hxxp://getessential[.]xyz

Analysis

user interaction
yes
max time kernel
1049s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://getessential.xyz
Sample260910-t64zbasena

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335320814088937"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{69A78620-418E-495D-9379-099FF87F231A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2408	1412	msedge.exe	84
PID 1412 wrote to memory of 3308	1412	msedge.exe	86
PID 1412 wrote to memory of 2068	1412	msedge.exe	85
PID 1412 wrote to memory of 3308	1412	msedge.exe	86
PID 1412 wrote to memory of 3308	1412	msedge.exe	86
PID 1412 wrote to memory of 4676	1412	msedge.exe	87
PID 1412 wrote to memory of 4676	1412	msedge.exe	87
PID 1412 wrote to memory of 432	1412	msedge.exe	89
PID 1412 wrote to memory of 1208	1412	msedge.exe	90
PID 1412 wrote to memory of 432	1412	msedge.exe	89
PID 1412 wrote to memory of 432	1412	msedge.exe	89
PID 1412 wrote to memory of 1208	1412	msedge.exe	90
PID 1412 wrote to memory of 1208	1412	msedge.exe	90
PID 1412 wrote to memory of 4392	1412	msedge.exe	91
PID 1412 wrote to memory of 4392	1412	msedge.exe	91
PID 1412 wrote to memory of 4392	1412	msedge.exe	91
PID 1412 wrote to memory of 2196	1412	msedge.exe	92
PID 1412 wrote to memory of 2196	1412	msedge.exe	92
PID 1412 wrote to memory of 2196	1412	msedge.exe	92
PID 1412 wrote to memory of 4192	1412	msedge.exe	95
PID 1412 wrote to memory of 4192	1412	msedge.exe	95
PID 1412 wrote to memory of 4192	1412	msedge.exe	95
PID 1412 wrote to memory of 944	1412	msedge.exe	97
PID 1412 wrote to memory of 1868	1412	msedge.exe	98
PID 1412 wrote to memory of 944	1412	msedge.exe	97
PID 1412 wrote to memory of 1868	1412	msedge.exe	98
PID 1412 wrote to memory of 3952	1412	msedge.exe	101
PID 1412 wrote to memory of 1416	1412	msedge.exe	107
PID 1412 wrote to memory of 2352	1412	msedge.exe	108
PID 1412 wrote to memory of 4404	1412	msedge.exe	109
PID 1412 wrote to memory of 3648	1412	msedge.exe	115
PID 1412 wrote to memory of 3648	1412	msedge.exe	115
PID 1412 wrote to memory of 3744	1412	msedge.exe	116
PID 1412 wrote to memory of 3744	1412	msedge.exe	116
PID 1412 wrote to memory of 4124	1412	msedge.exe	117
PID 1412 wrote to memory of 3232	1412	msedge.exe	118
PID 1412 wrote to memory of 3232	1412	msedge.exe	118
PID 1412 wrote to memory of 2656	1412	msedge.exe	119
PID 1412 wrote to memory of 2656	1412	msedge.exe	119
PID 1412 wrote to memory of 4876	1412	msedge.exe	120
PID 1412 wrote to memory of 4876	1412	msedge.exe	120
PID 1412 wrote to memory of 3652	1412	msedge.exe	123
PID 1412 wrote to memory of 3652	1412	msedge.exe	123
PID 1412 wrote to memory of 4124	1412	msedge.exe	124
PID 1412 wrote to memory of 4124	1412	msedge.exe	124
PID 1412 wrote to memory of 4356	1412	msedge.exe	125
PID 1412 wrote to memory of 4356	1412	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://getessential.xyz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff9311c188,0x7fff9311c194,0x7fff9311c1a0
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1980,i,6921965427649431991,2608286283628173567,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,17778225823068984142,559826121556969538,262144 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2376,i,1270883724345369390,3914019327073188032,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,6954902961121855056,15402973136327963956,2097152 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,5867949854641829379,5827649416515558390,2097152 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,40564368092446615,17335570222312714228,2097152 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,1609352054119826242,16874363306105645876,2097152 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,14213439722777945333,2717286121692047010,2097152 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5792,i,10060397346133996692,15174544206616338754,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5796,i,14176053541974869506,16592407725375892094,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6032,i,16552693520061740189,6360143157723616595,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6032,i,16552693520061740189,6360143157723616595,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6092,i,4420503205416935033,1075247996034178963,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6084,i,5012876764829070002,18269377386101837534,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,5421190986042993191,13335490424122906813,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6524,i,10677421376080881884,15719680615213440494,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6884,i,9696761442779314400,13276642442117262340,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5532,i,5544116133681986732,1482116219781067570,262144 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5836,i,13815484414748790874,4082892508693692678,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7016,i,428096428573011986,5561001791586234575,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3208,i,11255879398921411269,18112720082706962335,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7012,i,7371873355106444416,11794303717570037294,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7060,i,16895870854364811184,16427247430659138763,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6572,i,16955619008134717926,17589633539262267698,524288 --field-trial-handle=2320,i,16616971134125238312,356185250077460844,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2c3a0cac2ce5079a76f8ba4206ff452c1a95a218b4a4ecde5f33dde2bf3491c2
MD5 55d36206e300b7bd4b3c8beb5b37fbbb
SHA1 7a69cb982d838dccd4ff764835129f73a6548a03
SHA512 be49dbd6b157bbdd0f7035d8663442c86b615a6d53985e2280c3cdfa82f75e45375173b89d34e6e7ea24b60583523f6e5d191ab7507ea4e15ca7f6c27aa6ea11
TLSH
T1E1E020940BC4C21DD148F58742547B5CC3413B0BD2EDFA952B0494D535426406A85574
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4c0ff02ab4d5183f76b51318be81f67a017c607047e9d10853d39559ba81c280
MD5 4973f83d6324c775960636f2f684709a
SHA1 3cd3092f71f5cb2f2a27697377784cb0e1bd2b45
SHA512 96edde05f8a63ab961b9cb3a3de0e65c4ba1df6bb488179f1e0992cf95a27177bef291478d255a5a1711ec54dc2c016bbc7bf104c90cee451681a8c4131ba861
TLSH
T1BCE026842FCAC22EE648A5878268971CCB853B4FD2CCAA1E2700B8843185248BA925A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2b12d34ac545184c98651ed59eae471b58fe7af94935d6e4aed9a95d5baab0bf
MD5 64ad6be15b0c8c31a96f180aaedee8a5
SHA1 d124fe81a1bc8fbe1a6215ce9731d2fa54cde9ae
SHA512 c49d0b1b67d46fa76fecc71fa0d110ffb58adfe21cb926cd68f9910eaa9d83d7e9c46861948450fb8758107dd6b004ee3d150e8c8d1bbf5105233ff39d52a94d
TLSH
T11BE07D8807E8C32FD258A68741746B0D93823F1FE2CC7E1A5700AC943083650EBC67F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64a29115ab85fb3ed2256b4e4fd8de843312d70e692be40e589c708498cf67c5
MD5 6dd629bcdc034d21b765f45b2769a8a6
SHA1 27a6d99a9174583dd45faf8f11746f40f658e860
SHA512 25f77e892f94658a02b7d6cfb0749ead2b8a49d565063b20ee97bfaa59cfb5859bd5be0944e473b58a9634e9fce9146150934b46f8c5a835187362a7fc99fb71
TLSH
T1D97183354B930493F72B02F1E4C2263B3A73819409679E463E54C9FE296EB26CDD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aed9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aed9.TMP
Size 3KB
SHA256 832dc877573b80b52b2c1da363ee70a112dc8e9f3f1d12312979dfee24c1e4c8
MD5 84e92cc26e5b73681642ff9435eb69f9
SHA1 4f486c7b9076609008d68f856f6fa270fc2466d5
SHA512 bcf4fc76923da65aebb0aac6b78d0c645d8141894bd1129e402679b5a4891d3814870553827227eb9ebeb76ef60fb7d7a2e0c8360374fc3da01c97bb8f1f1ed0
TLSH
T17C6172394B134883F32B02F0F4C2162A3573819409A79D463D5489FD691DB26CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 08030ef405c1529b516720183de3fb7704497fa210362c42d1c4df92c392aea1
MD5 4eae86bd94cdbb7795ba702c3d1d3b19
SHA1 76706ee40d243dc554ee65a8ed9e349f08f069e0
SHA512 e2dea3adc9503ae462a6d61e75cf65c7a8189502e7b2053e4b0173053d09a2f0478b234c170dc88d8c9c02bb89710bc7e3994a7d17626db5dcf7e64724360cb5
TLSH
T1FE41B0F782F08A9EDD2156F0A6146E2BCE1D0915862C3C5E89D0EE67D3E3871E111B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f140a238402606a114e01110b2b6c4884e6cbd018664d21fc3008b1d70f9e885
MD5 dd8b46b397573b5643f354a8510acb4d
SHA1 e033b8eea3ebb23adce1817415fbcd31533fff2d
SHA512 00fabb93a8c435bad70ec9e3a6002046197b1222247b84ffca6470630b2a095a14ad42a2c9d2d99077459d937992095155b9e3b8bf7a62b6489b9cb2e09d9c62
TLSH
T10F418EF7C2E49A5EDC1256F0A6246E2BCD1D0D05822D3C1AC8D5DF67E3E2871E11255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a1fa740186f06d32e7275337179d91d2abd2212dced0bfa25e04dcfbe5f4ab67
MD5 587a89ac2a28de2ae7aa4a3f2709c442
SHA1 ae0a198ae2731d520e23cee9067c973244fbe6cf
SHA512 e09fb7924e3c92b53cc86cea3dd99dae4db4704168d094ad5197f4305aa97fb6679f1402a1cd2d3471a204a691e1058bb28d8eac5ee739be224ba72a0eca8e8c
SSDEEP 192:sxZ1RHyM/jK1Ml8MW4/frs8DIdpK9HW6+WNJKS/YHv9bAIgrJ:sxZ1Nu4/frs8ciHbV/x9
TLSH
T17E42F8156A389977CCDBC20DF9557F93D6F94472E2940E44A9FCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 31daa8602c6b0b613f8884aca6be25bbe01df79212673a2c24e591a13504ba13
MD5 6a4c4cbf5d6232ba78679359b4f325c7
SHA1 b202595419f30549700da1558f3743c0ae906fe4
SHA512 5d726370805e41e26fa511fdbda1f68e785012a14ada3fc5c17d55731040c8f737239ff4375eaeb092630b8cc38e210ea83f713505502a2d99f147bf36d12255
SSDEEP 192:sxZ1RHyM/jK1Ml8UQ/W4/frsXDIdp89HW6+WNJKS/YHLwbAIg5+J:sxZ1NqO4/frsXcAHbV/Kw
TLSH
T1C752E616AA389977CCDBD20DF9457F93D6F54472A2940E44A9FCCE1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c4ab475e31387c4fdd3cc35e98af34ab2ebfa85a78b20d5ad7cf33653d1f483e
MD5 e1da85e3a0a586a0c8e692a878fab6d0
SHA1 c30f9fab0e959d2bce66bcb667f21ecbb62ee4e2
SHA512 949cb230b0bbdc1ccbcfce2192750f7d7248ad21074da768fb1fa628389f82e4fac0ce4b14bb75bde4a41a17bcaa8772bb93d69ec9ad8895b944194df2451e5c
SSDEEP 768:VAUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RFroVz0T:VAUZYTMWvg09ou1ja7eLZmR+KT
TLSH
T169E20B2B280CCB7E4F844E9DEC2A6F963ED801CB6A584D544BEA894C03C77EB511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 877078883778cb1e5122d5f4267060c71f44356488533a491cecfbb2edc4aa69
MD5 cd49fb5bde308671984d95756712612a
SHA1 c7265ac5801bcc8f072a5549d2a59b0decf06534
SHA512 97ee0f94cf413b4eb84b6a4da8888d7337ace36e9e9c0c670af7b23cb927baa99c716cd9d8f8536a41f479c9516edc0100c14dbd1298c12622c17026d450143c
TLSH
T1BA51C94D0E609A5BECB841B215F364A437B0A4CD5A51DA136CEC2131ED8375E2D1F7AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce0f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5ce0f1.TMP
Size 2KB
SHA256 58aaf159c301a1bcc020982fa193411b7c8b6ea8c4ecd51f840a51de58ae2141
MD5 5d9a4bd243e148a565b024d3ec8116c9
SHA1 183a2a3e364a0f038ddd695052bbd16686a1cd8e
SHA512 8a7eace7bfa407a1aa32d5f55bd07efedcd583b74ef151726994512d850b7703cbc82dcfd6a191773ddfbfab9dad94e445917ef57f1985b3807241896dbae7df
TLSH
T1A551CA4A4D81863DD89440B30DE378B8333A68008755BF5374FC5636AC9279E3E1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4c2e5510d300856e8be4e3361a88832333d57640d954ab6219899daa8c66ecd8
MD5 3fffb0a5d2a274d12059b0ef1e4bcfeb
SHA1 bc6d3216b9ccf9b7691212aa693c0859f37f15cf
SHA512 68628a74135e9ba3aa050f1ef6801a403bc5a956317c05b68b9eb9230dee92ce56653f7ff48deb16b0ff3f65ae49e2afbb2c9499b669a5231be04a69c62892cb
TLSH
T176E068F72DBB1810AD6BC3D64471E4A4410138A8C64CAD8E00AAA2A310A23012806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 7a2636ebfe7fae214552e81e76b6a6a79241a4f546f47d481867b639a32aaf41
MD5 7384df979746252cad7fe917d1aee770
SHA1 fb9afce3f4625df742c1e49ea74bb652306bb62e
SHA512 9ea4f2ae3853ba07f84b5077cd717008f0becc36416f980ed3664bd01917fdc57ac3dcaf62c68a88330cbb6ae6e561653b73d2a942b3c71749ffd17fb2466ca6
SSDEEP 96:KA1eK2AUkQKJW6+DuKY033yKUAyGbOKUoK:E2bppRdT
TLSH
T115D1094A70BA12413C7D2A489254971B8FC271633228B42B7FBD41B29D67E21DEFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592b9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592b9a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1304010e945f5f5febb4e9949c0d079ed5ca6536b06d61b13063e4ea8d4b6b6b
MD5 48eb9718fdf394ec09a7eb1302b58857
SHA1 bcbf0d515cf18c7177d44a888bf0d22fb868250c
SHA512 0c3b5d6d272cd1b2d3d859ebc8c8aa90d226c1e7f0b5dcb9ed8d49815e60ea3f22bf28438b3a074ffb9c8b373057e7627457e2ba985e7df5899597790a8b5002
SSDEEP 384:ZZcIhsNq/IHByDnIgzX5od+685X8tJrcREYrsa+VY+Glod:xhIB5IO0GhcRNhg32y
TLSH
T18F825E325968AC7798E3E685F54B36539FB8D067E6C86B8481EC5F1D00DA698130AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1901b841373548132107765efb5fd7c0681655ca223d2b78ab32ebd7c49815ab
MD5 2528496a77527314f5088c71ea175a95
SHA1 df6834a30478330905ef07d85c5cfc69aca428d5
SHA512 4fe1ba816a7c2dd0664ec05ac697e6bf0a4dc353c14062eb80026524e690ed22de51844dcefec5ea32aee431718bc09d422478792f6f50d300512b2d0e157f9a
SSDEEP 384:KiFiZcIpsNy8TUNTUlIlIIHByDnWgzX5od+685X8tJr8REYrsa+VY+Glod:BFQpzwgnBDIO0Gh8RNhg32y
TLSH
T17EC209F259D7987AD8AE9747A77E2D028EBCC063F5846A50B3D85A0CCC961BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22b0ff45478bc549a26697b18fb29c80d84d2c43324fda0471f2bab01356a0ca
MD5 2cdbfba2dbd754337d6b350d5d897cfc
SHA1 8e9b7e39b9c4e1d1899b44e6a1ea4f1459cfbcf6
SHA512 45cea2d4be02be6ef6ec40c64d41b3c944add4e5cd0e39a8c08f4536a4448d8a6ad6109f862a4bc85b51e67a761ba370c803c38142e8aab7f90b04b4a7f3a9cb
SSDEEP 192:yONo61VWQmiUywTgGX5Obd+jqjzorvmk/aR43FOgU6:yONo6W5gGX5od+68UReOgU6
TLSH
T10702E935A8687C6B8EE3BE49B44737135FA52167EA542F84D6EC1B1C00D769C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49838523a877a254b7a364a1d60c8fce8f54075cd9f94a311895e7306326cee7
MD5 bb8a21160e18fa6446d7ad89b72e62c6
SHA1 8cb52fcb15062b82e867899104521667ad1257ca
SHA512 7a3eeabb9eb38f2da248262af74968a66298c3cb247dce941b2d5636dc85e267d49cf370f67402f468cbf29dcad70aba8cb0e9d314c8c06ad9393a1902ef2800
SSDEEP 192:/OND612WQmiUy2TAGX5Obd+jqjzorvmsX8ySJrLjJREcqerU6:/OND6zZAGX5od+685X8tJrZREYrU6
TLSH
T1F512F9326468BC679DD3B585B44B36139FA95127EB497F80D2EC2F1C00DB69C135AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 080ed7a404f60afb8cb470de7ee8ce03d44c393ea60149ade0d95a8be97f2bad
MD5 d4812c6ee34bc96215534f9f34045a92
SHA1 3d38c091b3eb76de8dc3a3b72cc2a211b6f06c3d
SHA512 7753345f4628a1355e31ceb9a64ded458f3e5fc27e673d05945437c8cab5282c6437d5a644c4bb8e2ceddd3d58844584fa8f93d8f5976e4e43b8c79badec50c0
SSDEEP 384:RZcIhsNqIIHByDnIgzX5od+685X8tJrcREYrsa+VY+Glod:5hzB5IO0GhcRNhg32y
TLSH
T133826E325968AC7798E3F285F54B36539FB8D067E6C86F8482EC5F1D00DA698130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b712fa08-05d0-453d-8e91-fdf32bb2ee6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b712fa08-05d0-453d-8e91-fdf32bb2ee6a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2da74f7601e4849a5a97d2857c1051237699b6871f3ededbef05bb8be5ca3fb
MD5 e758739a3969fefd1b8e8222c6c9d743
SHA1 77f505f7ad844c1969e144ecc8103f1a849cdadd
SHA512 9153e19d318cc198b66febcea219a6a16b33b61e791b7ee6c13263df8f355275a74353b770de73c5670f2d31a369a3bef899a7d7f98f7c194b4a3051c33ea1a6
TLSH
T12941F858A6F91108B3B77F5A9BF6A87E48BBB8772E16C45E10010E4E0662A40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download