hxxps://ctrk[.]klclick3[.]com/l/01M2NHSC8923N99SM5VYMP96AA_0

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ctrk.klclick3.com/l/01M2NHSC8923N99SM5VYMP96AA_0
Sample260916-1lt2yaef49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340686929550204"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{4A7AFC12-3DB4-4E2C-BEEC-3C5ACEEE2DAE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	msedge.exe
852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3192	4448	msedge.exe	89
PID 4448 wrote to memory of 1576	4448	msedge.exe	91
PID 4448 wrote to memory of 4284	4448	msedge.exe	92
PID 4448 wrote to memory of 4284	4448	msedge.exe	92
PID 4448 wrote to memory of 4284	4448	msedge.exe	92
PID 4448 wrote to memory of 2828	4448	msedge.exe	93
PID 4448 wrote to memory of 2828	4448	msedge.exe	93
PID 4448 wrote to memory of 896	4448	msedge.exe	95
PID 4448 wrote to memory of 896	4448	msedge.exe	95
PID 4448 wrote to memory of 896	4448	msedge.exe	95
PID 4448 wrote to memory of 2068	4448	msedge.exe	96
PID 4448 wrote to memory of 2068	4448	msedge.exe	96
PID 4448 wrote to memory of 2068	4448	msedge.exe	96
PID 4448 wrote to memory of 4844	4448	msedge.exe	97
PID 4448 wrote to memory of 3284	4448	msedge.exe	98
PID 4448 wrote to memory of 4844	4448	msedge.exe	97
PID 4448 wrote to memory of 4844	4448	msedge.exe	97
PID 4448 wrote to memory of 3284	4448	msedge.exe	98
PID 4448 wrote to memory of 3284	4448	msedge.exe	98
PID 4448 wrote to memory of 4400	4448	msedge.exe	100
PID 4448 wrote to memory of 3956	4448	msedge.exe	101
PID 4448 wrote to memory of 4400	4448	msedge.exe	100
PID 4448 wrote to memory of 3956	4448	msedge.exe	101
PID 4448 wrote to memory of 4144	4448	msedge.exe	103
PID 4448 wrote to memory of 2800	4448	msedge.exe	104
PID 4448 wrote to memory of 2800	4448	msedge.exe	104
PID 4448 wrote to memory of 2800	4448	msedge.exe	104
PID 4448 wrote to memory of 1744	4448	msedge.exe	106
PID 4448 wrote to memory of 1744	4448	msedge.exe	106
PID 4448 wrote to memory of 1744	4448	msedge.exe	106
PID 4448 wrote to memory of 1740	4448	msedge.exe	107
PID 4448 wrote to memory of 1740	4448	msedge.exe	107
PID 4448 wrote to memory of 1740	4448	msedge.exe	107
PID 4448 wrote to memory of 3572	4448	msedge.exe	112
PID 4448 wrote to memory of 2780	4448	msedge.exe	113
PID 4448 wrote to memory of 4380	4448	msedge.exe	114
PID 4448 wrote to memory of 4496	4448	msedge.exe	116
PID 4448 wrote to memory of 4496	4448	msedge.exe	116
PID 4448 wrote to memory of 4368	4448	msedge.exe	117
PID 4448 wrote to memory of 4368	4448	msedge.exe	117
PID 4448 wrote to memory of 852	4448	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ctrk.klclick3.com/l/01M2NHSC8923N99SM5VYMP96AA_0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffb0119c188,0x7ffb0119c194,0x7ffb0119c1a0
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7491651879382120400,12516677555606480767,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,17791349053553598247,7970626120881254585,262144 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,15246676617958405172,18257033354573065261,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17828901465127250867,6341889818621308240,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5102066543846361610,4841752455936913477,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1334903837399932287,17380615881975817511,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17001180298554699231,6099984169757447886,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2166337751956720853,5889035858253517833,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,2351175990887154820,17399063926912858758,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,1415778184027300872,12995420534132338423,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,1415778184027300872,12995420534132338423,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6128,i,11257677897446065541,10071941430326018560,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3404,i,18075234222733047677,13235083150743609894,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6372,i,4340800564604315209,17295029874007120337,2097152 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,14277275695629408320,17556233808852687994,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,1032510293964285432,6492970962935553074,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,14931033760025780172,1954838810422962810,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,4400079649527196102,11272629240539468097,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,3885934027843315317,495110822222987609,524288 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,968511552171812202,16917369736423546352,262144 --field-trial-handle=2788,i,7689058011734529140,2347949016524036293,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 28KB
SHA256 8ffd4d69e1f3782d5d937114e5b75a841e57ecd8f3e5e89f19590699f6f9225d
MD5 1091b063f7066055be657fdf2611759d
SHA1 d640ab733292c8edeec314a34cf9ab5aeea4ec84
SHA512 79a586da5420a1178ac4438968be29c67b01cd482020a235f9f447b487e2df660e40674d53d92a5a6f5ced83d71fb1ac7720d841318c9477551cc5bc34f16932
SSDEEP 768:XmNKsJcw8y70k1iYEpNP0twbnnwN8TiaK20u1UyO:mcwz03pHPcwbnnwG+20u1UL
TLSH
T128D2F223277DA32F430020F1B9E38FD97DDCAF635C165F6E407324A9E87A4355689680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 86d7b851a3ee22243b96a7024127dbc430dd1bdb46fb3727ed75977923a029ea
MD5 862d1efb4ca31ba665ea22fe733f4be7
SHA1 5fdee4ff16310b1c8bee386f8ec79ff16b6aa3fb
SHA512 7c1b8e333034805f4267cf254cf58f1503bd73833c08d8ff2e37f517f4d4a75f99cd887249b91e4e2cc752600b7716acea7106c2342fd7f1792002b096be3403
SSDEEP 96:lWraL38wnvxlJESnSx9wPeKZ9vNwuYJa8R1x0QhMgZ/3hKiOAS5VkvgB+OW:l9/dSxQeMFwAA1x0Y3kiv9/
TLSH
T17DB1CA8A58F84555FFE47870C0CAFC9E327C845C16BA1E8A247CDCEE9A8B7A54B14842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 52c13bb89b682f73141973cbe16800a07329247d40aa06aada7a76b8ff8ba492
MD5 fd994c404364e5a7ebdcd227963a7ea4
SHA1 2c597d907b7810e550634be3954cc10f922aa1f5
SHA512 08a2e0523c7c9911e807a9005e94c881e1bf07615a0ca28fea8cba0e65471d2c97c14ee29973417c6d3bd3d692c9f486d9a5c7e2e475adbbd81dd4517ff07ab4
SSDEEP 96:esseqQ9juv2yaY+lOvrQ35EkXFbnXxeOQKcG9HeXN5k6uib+qB8R/ma:aiSNM3tTXxMeU66XAt
TLSH
T18791968A59F49645FFD4787185CBBC9632BC845C1ABA1F83287CE0FD998F7A90A14C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59404b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59404b.TMP
Size 3KB
SHA256 839f6964b2637fed69cb75dcd028199a14822122133f1a76766f8e65ef48f8ba
MD5 948021995e4fd27edb585621037745fd
SHA1 e3ca4369fbbf9f920ec0613ce2f83ed46c0de71c
SHA512 6c92a456945586f894b979beefe432deb6bbc44c92e17c7e5cd8f6127d0aeaa73f3434a026c26980fc4223e32ee6aa47c8619c38025f040ed4a136a7649d2cc5
TLSH
T18451728159B48699F7E8B87084DBBDA3303C819469FB2EC108BCD0FEDACF7185B04840
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 3c8565f79a9593b746b58e9b874c44f7badb92e3528eb15a26f04ecba498834b
MD5 895c77ae593d4b1e6ea0e15f09c7464c
SHA1 506e19c125eb7145949dca133d7610bf12c30ec6
SHA512 4dd5e5b962651afaabeb0aa9859a1f04c75a9f41ee6c6a776da64a8d3bfcbfc726944f8fa1c81d9cb142b0f027734d21137804ebc7a4657eb73e02389bbc34c4
SSDEEP 192:DzvVvqvbvDvpvMvSevOvYvDvbvDvJv2vxeYw1Ev+vmEvKvT6vmVxviZvxvmLvAvb:DztSjrR06eWQbj7RO5eYw1E2eECL6eVa
TLSH
T187128AF296EC836DDD0191F0EB506F1ADE1E0824539D395EC9DCDF8EA7E1871E24260A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 14a99c3270bd3d07ac78e273e1f30544dd19bd752c7d984866bfae3057d9d26c
MD5 5cefc80a6c8955f58be62b675539b212
SHA1 ca0c0015045ba28ec98fd4bb46d1bed953c876cb
SHA512 fff219dafad3bfdccb5a0751ceefecde2c392f8cce58c79c66518d8a42cf2f1020979b3a2d997683b57ccd3ce549a3d234bd48b222b6e83ba0f923c3b36899c9
SSDEEP 192:sxZkRjWI/fls2mIdpyKsHW6+WNR1Z/Y36fAeIgrJ:sxZkYI/fls2HUHb5/X/9
TLSH
T18522B5567E38A97B8CC7D219BA65BF13E6F9103251901E88EAFCD61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d794342d18c21131ab21a288e142800ee3f6cd40f8129558b66b3b20a54d238c
MD5 9ab8abd411713594b8f3bfb576d0f10e
SHA1 3d425c84025a5a90c25d2da088fa57b030b6b652
SHA512 17be3d381ea9942a2e9f90afc8f1bc3175be31024ed70ffe2795294a48a74e5ab3dc09acec411ad5b0f99d19b71cbe348f39b383d199920a6429b66bc8adda96
SSDEEP 192:sxZkRjWI/flsC01Idpkq8HW6+WNRusZY36MAeIg5VJ:sxZkYI/flsCnyHbTZXe9
TLSH
T18322C6567E38697B8CC7E21DBA65BF13E6F9103251911E88AAFC8B1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 40cf2bcc1a9f26b247c8aad8b56a0dc3d14b0c90379302931cb0732cc8a7606c
MD5 4254961cdb4f88641d55b53b180592db
SHA1 d45fb4612f443473222d1823433ce80990b95c63
SHA512 05ab6a7636473951326f10eb0bd0ec059a624f5f659a9f33cdc024fe6acfe6e4520eeb7c3879032256d24533002a8be38c159bbb4a961ca8551f65c894338e2a
SSDEEP 192:sxZkRjWI/flsimIdpyKsHW6+WNRh/XY36vAeIg5HJ:sxZkYI/flsiHUHbvXXv7
TLSH
T11B22B6567E38A97B8CC7D219BA65BF13E6FA103251911E88AAFCD71C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 821024e14c7d08f0e69c9062e1969235494c09a94c08b54f368e734a446dc851
MD5 0c3e5a7db27b79ba57ef332b78c50af5
SHA1 715d05f3faf58971e6f39d21d9e2d4a38d3293b5
SHA512 aaf11486175d45cca370ebb2782cdffbf53a527457063af86dbc0afabe782d358781a9455a2b15fb810816b4306d06081bbbb9d8cb7d966e7e875438531827f2
SSDEEP 192:sxZkRjWI/flsC01Idpyq8HW6+WNRusZY36FAeIg5VJ:sxZkYI/flsCnwHbTZXl9
TLSH
T12D22C6567E38697B8CC7E21DBA65BF13E6F9103251911E88AAFC8B1C05E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 abb68ce503907ddcf8c1c7eb477e967c6531726d8b73f4c1d5d51c5b55c4d1d2
MD5 177534e49ceb1e8afc9933c7f5d78619
SHA1 12c756f97f2879a90d38830ff650ce29c1343018
SHA512 63b89f31cd52ebc5b3bc4271a4582b484b0e59be8e06e6048268a6c30419124c75ab01756b9e382efd6780cebfde627d5e48b13b88dc5e3e0f55cb5be998fd14
SSDEEP 192:sxZkRjWI/flsCmIdpyKsHW6+WNRusZY36FAeIg5VJ:sxZkYI/flsCHUHbTZXl9
TLSH
T19B22C6567E34697B8CC7E219BA65BF13E6F9103251911E88AAFCCB1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 94c475cb3e4e8f2e53fecf7d6fdb1acd471fd80a4eeeae3184032c2ea6edbe5f
MD5 0264284e93ddef7d50ebf7df3160e9fc
SHA1 e1baefcc9a64e5e35ae0216e12c132199c838d4d
SHA512 c324a45ffa5edb141d8035b7050de3a41f7d6352b0cd164e6bb973f6dda8d0de311285fb01d784f3e8d4dd82082b1d8da0fe67e68454e5dfc7b36551763035d4
SSDEEP 768:zjKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/gropV:zjKlm7QWvUYe0u1ja8/L/E/rpV
TLSH
T1F2C20A3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EA91274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 2KB
SHA256 eb0b7ef19e2afbaf30ca31c1160932f9882160e8167a703b7a59b46a42ec4621
MD5 0b2a9972718f1babcecf60a941ca7866
SHA1 31b1138a0416201dac13bc9d739ec02604395675
SHA512 9a904a4ef2d22128149f1b78fd585e851c7be98487a5c7d0d0581ade23e082d933ab2be3097d35fe4b0457f2ef9b857395e0baf178de85e443a31f915aaf299e
TLSH
T16151AB479C98DE33D9F413B0DEC22028773915CD894B868A16A5BCE53DD327497D309C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7e315339a485c39bdcaeb58daa1de0d3f5d475a43e541339d254c37da877f14c
MD5 c9c591df9167ddeba321fd9f3df37b19
SHA1 fcb4baabe81c786a37eff212d0937f97d1253d65
SHA512 563dadc5613c83474775a7773cf315399b29ae0039624fb655e9566d959c3bc982af2e278b6d9f137b69654376e598b97a704730f57bb7f5b256a754b82cf494
SSDEEP 48:K0vSbvRxRqbpkZIS/qK9f1VqxP6YcdfDyLS9AsSwQhbM78ISEhK9I1ShxqxYzEIo:KEoQKBGOOJaKiw18wKhG6yQQKV+E
TLSH
T143B1431871BF0744387E255891648B5E534131A3311CF7BBFBBC14A28E6AE085EFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42224684-93d6-4a01-acd7-390ca7ad68e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\42224684-93d6-4a01-acd7-390ca7ad68e2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 38f726f7bf2913969313fcf80ff3628f8f38ea2c7b364cbc7ee343afd33085db
MD5 16ee2dbe31f129c299c366ea37d114db
SHA1 2544285f348a2026ea6d627ceac230f2ed135100
SHA512 d49c3d25731fbe9f28cc274cfd9fc8a9ea11818eceb740aaaa438ccd36ab5d3d898ef0100cb975f3f6784a693097fd4efdda726d42bae2be93c668059fbe4a1e
SSDEEP 384:HZcIIsNFCFbQFLh//ueKXQEac7O6R2Feo1lPo7:vII9/2VQEh7TRMs
TLSH
T157827BB66C78AC3B5DF7D186F4427A139FB480A787C94E90DADDAB2E01D95980307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9e7cc219dd6e8490e0dcab7c999fe31c314d1fedb7abcbec7abf09bf3cc1af1a
MD5 5b73c8faaedf102662dec6b497e452f3
SHA1 f34ca365870e0e6356e311d12b61c735db821056
SHA512 30d1ad9d24b8ee932e1cc972725681246f61443ff6eae2755912e98c4c7fe153ec2db7454be76b9e2d971784fff030933e24fca7bbe3a8fe355579926c868a5e
SSDEEP 384:NiFiZcIxOsNf8TUNTUlIlCFbQqLh//ueKX8Eac7O6R2Feo1lPo7:EFQouwgS9/2V8Eh7TRMs
TLSH
T156C22AF258E7983AD9AE8747A77D3D128EBCC063B6855950B7C8AB1DCC851BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 040a6ec0bb18e64757c522e69cd89ad2dfa56706b1a1789ff2cfedb089607ea8
MD5 4f41a496e6b05ca23ec5a3c58d8c8b0a
SHA1 2c5662c74b126d4425bcb957b52d624a35927dbf
SHA512 fc369d4491a22bb0fd2a410e3aa91cc56c359b6354fde4ff0935c4b009b4b398862f5d197de924895adb3a68faf38679399bc964c28276f244790ef9376858e1
SSDEEP 96:KqONkCQsjpfbUmjH5ih/cIPURHl8h4otop5waDgBKP4v+Y1xf//ojdlxsYnXhuZx:BONa6JUm0QmiUypEso//uhYBCEyUU6
TLSH
T19002C679AC68BC7B9EE39E45F0877B239FA4107B9A911F84DAD82F2D01D755C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 26ce45ee57f91321e4f45e44663e0e02d5c86a35c7096d3add21e0e381261dd4
MD5 ce475b747b215219dd7a1654472d7dc6
SHA1 1d647499f2305712a35945626e3a2b2089c82308
SHA512 94cead249f432ebaf5812dea59805837660c8779771989f79e9c229d606f2816977e8dd73b3c0f630609dd1dc000e9b85976117acea3c8b42238c742777ad758
SSDEEP 192:uZGsNF3QNW+UbEyQmiU1eC04h//uhwKLTGaoE3/CcemO6R2IMMXor1lZ:vsNF3FbFFLh//ueKXQEac7O6R2Feo1lZ
TLSH
T194624A767878AC3B5EE39195F0473A23AFB440B78B860F94EADDAB1D01CA5985307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9659b3025e7e8f479aab938d9a8b4d8271aee044df3bcec52f5b158f9859b521
MD5 83bf003ea47b4a266f2f8e37dae79a50
SHA1 db77b4b5b68330e7b5adc433cbcbf0cd7dafa3e8
SHA512 7a42348c5011e64bf84388217fdf9b326c980e33d4cab7fa728df4262aa69140c900e9d851847ed9a787c32082d8a032fc46620476c8efd2f2652c876e047792
SSDEEP 384:LZcIIsNF3FbQFLh//ueKXQEac7O6R2Feo1lPo7:TIX9/2VQEh7TRMs
TLSH
T1EB827BB66C78AC3B6DF7D186F4427A139FB480B787C64E90DADDAB2E01D95940307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d3fe59782ac7c789056e50d41f26f0f9b190b830af2c6dbe1a016e5c9989fe13
MD5 6a81407bf6f2d993619745b97c00bc35
SHA1 281cf3c3e2aaabb8c11f93516d37cd21437a970f
SHA512 b8d34012788c34dc64bc8ef7a921800e20cb930530f9562d855da8eec8256960369021c7d15740addb4f5ab7080bd354d20e5fea8479b4533a4de52f886f2c55
SSDEEP 192:BONw6JUHQmiUy1EJo//uhwKLTjNxE3/CcU6:BONw6+pJJo//ueKX/EacU6
TLSH
T1E3120936BC68EC375EE39581F08376239EA441779B855F90DADD2F2C02EA1AC5307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3cc7f66-157c-4898-848e-81f11ebed607.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f3cc7f66-157c-4898-848e-81f11ebed607.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 92814dd973aecf527fa97975ca8bdc98ada43364f3410a9ea19ba747e1c98cb8
MD5 6f0475c8c91fecb460dd4f2a9bb2d66d
SHA1 1ea142beb15071db70835dba98d9177d61bf0bdf
SHA512 5b1fba6d519fefdc92ac95f12bb8eb654628c62b4b6dd58a5d230ed055cba4df488238f0556f03467f41b173cd14484e9193ae4ea854ebb7fbc63c16aaf92c35
TLSH
T19141166CAAE91108B3B76F16ABF7686E587B79332E46D56D00110E4E0A26B40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download