488887005644BFE6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e2041f5ecf59e1c1447b5137a1e769556e31e6ea73c0c83c6a49b631af6e1f5e
MD5 585fb19dfe66217889c060fe64b5f76e
SHA1 52a3b9c57cca65e3af996b269334e945b9aff94c
SHA512 c12333bb661039a28309350fe1ccb7e7d73c5a28e5d4bbba1665e96ed4ee9fc2009c1d46453cf5a6e71cd4bfdd8fb0f96897136f589acad8c077635be1ccf712
TLSH
T19AE07DC407C9C22EF27CE44B41A8EB0CD3C13B0EE6DC6AAE5B40C5847105640F7C2690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 48b79d74401bf3bb187375885029d0b7096e59758c024d0f9961b47415fe0e6e
MD5 7e16a206b8449d3c4c5ce7e3d0b9bd20
SHA1 e324f8726018c872399b9e75900bed490d34c733
SHA512 0bcc6722bf5010198b776fa446e53ffdcf51ac7cf141c92520fe807710773d463a790fec2304642b1023cea148e37b096650de5e11f4f8921f4cf519bb6a5877
TLSH
T14D61A46423AB0AE3D32845B121F1145836F086F5CD47FFAAA04E9EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599e3a.TMP
Size 3KB
SHA256 1d678969b228a7d0dc83a8fe0ae8f55a75e8d75c08f7459f2487040ba10652b3
MD5 bb1f2374b857cef5310706cdebdc103c
SHA1 8cfe15cf96cafb020e62350e5e0cf060406835ea
SHA512 c2adfd23cc1d4eba352587e1827cbe4a8b823a922df4cfef3b9ce1c20689776613578b2ab3e8ac7905178d514ab2e830b654929ce68a697f5139f39600a397f5
TLSH
T17961A45423AB0AE3D32845B161F1145836F086F5CD47FFAAA04E4EB8D4A6F38D0D8217
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 97086d1de3b904c6faccd7047933e78130e7fa8428722b5104d1949511fcaa6d
MD5 765e7abe214515f0bf868505c7e98c82
SHA1 d7f2f6070092e6c5d736e101b21ae7be6fc90bd0
SHA512 d56647e623a5a82c0f594075c3ae377e0a93d28b311c73abf402b8021c5e0be7376d6fc1e97e66bab3ce89e4bcccd93ed612c30048213836c95762dd3e430ada
TLSH
T1F6417EF743B4466E9A1196F0EA14AE2FCE6C0116832C7C6989F0AE1793F3471E0417AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e08c6c2c54ef405389bcc69f9b3d5b366711e5e2262cd5b390210dbeb0a07cb3
MD5 005447503d6ad5a93440eff2f38aaa7b
SHA1 c273442039f435344512c54b9224334d5093eddc
SHA512 c257d563d9bf426e38956db352fd1084d3b33a15db779debe1fca58608113d862b5e9ceaa943cae70abe8ab2717677e9e9ccbb09c2db2d57206dc9dc02da6c01
TLSH
T17721ABF3C2E8567D894181F467182F1BCE2D0814832C3E6AC4D4AB5F93F5861D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3c86394ad89a1902d84e3bd0c74f7960bc72161633c9b295cb956e33e516fd60
MD5 95ddf6f9122baa209d78b4ca51a43f46
SHA1 7e83474504f11d9f28fca5fdd8cb99268f69faae
SHA512 5b96b7813faaeaeff58c2866fbb82961ce25bdc96dbcdcd61a0f41c49bb5578987a5b56867c3d3fc020cc767ad2a551bac6f22a516467909307c215a68c81edd
TLSH
T1FC417EF783F4467E8A1196F0AA146E2BCE2D0516832C7C5A89F4AE17A3F2471D14175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b8551c46aba4fb9e5318c217e4e6841cb9e211580965fb45352eb841574ba9f1
MD5 617f6d1c6e74452b0ca56c6f0a13a9f9
SHA1 23b64013508d3601eb83a48a36826b59a40ac14f
SHA512 879dcafafdf91c3ac36cc1fdf8207fc12a87b38070d6c47aa178651f16bc1f44067fa7ee0051c8ae25ad3c7b671d79e626ad165e2814dd80674a23e3f266d60e
SSDEEP 192:sxRqRMb3/f3sT8dcwG7zoA8p4T/g6+WNIYo5ECYqGJIgIJ:sxRqI3/f3sT8mpa+/5IZEs
TLSH
T19E3296166928A93B8CC7E61DFB65BF53D2F95032A1D42E58B7FC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 938b0dfc77b1ec80747466c28fd341be27901729c6a0019376ffc89103b622b9
MD5 4d08863d9ba82b3a54f4aa0a555f1f3c
SHA1 20a42188465f767a1bef9df3a90356ad0a32de61
SHA512 35fcf463919e00b32d9ce4f13cdc70bde3db042a9a45c4bba82644062a9c9e5f1b16d626a927b82dbafaa99a285b806c70a4e5b44b01fadf52731ef17a3ad3ba
SSDEEP 192:sxRBRMb3/f3s28dcwG7zoA8p4T/g6+WNIYo5ECYqGJIgDwJ:sxRBI3/f3s28mpa+/5IZEI
TLSH
T1C03297166928A97B8CCBD21DFB65BF53D2F95032A1D42E58B7FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c1bc7c66fc776922f0fe0f8504bc08da06a7baffab75e7ede895884454360ef8
MD5 7f8548941d6250f07139b241d56471b9
SHA1 211c0404d27874a31aa822dfca04868dc5db9e02
SHA512 1159b13ff0aee82d67d98245eba526617c0beba2c5eff3d8e14a2df0eff4b0ef3c5dde78d70a9d5c3de0078067ed6165ce3b048fc41f2940c95c7efe00e59b9d
SSDEEP 192:sxRBRMb3/f3si8dcwG7zoA8p4T/g6+WNIYoKqCYqGJIgDSJ:sxRBI3/f3si8mpa+/5IWEC
TLSH
T1CC3296166928A93B9CC7E61DFB65BF53D2F9503261D42E48B7FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 502e7ac157fc3fd2b8fdc27458b156eed792281274760f5b5e15b0c659dbeda4
MD5 a033627726c852d02fbc4bf8f7d98fa3
SHA1 71144cc3999f8383b8c788efa15caf6d83f8b931
SHA512 2fdadcd152fcffec74753e4235c3b3c3eef8424a2689a132c08a6e546e05c87c76329d396d9e9b75b7695356cb8ec9edc42c455d661abc07b78e9eea1c2032f1
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXQro980:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vc
TLSH
T118B2EC2B640DCBBE5F800A9DDC19AFDB6D9802C79B588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4c16b758-e7f3-4749-8ffc-0ca0a5acc1e9\index-dir\the-real-index
Size 432B
SHA256 8e7b994fcb9c972a2564162419fa6ed9569d56972315dc2aa3c8a9822ba74963
MD5 d463df20f0d0c72f84b9bced70de6791
SHA1 26a214eeb7db1492f7bad23f106cbeb69d7751f1
SHA512 12001e7ad9632f3b20dfc4bf49146d0350b501cc2438a41469249fe600a180ed62824cf297d55cfff78b0c45f79fd007cc59ec9e0dbb2778e54b6d72917061ff
TLSH
T1ADE078D78C757563D93795BB1637141D333B09FD25066D5610FD642DD51313C4311705
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ddf66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4c16b758-e7f3-4749-8ffc-0ca0a5acc1e9\index-dir\the-real-index~RFe5ddf66.TMP
Size 432B
SHA256 03bb6716cb9d670061820ab15371e962b2623136c48f839255359746fb2c2bc3
MD5 d9a6186a0277a689aaa10498086f217a
SHA1 5be289ed6c9255b23d58b5d0308aaf150725ec8d
SHA512 a7e8ce9ae20f7ae77e757ce73b5a6203cb40c18f4a7f756475d6739fa07f1a42b4098863b6e03cf33f288b25955aff0f7c5c98b6a138b56754f132b67ee3436b
TLSH
T19FE07DEB00B0BD71D91555B6250B1419333F0C353425EA1F509A142EA9213BC8641B06
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 97c56ffa4c8a322356fcf8ca4416a09869540590801f0098fd046cc22eb27387
MD5 07fa10f7b47dd365f406fa80dff43157
SHA1 e62dd5f095c1b8355ff34819fff60a48efc85568
SHA512 09b90a97d4c068fe895b402e401937a1c049a29e3acc8f5e4e3d69d9bcf00e52874e0024a8918617a75c6dc3f66389889bc40d3b7d6bbaf1ce9d2ffd588d4eae
TLSH
T1AFE0D8B73FD76814FCBF93F92871A898014179548509AC4F651EA2C610B12613957C21
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3838.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3838.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0724d7357aee736e3ff97b625487c01a8fd632ef3163039ca8cf6429b9bffa23
MD5 5a8f8c81417a123729d6f6f55575bc0b
SHA1 8701347e221cdb745b9a1c4508ac5a3b2132594a
SHA512 43bdecf34b44f8fdbdde3e974a0c5bc737ed8ed4cd7994b804b6b80a01ae4f0c2f584667af8cd38685774cdc61ebd813ac057103b4dd236f14d2228d8728a3c3
SSDEEP 768:Grv+4UNbdz3bz/TBOWoScKONXyer1IRCzniwDeVH1SK7:GbsbV3X4KSIqnfEH1l
TLSH
T1FD03CF32E0689E338DE2A3D6B047B6437FB85157D6840790DCDA2F8E0A9B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ecaff7783842420e0c06dd8157d66fe10e3e2ce25a574b982f41fde2bfe94b8c
MD5 e0b18014b7f345a512d9bd6306fb833f
SHA1 b76c02d1087c70925ee9210b89516ac063bff186
SHA512 5c7fc774b57c03324ecd486dcb2215ba8fdcda656eb4291197e23edfa38f75271c65edb9a354ae3c88e3690dc4cd829b021ca61fe4c3deb9044a6e136a1d265b
SSDEEP 768:UF3Xd/TBOWoSc3ONXyer1IRCzni9Dk4bkh0N:UF3N43SIqnokx4
TLSH
T120F2BF31E4909E378CE2E3D2B2077743AEF8A157D6C45640ADDE6F5E09D766E030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5a0256479f03354020ac88bd25ae70ae146c155448a823c3c154b4d95ace5131
MD5 9edb0b777836c354eae971da6ec4fbf6
SHA1 158da5fc4aba3ede1a59d927190b4b5ca4fea8f4
SHA512 e4ad99136316c83a3df5d5b989e33117fd36d42719685937b3b296908eab351693058d5312bc86d52230c09bfc99792eb7f53e19dd71a4593506162ba52e4a84
SSDEEP 768:8F36d/TBOWoSc3ONXyer1IRCzni9Dk4bkh0N:8F3A43SIqnokx4
TLSH
T1C1F2BF31E4509E378CE2E3D2F2077743AEF8A157D6C45640A9DE6F5E09D766E030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a052b83ad4449363f4c65f3c04a0d0338fc8987eec1d4954e279132867a51d46
MD5 ba845be218df7eab55dc840343aed8d0
SHA1 8d4a37ac38925dc9fcb70a7b92e1734ad0513824
SHA512 a53d878cca6f578b9a562a0d059bdabd664e2621eeecf33608faf107fce003d21a23c6933d4ae7db9896e6f4c9feec57a2d37f7e9f485a86f1ef6d6afb2f2861
SSDEEP 768:4rv+4UNbdW3zd/TBOWoSctONXyer1IRCzni9Dk4bkhN:4bsb8354tSIqnokxN
TLSH
T12F03AF32E0589E378CF2A2D2B10776437FB86157D6C40690A9DE6F8E0A9B59E130F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 430c135d81459c30fc8deaf8a407af702dcb35aad31e45b676afe471ee15f306
MD5 c4aa33f2fd20337891e5c5ce9817665d
SHA1 cc4e7e1a013b1a22528e8124385e296492c7dad0
SHA512 5653cb528aa1c89d91280b255d4df9d1d628251bd79eb6016b9d3080affff1cb8dd0782c53094bb55230c39348803ac90e918781a16e2c1d20cbcde7c5caf5b4
SSDEEP 768:3FQZ3Wwg7d/TBOWoScMONXyer1IRCzni9Dk4bkh0N:KZ3O4MSIqnokx4
TLSH
T1BFF2BE32D480DE3B9CF6D7D2F6063343AEF49163DAC49690AACD6E1E05975AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26580174e7fe4b463084cd5329320a1f594fde6afbb905952059bcc59918269d
MD5 b9b71b9fc1730d51391903bcf6830774
SHA1 f49373a614eb11a967554fee71bf8bea42c01e93
SHA512 5147d6bb3ae28527dad7c085548a45bef866966bbc5392b8ce2da996e8434187eaa18d2198f2403b0b81b7b7cac6e1c9cfd627fa3adfdaa5a45fc2bdadbeae96
SSDEEP 768:hrv+4UNbdz3sI/TBOWoGONXyer1IRCzniB0eVH1SK7:hbsbV3nlSIqnbEH1l
TLSH
T16703CF32A4A89E338DE2A3C6B14776437FF85057D6800790ECDE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d104f68-11bc-4cff-978e-65a3bad92658.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2d104f68-11bc-4cff-978e-65a3bad92658.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download