hxxp://closewithclio[.]com

Resubmissions

16/09/2026, 22:27

260916-2dbq3afa653

16/09/2026, 22:24

260916-2bqgfafa473

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://closewithclio.com
Sample260916-2bqgfafa47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2388	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340711092808139"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{D6B262D9-DF64-46C6-9B93-07E674C3315A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4864	2408	msedge.exe	86
PID 2408 wrote to memory of 3892	2408	msedge.exe	87
PID 2408 wrote to memory of 2388	2408	msedge.exe	88
PID 2408 wrote to memory of 3892	2408	msedge.exe	87
PID 2408 wrote to memory of 3892	2408	msedge.exe	87
PID 2408 wrote to memory of 2596	2408	msedge.exe	90
PID 2408 wrote to memory of 2596	2408	msedge.exe	90
PID 2408 wrote to memory of 2500	2408	msedge.exe	91
PID 2408 wrote to memory of 2500	2408	msedge.exe	91
PID 2408 wrote to memory of 2500	2408	msedge.exe	91
PID 2408 wrote to memory of 4572	2408	msedge.exe	92
PID 2408 wrote to memory of 4572	2408	msedge.exe	92
PID 2408 wrote to memory of 4572	2408	msedge.exe	92
PID 2408 wrote to memory of 5648	2408	msedge.exe	93
PID 2408 wrote to memory of 5648	2408	msedge.exe	93
PID 2408 wrote to memory of 6104	2408	msedge.exe	94
PID 2408 wrote to memory of 5648	2408	msedge.exe	93
PID 2408 wrote to memory of 6104	2408	msedge.exe	94
PID 2408 wrote to memory of 6104	2408	msedge.exe	94
PID 2408 wrote to memory of 2768	2408	msedge.exe	96
PID 2408 wrote to memory of 2768	2408	msedge.exe	96
PID 2408 wrote to memory of 2768	2408	msedge.exe	96
PID 2408 wrote to memory of 2744	2408	msedge.exe	97
PID 2408 wrote to memory of 2744	2408	msedge.exe	97
PID 2408 wrote to memory of 2288	2408	msedge.exe	98
PID 2408 wrote to memory of 2288	2408	msedge.exe	98
PID 2408 wrote to memory of 1280	2408	msedge.exe	100
PID 2408 wrote to memory of 4752	2408	msedge.exe	101
PID 2408 wrote to memory of 4752	2408	msedge.exe	101
PID 2408 wrote to memory of 4752	2408	msedge.exe	101
PID 2408 wrote to memory of 2440	2408	msedge.exe	103
PID 2408 wrote to memory of 2440	2408	msedge.exe	103
PID 2408 wrote to memory of 2440	2408	msedge.exe	103
PID 2408 wrote to memory of 4740	2408	msedge.exe	105
PID 2408 wrote to memory of 4740	2408	msedge.exe	105
PID 2408 wrote to memory of 4740	2408	msedge.exe	105
PID 2408 wrote to memory of 5164	2408	msedge.exe	106
PID 2408 wrote to memory of 5164	2408	msedge.exe	106
PID 2408 wrote to memory of 5164	2408	msedge.exe	106
PID 2408 wrote to memory of 1180	2408	msedge.exe	108
PID 2408 wrote to memory of 4164	2408	msedge.exe	109
PID 2408 wrote to memory of 2612	2408	msedge.exe	110
PID 2408 wrote to memory of 2848	2408	msedge.exe	111
PID 2408 wrote to memory of 2848	2408	msedge.exe	111
PID 2408 wrote to memory of 5140	2408	msedge.exe	113
PID 2408 wrote to memory of 5140	2408	msedge.exe	113
PID 2408 wrote to memory of 5140	2408	msedge.exe	113
PID 2408 wrote to memory of 5756	2408	msedge.exe	114
PID 2408 wrote to memory of 5756	2408	msedge.exe	114
PID 2408 wrote to memory of 5756	2408	msedge.exe	114
PID 2408 wrote to memory of 848	2408	msedge.exe	115
PID 2408 wrote to memory of 848	2408	msedge.exe	115
PID 2408 wrote to memory of 848	2408	msedge.exe	115
PID 2408 wrote to memory of 5932	2408	msedge.exe	116
PID 2408 wrote to memory of 5932	2408	msedge.exe	116
PID 2408 wrote to memory of 5932	2408	msedge.exe	116
PID 2408 wrote to memory of 2316	2408	msedge.exe	117
PID 2408 wrote to memory of 2316	2408	msedge.exe	117
PID 2408 wrote to memory of 2316	2408	msedge.exe	117
PID 2408 wrote to memory of 4060	2408	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://closewithclio.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff325dc188,0x7fff325dc194,0x7fff325dc1a0
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,13127993981892051016,3126368504325581380,262144 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,988620514745928875,9880011819749370580,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,14316555067104230419,4198181584991150556,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,3195210697528489321,10350991660424570387,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,5519844890464191549,16847230180711587644,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,17187440504563590310,8322634830169193639,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,14685157343985228983,18085898699818790935,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3716,i,13049941908295696324,12672398656356382530,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,5619080384839001481,17844174919737586632,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,8565715197724762645,4730307369018273729,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,822675273507999912,7689023354564436201,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,822675273507999912,7689023354564436201,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6572,i,17425050821640931310,5913876179948184077,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6744,i,14209382668546010602,776385248434657766,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6844,i,7095787092891854428,5779574701138376509,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7124,i,1534131538137332114,5821476355416965510,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8022172957568526333,7200460645359039662,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4972443900941079431,12883002139760977293,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17298377675778565175,16427845513117213875,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,3154250019844271754,16696152047270890028,524288 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6160,i,3121934755727669854,5773073511988662888,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7232,i,15223100624390011629,1463317683554162206,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7400,i,15647099107130683390,11537958627138605034,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6560,i,13233175280504873899,11672510984136197102,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7244,i,2120370620873070840,4240105469236044846,2097152 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,14427103832975009341,643782778499935861,262144 --field-trial-handle=2472,i,15848824465322240713,8701691632588888208,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 77KB
SHA256 5f2e151940b101513eb4504dfebdf9fbe9b40214fcb53bb23b8e69003476044c
MD5 61255e4d8cb466999b158000a74b9c47
SHA1 13c704ef28ff6af60c475de9d3cdca70cd1ccddb
SHA512 c0202b8b0616efdd50835f5d6fde776079b96f197fc802a363e2ce4790c33c89739e68c13cfa807ba4163d779f5ea343ba0cf4c5c703d74dcf17f9e9ed7195ad
SSDEEP 1536:YjMOlfECyxqgNOd5jZn+QJsJ5ux3o7BJozDODtt:QXfECy65jZ+Q541
TLSH
T10A7380CDBA96F06553A372B0802F510BB17B6A59B44E84C0D666D5D0BCB888F817BF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 446KB
SHA256 ef7dd2f445167412db7fe62a1c46439bd60b51487acaf8e2494cbfdd9a888fb3
MD5 7dac17d332e201e81eb05bcd25e9012e
SHA1 b2abca3819d376ae3c8b289171da4a584a4a1d21
SHA512 8832e3a55d176c074162bc8b0e9586800315f3f5902e6cdb5f4d36098d5a6223f1d766c51355825b4609bf4dc6f0bc345b98293569bb7d129919244946048b3c
SSDEEP 6144:PsruhyOqNncU8I4yLVVzXVp1/1R2Yc/JkBppy2+rNHWodyv:PsCC4ypVrVp1/1R2YcxkBpwWodyv
TLSH
T1FCA418C5BA90F06547E3A1A194FB5506F3397E88744DC028B7A8C8D5FCA998DE227F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 379cf0a13d2ee007a7feff44c979801aec47f78d4752683397665bbbfaa14c7e
MD5 509662451e50f6b2a37001c701f3920e
SHA1 0b46a8d17ef6214b9f252f12512601c17286d9f4
SHA512 fffdf83659f7e9c18d3ce9ca017341cbf053b6a2ffea831e46e0f899fd31e491311026814985c73d9987cf2ce2c024cbc7a9e15a0b855ac20ecd7bddde2bd91c
SSDEEP 96:N59Bo6FJvOMMMOqh2SmOJsjtkgdNiMkGI2EcU2d6xmgbbWfdQbL7U:N5JvOoOymlyhM/I2371gbql6nU
TLSH
T113B1BB82418097A2DB593FB3969668C62E3067FC724E0AB37CD5EA65FB1E283705DC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 99950b5cfbae804e6dfb79b29a04cc408ee667c989af185163fdaaf186ce1d87
MD5 39ea85364be0c41f42ed1337ad45b6f5
SHA1 e95e87f9098ddd60f0ad4b9d7484ee27c699eafe
SHA512 4d09faaaece2493e1e007c88bbff521f673db071699ad22638f6944902fe3a2cc8a2c955ce847f605870e3c990d0bb3f8852c941ded4ae1473d970fddb5abcc7
SSDEEP 96:1qoRp0sOMFo6FJiBYAFIMHQJS9gh9V42cOgz42ZOJgfQlQMC88lJl:UoXJOYAFPh9apPy16bsl
TLSH
T165A1A58381C0E390CF6D37B29595A8CA3E34A6BCA68E0FB3B4D5E665D71F292715CC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a5083.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5083.TMP
Size 3KB
SHA256 5ee82c0ced4077b56aa540c240fd3643fa0640855d559af7a954400a6552ecc6
MD5 a28540d18b790dc7a1ab4fcd4fe5251d
SHA1 30783095d0f0d56eacf40c6eb8e4c000a1a80c28
SHA512 3c6952f2d4c735b12368dd8baea2f11ebe8aec8e579ce78506a6bdcb5251398636c131067f0459a743ebab376fc803d76e6e6de1e1a07395237fa6227b7bc223
TLSH
T1105198828284E391CB5D4373A5C565C77B709BFC978F1E33A8E0E7649B1E302B25C844
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 76470fe344a3eeacca14ceb190a4a413c3fc1d542c32a16d91d412a96677e23e
MD5 477a31266c66314d7e2750f3e7f68662
SHA1 8a32c380872a38f218c893c2306ae854d8a7b131
SHA512 1934e2a3baee6e9b63eead4f6157cd25a82e019953b69c37bdaf6a2297501c4c88fe719467921c7f3c77c975e842711e146a510123ee877a33452dbb8427fb11
SSDEEP 384:DF7Av6o7uLA9uUcaimd5N1FH6nxLOaVvGQdFHpJ0bs/a96KDpzF954NmdWKTMv7e:Dsh
TLSH
T1F2429CF683E4432DDB1191F1A6182E2ECE1D05A453AC3D59C9E8DF0EE7F2172D142A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ff26ac40380ed1d5466aa019e7d488a5dd3a1e4f60b3d88d18e0888f3d3000ef
MD5 ea117367466dcb3d6b5715690dccd998
SHA1 e90a016ab758b51a194efb847be4a4541b04294e
SHA512 7b211ca2bd1c8049e456b5b69f4ce5212fe4083e7aa81a38c230c6f8a80c65697641104f49a4bed84e9d50f2e2c0b65edf58314b53ae2c64c86d726af1a09a5b
SSDEEP 192:sxRjRObD/fs2s7AAyYh5zoA8pGBY/g6+WNC3I/Y2Lc3GSIgDfJ:sxRjqD/fs2s7lbEaY/5r/e/V
TLSH
T11632BA15AD28A93B8CCBD21DFB65BF53D3FD5072A1941E48A6FC8A5C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 14091158fae333b3004ba085a1cd692d401e7aeca92a938b02e8a9a809155465
MD5 e868e9416b11b52da94e776012962eef
SHA1 694a0e3ec4811829a7efa6f5417840bbb7e3de8c
SHA512 a0a697bf08caf0102d7fd872c2bf1a3be1f4f786cbfa6d993b1fda5824d2b5278c0de740e02fb724fddd68c3e4626085fbec70c1b507139d6208be9a3b4bb4ad
SSDEEP 192:sxR8RObD/fs2sVAAyYh5zoA8pGBY/g6+WNC3I/Y2Lc3GSIgIJ:sxR8qD/fs2sVlbEaY/5r/e/s
TLSH
T16232B915AD28A93B8CC7D20DFB65BF53D3FD5072A1941E48A6FC8A5C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7749b893c045dec74851d12b86601a128a180ca14afe08e8d0c9b0cfe6d8311f
MD5 c58125082f467734ab10956e15bd8889
SHA1 98c561bdbee0bcec6d0dcdfed08b4c7cf234a022
SHA512 33c80b6142dbd7bc804ed46db0d668aef88b1ab3bf74002676d6951a3166c24983902e31c47049d70615d56bebe73138f0a816f361b8e3dccbdfff29901875f1
SSDEEP 192:sxRjRObD/fs2s7PAyYhYzoA8p89/g6+WNCR2XY2Fc3GSIgDBJ:sxRjqD/fs2s7obh8/5BXY/P
TLSH
T12142B815AD28A93B8CCBD20DFB65BF53E3FD5072A0941E48A6FC8A5C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b7a882c2a501b7863ac2b280c931649c34184cff9d84a1780fb8eacfe3fce8a1
MD5 ca5868354d0cfd0ff7b4737455bacf8d
SHA1 035185714b39abe0dcb21f3cecbc292361ff4a32
SHA512 68a8ce226d3107737ec33b85f5e7b222c5f292ee2fc11bdc97574a0c3d6d3ccf7550b24369515a4bdd0244e5df366eae721eece51eea8c93f44fa6a96fa954be
SSDEEP 192:sxRjRObD/fs2s7PAyYh5zoA8pGBY/g6+WNC3I/Y2nc3GSIgDBJ:sxRjqD/fs2s7obEaY/5r/W/P
TLSH
T19842B815AD28A93B8CCBD20DFB65BF53E3FD5072A0941E48A6FC8A5C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e348842b3830f5ec0f2ac1d2013c4d8df310031640fd5f45f14740da9b864908
MD5 2efdfaaf5708f446d98fd7f9cff333a1
SHA1 db7da52d8805be7840d8457ee050c5c80e967eea
SHA512 3de274026fa5987bbfe2a326a64f08ec64ce0166dc263eb01f08072ea358aad979f301213be45f2d7d7f70453295aaa69bd7afb89c30b8c1b4b4c2812f35704e
SSDEEP 384:LbnaaCTfCtgp/FfrDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWzroHr+:L7aaCDWgptfrD8F1+UoAYDCx9Tuqh0Vl
TLSH
T14AB2EA2F640CCB7E8FD00A9DAC596FDB6E9802C796588D4047FE984C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 101B
SHA256 bd2ce1b2511682151a83372fc6bfde08f9b839887b31c7fe0a6a7b601f735bf8
MD5 3d9c3ae7465ed0c74335630448b2b305
SHA1 639eda43b8e97d9fc633c5f9755137558d1b2688
SHA512 67ddef79693dd0ce5f697d4ab4be2f80bae2021ac5e478e1defa6fbd0e8a72549e47c1fb0c23f14f94629d28e3f3da3752b26b163db3d2f1ea2abbd028c0bc32
TLSH
T143B012FF1C04C24F4BF055D03411714DE08B024E4CC4DCF8980450613068AB71D01C03
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59e9e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59e9e9.TMP
Size 185B
SHA256 49be79f6e7a2deea4db0ba00d1dd314783da98724b7316356195d53f9175a7d0
MD5 88120358a3d5e418abdc8021d7ee2a83
SHA1 79b4c30366c571c3cda412f4fdab61850c6e6844
SHA512 652b1eb3869dcc3cf83e9bd6143417a3819d804853022e6cbcc878ea3ed40aaa20975aaee1f6614f21e726140e2e8e7b0e1f5f9f668117a84d63e6531050e2ee
TLSH
T107C012BB5572D54A077065E03821715DD0960E0A5DC4DCF95404716170786575A16D12
MD5 SHA1 SHA512 TLSH

Submit Download

5200b77f-9956-4f8e-8108-a8b7c5a87d52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5200b77f-9956-4f8e-8108-a8b7c5a87d52.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a5f94364b6c8d172df47e85dede19850bc73c0160dce99953218540ccd57d4f8
MD5 d6929c2471355e652fc2c0bfeaef59df
SHA1 f975f4c8f4cca3e5035aaee7efdcf4caf618d6cf
SHA512 702e65c7a0ceafa22f691f18088b47931c178b28aaf33683eeb192a6be791f80b3946ee6655e303a63d9bb982d996cdc3a1b8782ce823038ac093892998bdd05
SSDEEP 768:y/UxvxjgC+h3xV1q5gm1d8HZgDmGA5b65Q92RQMPbE4Ak2tf:3Zj3+h3xjjAAF65dQr4ABtf
TLSH
T12F13CF36ECA5AD73ACF9A18036467747BFB44423C0C956A419E96F0E06C769D430B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 db132dba435bbaf5562885371cb3b5e2cb7063daae0ddb1e027038ddac7356fa
MD5 f983ceb89091abc6e35a43225268ff3b
SHA1 caa6c8c931ce0414f012ba3280174db6a53716f7
SHA512 df30518d2ac8bcd3527488292535906ed5b4ded4ad947b2193c69a85830179c04fb4d38fa827ff8e8594db28450aee96377741ef620e425c8810cafb74fbf3f3
SSDEEP 768:yk3xVcu5gm1d8HZbDmGA5b65Q92RQMPbE4Ak2r:yk3xq3dAF65dQr4ABr
TLSH
T1A2F2BF72ECA1EDB79CF96181364676067FB88423D1CC4690A4E9BF1E01D799E430F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0f345de0247613f310f5fd594370f8d0ce93687bce4d8a3d4035f686e10b84b3
MD5 325ae09b8238ca2dcaaeede747dc1db5
SHA1 846e86f7fc0bc2368d7b2d7199ffe42c717e38e9
SHA512 7134ec9cbc11977e6c1851038a4b9651287155b89c2bcc8f83e763466adcb7e4ff29ea73f9de1ecde18b03390c8882e28f34fd38fd0bf6b0297fa3c79ffa7918
SSDEEP 768:GFQ93Ywg3Vlu5gm1d8HkDmGA5b65Q92RQMPbE4Ak2r:N93YzSAF65dQr4ABr
TLSH
T12F136BF298D39977D8AD5783677D6E016EBCC063B0889190B7D46A0DCD835BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ad38263b503a3f4bf8451ad3ca39cc593714af3d43a0b0df94ad344bbeb4f74a
MD5 35b368c7e2c1792922a3b1fb95d9c5e4
SHA1 73f292ecd5c47a6ebc165503b9f97908f7665b72
SHA512 aa9abe21a7e39bdf4377cc5e393bf87954629aca109a101c75e23c042b08fe76b619a60c938dc5c7493b3a347f9154b8b3685c1f6e4ddc41bee7772a7a62d1bd
SSDEEP 768:uk3KVcu5gm1d8HZbDmGA5b65Q92RQMPbE4Ak2r:uk3Kq3dAF65dQr4ABr
TLSH
T1EDF2BF72ECA1EDB79CF96181364676067FB88427D1CC4690A4E9AF0E01D799E430B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3cf203d8b75b52902ae50d9df79f3379bb3d69188bca86f7477d5d49b68c849e
MD5 0f4042155e9b67068e84ba141679f5e5
SHA1 b2a068fbdfe9adcee82fabbf9603c304d8aab05d
SHA512 e726fa6048adc83914d45b830285372142c0c18f7e0ff5d0d6214ef407ea8cd285115a95d59e79090e3aaa66ccec161a45f2b139c64bd807874c70a0971ed0d6
SSDEEP 768:U/UxvxjgC+B33tBXngm1d1tDmGA5b65Q92RQMPbrFj0O:BZj3+B3dBp3AF65dQEFQO
TLSH
T11803C036ECA5AE77DCF95280374BA35AAFF84473C1C955A049F96F1D06C768C830B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download