hxxp://clebari[.]com

Analysis

user interaction
yes
max time kernel
209s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://clebari.com
Sample260922-pefeesvera

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345528664575530"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{09529F6F-37BD-4764-BAD8-E1DC1668A701}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{D7347D8E-08D9-4CDA-B78E-5A015042F254}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3272	3200	msedge.exe	86
PID 3200 wrote to memory of 4216	3200	msedge.exe	87
PID 3200 wrote to memory of 1080	3200	msedge.exe	88
PID 3200 wrote to memory of 1080	3200	msedge.exe	88
PID 3200 wrote to memory of 1080	3200	msedge.exe	88
PID 3200 wrote to memory of 5096	3200	msedge.exe	89
PID 3200 wrote to memory of 5096	3200	msedge.exe	89
PID 3200 wrote to memory of 220	3200	msedge.exe	90
PID 3200 wrote to memory of 220	3200	msedge.exe	90
PID 3200 wrote to memory of 220	3200	msedge.exe	90
PID 3200 wrote to memory of 2744	3200	msedge.exe	91
PID 3200 wrote to memory of 2744	3200	msedge.exe	91
PID 3200 wrote to memory of 2744	3200	msedge.exe	91
PID 3200 wrote to memory of 2516	3200	msedge.exe	93
PID 3200 wrote to memory of 2416	3200	msedge.exe	94
PID 3200 wrote to memory of 2516	3200	msedge.exe	93
PID 3200 wrote to memory of 2516	3200	msedge.exe	93
PID 3200 wrote to memory of 2416	3200	msedge.exe	94
PID 3200 wrote to memory of 2416	3200	msedge.exe	94
PID 3200 wrote to memory of 3336	3200	msedge.exe	98
PID 3200 wrote to memory of 4056	3200	msedge.exe	99
PID 3200 wrote to memory of 3336	3200	msedge.exe	98
PID 3200 wrote to memory of 4056	3200	msedge.exe	99
PID 3200 wrote to memory of 2320	3200	msedge.exe	103
PID 3200 wrote to memory of 1248	3200	msedge.exe	104
PID 3200 wrote to memory of 1248	3200	msedge.exe	104
PID 3200 wrote to memory of 1248	3200	msedge.exe	104
PID 3200 wrote to memory of 2484	3200	msedge.exe	106
PID 3200 wrote to memory of 2484	3200	msedge.exe	106
PID 3200 wrote to memory of 2484	3200	msedge.exe	106
PID 3200 wrote to memory of 3560	3200	msedge.exe	115
PID 3200 wrote to memory of 8	3200	msedge.exe	116
PID 3200 wrote to memory of 1132	3200	msedge.exe	117
PID 3200 wrote to memory of 5360	3200	msedge.exe	119
PID 3200 wrote to memory of 5360	3200	msedge.exe	119
PID 3200 wrote to memory of 5464	3200	msedge.exe	120
PID 3200 wrote to memory of 5464	3200	msedge.exe	120
PID 3200 wrote to memory of 5464	3200	msedge.exe	120
PID 3200 wrote to memory of 5532	3200	msedge.exe	121
PID 3200 wrote to memory of 5532	3200	msedge.exe	121
PID 3200 wrote to memory of 5532	3200	msedge.exe	121
PID 3200 wrote to memory of 6056	3200	msedge.exe	122
PID 3200 wrote to memory of 6056	3200	msedge.exe	122
PID 3200 wrote to memory of 6056	3200	msedge.exe	122
PID 3200 wrote to memory of 2244	3200	msedge.exe	123
PID 3200 wrote to memory of 2680	3200	msedge.exe	124
PID 3200 wrote to memory of 2244	3200	msedge.exe	123
PID 3200 wrote to memory of 3956	3200	msedge.exe	125
PID 3200 wrote to memory of 3956	3200	msedge.exe	125
PID 3200 wrote to memory of 3956	3200	msedge.exe	125
PID 3200 wrote to memory of 5948	3200	msedge.exe	130
PID 3200 wrote to memory of 5948	3200	msedge.exe	130
PID 3200 wrote to memory of 2204	3200	msedge.exe	133
PID 3200 wrote to memory of 1636	3200	msedge.exe	137
PID 3200 wrote to memory of 1636	3200	msedge.exe	137
PID 3200 wrote to memory of 2936	3200	msedge.exe	138
PID 3200 wrote to memory of 2936	3200	msedge.exe	138
PID 3200 wrote to memory of 1280	3200	msedge.exe	139
PID 3200 wrote to memory of 1280	3200	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://clebari.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb0c2cc188,0x7ffb0c2cc194,0x7ffb0c2cc1a0
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,1432115468138494280,5300523986679180602,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,12302563832192412412,1629577864907283186,262144 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,4488408805219158524,6489071293864224056,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18050776180039471502,1441935766302173292,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6971024749741723036,15088558815967750791,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13067513064531750469,18249572600113352260,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,13040884737541647618,2469623338794982538,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3165008326479680540,1665196377514430486,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,9059864493584288242,15602894013823768484,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,18096309711423024044,3346669130811819435,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,18096309711423024044,3346669130811819435,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6336,i,7518665281686664321,10390371125574373848,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6504,i,13928984938162388963,3747181274410419524,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13741311212670817977,11182426959664822090,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7945531445528949921,4323996665841098057,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,15985404622259699449,11825134187616787437,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,814203402346005843,13614075220313079668,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5124,i,1417886564224400311,16660939349707876663,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6604,i,465208163284280413,4545457569959577973,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6884,i,2723026529498465821,5296357568118981106,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,13683454209385973605,12462019577036757673,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,14942125623708916455,8732514271548153082,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6728,i,16562538888496706053,11718252224565746123,2097152 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,17763850459017929198,11078863609847723492,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,12084088340605050228,16525609391928555866,262144 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,9465205194946024203,9315710909675685041,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1528,i,1607044686302094807,7799743032640085112,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,1938215051117728190,16632405692331467885,524288 --field-trial-handle=2300,i,954638691631472879,624362979627068136,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40a2c673-cb72-417f-bbed-67680ad7bd11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40a2c673-cb72-417f-bbed-67680ad7bd11.tmp
Size 8KB
SHA256 9a7e3cd3c683afdb0fb15ae7fcb74efa91897a4cd298f109481e454fdfe7b8a6
MD5 c1040559cb4244d2feeab8003c944626
SHA1 17a442e2faa5d2c22d56ab3e4fe5790b7fb1c8f4
SHA512 816a631a9a375b5875bd93c3335eddf4cafb59e1e5d7f27d2e2f39b8eb6b9cccee161643d4b95121f83e64c720a0dfc51be53db192b2df10736c9ac954d2a95a
SSDEEP 192:SONP6iDCQmiUyp2Hq5u88PMcPCsSqeHFU6:SONP6/xHq5u8iMcaMeU6
TLSH
T1DF02E739AC287C7B9EE3AD15B48B7B139EA4016FE6941F88D9E81A1D01D768C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 68KB
SHA256 aa8aa822dcc877a0002877631fd1888141da53bfa4838119a05e25ae6082c3bf
MD5 110c2e941f1ec2d409ba64e9076d05a6
SHA1 3112c99e2bcd5fa11dd1b28410b2c0a1bc76c0fd
SHA512 9ae278820122336eedfbef12aecd0ed14ea9947fb51bd52253c6c72f8b0df58284a38bd3baec36743dcdf026ad8ca383ca7eb2794cebd3886a02a4f405686157
SSDEEP 1536:a8ZGkKYRIqNz2tDACsUf76Z+AGYguWv0KxwhneRy4Y1R9s82yCENwYJoYl:tkVYR7NOAXX9GjuW8Kxwhne04Y1Ds82I
TLSH
T149630267DFF657B536E17808FC6CDA2698DE11684B438A900FBA7CC50F86C6284CD48B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 44KB
SHA256 50ff841b96d52649bc11ddd5c343b30aa63730e48d87b789c24fdfb1c3b80ef3
MD5 92b84614dde1055f02fb1f0a97fc1a3e
SHA1 81ab31e5a987cbcf58bcc7d2926dbcf8cf0893c8
SHA512 4b5b0a5d1232276522d18ae693c170c35d8d3cd1a6ac04ebe6c9ea2434f3b8f09eec8e30a81e8f32edf6b598de1caa976569ba67355509407ced2eaee09d2432
SSDEEP 768:QUj7szFhl0vX4A7hxnBvcxJl5jjNrTeICg12z3BzppFMUsmwwKpBUA7bzC4:QisHl0vIGhxBvEJl5ZTeICBzVraaKpBH
TLSH
T1FC23F27B08BC5B1CA45A2F349FC6A08178B893C1312B7AE93A8643C57D4E81AF155FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a30e3223bd0b6d76a36ebd6bb9e67d32c493998f733236f70fbb7824f1d32f42
MD5 6fa354088fcdc5e5ebd55e04838969a2
SHA1 d65cc4f4850a717602f0b9897f998d0e2eabf3fa
SHA512 5c82e8d3c50c6c27a3dece1552daa87585e758c8faff12f46d077450ea558e15a46e6d532e4c38d2631264021f7d4e7806008c34d40439ad4c266239846092ef
SSDEEP 96:g48f6yyDKBrtoQEIlC4fHOa+VUuV7kPWdTRumbBWzco8ZyE:gX6y5rk0Ofj+OME/
TLSH
T140D1B790A0A0758FFF9A3AB356F41987B930434E5D431EAB2F8EECB685C77D48034864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59fd90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fd90.TMP
Size 3KB
SHA256 cf4571840a8962773660606b0616747c7d3390f6bc96146cbb0d6b4bba67aff0
MD5 f1296bf397634cb6de13ced7d7ebee63
SHA1 1ab1cfeb4fc639f365854eac330846d5daf3cb81
SHA512 6444736b585f106f841587c50089aceea092b3ffd897136c5facc9934ff94ed67af80e071d3f3243e115297e2cbc4cb1f89a9cf911ff68ba78ea86e755ec0385
TLSH
T186613B8124A960DBFF9B4CF396DA1287F634874195932EE32FACDDEB980BB54C034840
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.atlassian.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 1e1a818275fe8794e16323308fe49dc6d4bbc11e76c0a296fdfd4cd816c97cd5
MD5 7929c8d37ab539f6171d2d068a8fdb12
SHA1 adfd9b81445d6b3c1c3c89f19c16975f7ea051fd
SHA512 0b81165f34241a8f3f2d38f18457b3ba04dcc65cb4e3359ae84c2f85806bd13206c6cdc8db1f87b40b90acf3ccbbbe820b6fb0a0fc41305fcc6d95906836c284
SSDEEP 192:DVSIcQgIN3CZlq1I2T1vDGON3Lsz1wUvgu85QzRuaz26x5:DVSIcQgIN3CZlq1I2T1vDGON3Lsz1wgR
TLSH
T1360292F7D3D99A2DD81259F49B18FE2ACE1D0515822C3D26C8D8EE47E3D2C71E15190E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 302f903c7dd2c88462066eaf331785b3db8c647a787e2be2a3ce03ccb87de3a8
MD5 2fa2bd3152a981194ff8fad2fa871c48
SHA1 3004adffc3abb89d8391acdea33b225f0f8747be
SHA512 7261c4aa5377c8b57567e5af9bbd5a6fb88c1156dfcef5332d71d844478a6bae2807635fff3612b79220c406917e4b5d3f9c1bdcd86da5829c5b92dcd794f17a
SSDEEP 192:DVSIcQgIN3CZlW+/2i1I2T1vON3Lsz1sgu85QzRuaz26RfUY/VR8:DVSIcQgIN3CZlWyv1I2T1vON3Lsz1sgD
TLSH
T1591270F7D3D99A2DD81259F49B28FE2ACE1D0515822C3D2688D8EF87E3D2871E15190E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f2de76b8a31e516e7b7db9c620ea59629fe1a82b91ae2520943b7d84127c3f46
MD5 e693f77f85697b65ef283d4ce0683ad3
SHA1 e738af97d29c284c92e893b2e081defa4664bbfe
SHA512 6f4456303a3b3b0aac96897758cf61d40b6d33cbf7f354164183bac5b72fa640d10ac2fc5a295a7a13983d4cdee26ac3034ca38facef0640d5437f3a83ddc897
TLSH
T12BD02273130830B6A95D3EDAA9AEEDCECB6700600802ADD410E0DCAE163A4AD0977280
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0637ddb21efb4c4d18bafa21a1aa0342b4e7a1fb1540fec350de94f59ec37fbf
MD5 abdf5ef8ed985bcd0da0307ab77e1618
SHA1 f274d44bf236ee881e66f78491d06ebd1bde98dc
SHA512 6a94c003d35e8ee3e6247fa5f3710af1fe553c85712f2d27ad0cd91df676ac2d155e36baeff5146d379443f356f37849020077dabe433585ebbf4c151d5850a6
TLSH
T11BD02233130830BAAD5D3EC9596EEDCECB6600A00802AEE410E09D9E26354AD0977284
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe593f80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe593f80.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f5dec44f6aa6ae808e798594d27b915556b838914628020a33955eff9eb08107
MD5 7b5ee7b572033a2ea75d42de850e73cd
SHA1 be3a48fc7fe2f241087c80a434bb1dd0a261597f
SHA512 edc7a3f860ca0fdd89d0317627829f677e655b0eb44a6ebeaf230f813f351945b4729d5c4647c1413946ea447f9709d88e0d9b832a0391e575787029856cc595
SSDEEP 192:sxZWRSucBzO/fisBNNCOdpTjZ0HZc6+WNRfTSgHHT/YaFptIgrH8FRz8:sxZWLmzO/fisBNNC+yH31hT/xbOS
TLSH
T1E142B752AA24D57BCCC6D609BE35BF13D6F5406299951D8CAAFCC61C04EE5EE2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fa5f75e7d6a2a37f1271fea4f3e58e451a6ccd236ec4bd791c9ca1584ca46fe8
MD5 c3bc56abdb44c387bede5818ea32af69
SHA1 6a89895968d1a431d184f4d7a1747c2f239145e1
SHA512 ad535f8f96285b7deb86ebccd8647f9b898f6fee14f3c3b80d91654a806709041e78c777e5b48d5d0196af7b17df9a7f2bc8d7da8222ac1a2835f6fa7652519d
SSDEEP 192:sxZWRSucBzO/fispNNCOdpTjZ0HZc6+WNRfTSgHHT/YaXptIg5yH8FRz8:sxZWLmzO/fispNNC+yH31hT/zmOS
TLSH
T1D452C852AA24D977CCCAD609BE35BF13D6F5406289951D4CAAFCC61C04EE6EE2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 41a4d5027c4ce49f5d4939fb2dfbcb9dffea6ba0faa941691781e9374ea045bb
MD5 da448cd6ce610db5cb0ef60a1c3b7077
SHA1 a3bcc3ecfe037c4960a4461843f52130d1b1a9fa
SHA512 8fcaa43a577d5af8d2c23a3a26f12b15c008c86089a341caa87a1833a520f332280a85db9e0faa86202a2c6920da215596bc7fb543c7de5066f29e04dd407e3e
SSDEEP 192:sxZWRSucBzO/fisKlNCOdpToFyvHZc6+WNRfTSgHIl1ZYa3ptIg5YOFRz8:sxZWLmzO/fisKlNC+lH31hcZT/S
TLSH
T1A252B856A924D977CCC6D509BE35BF13D6F5402299851E4CABFCCA1C05EE6EE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ed22db9efe6e6765ce8f97ec7700e07b022f7742510da64f6ba09fc40704c4a9
MD5 6baa4b898e8fad9c020f2ac109706a41
SHA1 387db9d463c8c930fe2da72970292f6238911909
SHA512 de9bfa6b71ff9d4464188ccf8282d47afb65ef87041764b05f79aa198c622507deceba1331067ea722b0fcd4ba950b71746d70b603e74ed436c342a53679af94
SSDEEP 192:sxZWRSucBzO/fisKjlCOdpToFdvHZc6+WNRfTSgHIl1ZYa3ptIg5YOFRz8:sxZWLmzO/fisKjlC+AH31hcZT/S
TLSH
T1FC52B856A924D977CCC6D509BE35BF13D6F5402299851E4CABFCCA1C05EE6EE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 22e1f839417ce8583ff9cef9dd7a46676175dc17f23ba108e1dff2abd63afa9f
MD5 bdbbc1acc31777eed1a63469bd80714a
SHA1 a626179ed1f2035ebe91352411254169b9cec330
SHA512 2e591637d8326d13a90adce857e71301f1a882908252ad2a592e776015d85973f3d3c29e1039f00b88184429f463c95568447cdcb5d18b76370596f28026f743
SSDEEP 768:jUyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH34ro0ZUu:jUyQRbrWvvlpZu1jaXKLf33D0ZUu
TLSH
T1F5C2FA3B640CCB7E4FC00E9DDC666F972EA802C766688D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d948f36d-05b7-48ec-82a2-19affb0d87a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d948f36d-05b7-48ec-82a2-19affb0d87a5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 27117284bc0f7bbf3ed6ff9f15a8af6244960493cf20d3350d6e3e82cf0e481b
MD5 288019b7a8525ea9767635d295499c98
SHA1 5afc0c6ce92a72cd631acedc5ab7743960a8a3f2
SHA512 f0e79795b03b69eff7a3fef38bd380298995b165c0a3fd13d439e6f27b87f98e62aa6041654c2674eb5ec7c6044ae93cd2a44a815d011a871bc2979d04fcaa2c
SSDEEP 384:YZcIhsNVXUyfulp5u8iMcaJB3Q+cBkwc0a3ou:mhSmxkd9fBkua3F
TLSH
T1E6828D326C746C7AA8E7A551B44A3B038EB8816BE7C85F84D9ECA71D01DF5D50307E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 139e578aaef4492909742f13f2b26d31ad7bf96cbcf4a5a2e9f5ca899a800837
MD5 36b1d6d14e368cd9bfc38bb17630a038
SHA1 c5c17eb62b23850f41f3ffdde24c8312958783e0
SHA512 8c12bfaf111697a95c3da93e24d8ab5295aa3a355a8b4d2eca9e763806e938f0214e97123bb10186e538f9b4b908faf65896cedfd50b7b610ef1033495b8defb
SSDEEP 384:DiFiZcIPzsNv8TUNTUlIlyUyf3O2p5u8iMcaJB3R+cBkwc0a3ou:uFQrCwgMPOkkdyfBkua3F
TLSH
T1F7C219F248E7983AE8AE5753A77D2E038EBCC157B6845A40B7D8561DCC960BFC306D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b4320cc3bf6d0326b2dc95c919efa177c0ff38ddcffab8c73c0e749ab2270552
MD5 b1895e38ad46375df0f3b3bd904f1ef9
SHA1 c8e772bbd2b385efda261e2d70be92f7d66d8a93
SHA512 c5d67217cada80c5eb06d1f6e674c402772069c437a1314e013554d6a016bf33b0656e88af331929590766bb08cc670a60af15db825533c240bf61ae3569dadb
SSDEEP 192:SONA6iDJQmiUyco2Xq5u88PMcPCJB+ohaFuZN/YcU6:SONA6+fXq5u8iMcaJB39+cU6
TLSH
T1C6123B35B8787C7B6DD3A861B48736039EA4426BE7886F84D9DC271C06EF59C5307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 99fb0cb3498dbff40d9e3bd6440697a4b38c96c8a9caa70fdf83e02bf7cfdc71
MD5 38a397d564956cc7dd120d6fac4ff130
SHA1 6b948477d1309e6aa1c820d52272176c2595ccef
SHA512 6000ac076a08454b279ae28faabe9ee3e3327b8c8330d20ab6eee9b5bc81e8b8a67941f568b5ff9d96fe6d2de004f76b1e2a265027f37cbc507f8272b124b8ad
SSDEEP 384:1ZcIhsNVyUyfbO2p5u8iMcaJB3Q+cBkwc0a3ou:Nh9jOkkd9fBkua3F
TLSH
T155928D726C746C7AA8E7A550B44A3B038EB8816BE7C85F84D9ECA71E01DF5D50307E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a361df3b0332a73fe0ef6c6ec8bfb74db8726e5a0852d81d34f42ad1fd54a555
MD5 2a09abcd3140bc9af8328f131162909f
SHA1 eb9746745076ca9e5c09061f77edc5d521cbe110
SHA512 19be9f4efc3d243435baa7b3000b14605bf8b2e1bde1602f5ae4cca823db9d4a57f33c4ec582e38d955278ccf11b5b03560ce973d650026d3cf9ea2ff4818a21
TLSH
T1D8E00205E2100065C158033100D31F106AE1C20082B216855770066C3C2B3416B31BC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fff9a242fb80f1c548a5dd3e37c2d4e0a3d39cb77ed401a4317a5208f770ecc9
MD5 c03a49b5cf7c62a7195f3ffa03f5a6c6
SHA1 be34862e728d776fd889440604acb1cadb6d8127
SHA512 8ffa7614ed16964ad19ea0b432754ff355fb7bdd3fa8ea4f5f09f4fa2f113a67adff82983362cc7fe051596a9deeb68dcd22c3f409712f9d926f767b6146b1d2
TLSH
T1BBE00201A2100049C150033100D31F2029E1811042321544576006682C2734127013C1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4bd530ab8b34183317eee958ca6af9897c1d6eba84a90014328581313bf347c6
MD5 408380a1fb22861525a6762630c705fd
SHA1 72c04e4cd69966c0bccd0e729434bd59d108dd11
SHA512 aa769d64318b8db3d8ac912f3953411bfafb3f23e3430ffa9848c1656be4c868b49629070380750410d6c63ae48498a2a4592d0b7c2079cf105592fbffb8f0ca
TLSH
T14FE00206F310406DC578033100D31F306FE2C21082B217875B70066C3C2B7416F31BC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe593445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593445.TMP
Size 392B
SHA256 0a1038ccdc2edd1b0217fea24b8fd08d8e266eaa85dda275abacda6ef5628d1e
MD5 4a0cf6411a86daf7e58adadddde26d90
SHA1 0e81bdefb39aa924e1ca3b691d54eec3eff89fc0
SHA512 a5f88d5ca2e3f3813475640be1664856fe248b1e33da3688db62755c5e516f90a1bad4953a4e4dc9e6cba56790281478e2e51ec580d68bfbdd716a506f0982bf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 20d4186e34c4f9f5a2fbd0c125cc5a492b5a7bd0693b5d84491f63f2baf45937
MD5 01952ea0fa5de26103ba1f244493f091
SHA1 07353e5e5d62f487b8d7d11b353219db992d27b6
SHA512 9de50948df8b20491c076d99f0efdde04ae0d10ec5b4683de2886c6432a34bed6a1d5ef0058b700cb44384c0652853e04f368b6e5b7ee37bbfacbcc3c435c483
TLSH
T1AB412C68A6F91058B3B77E569BF6A86D447EB9772F4AD05D00010D4F0A66B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download