hxxp://www[.]corranhouseoban[.]co[.]uk/

Analysis

user interaction
yes
max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.corranhouseoban.co.uk/
Sample260925-pycsmsyt4r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348138399203031"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{9FC4CEA8-84B6-4293-A30A-813958AAA069}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3880	3064	msedge.exe	86
PID 3064 wrote to memory of 4872	3064	msedge.exe	88
PID 3064 wrote to memory of 3132	3064	msedge.exe	89
PID 3064 wrote to memory of 3788	3064	msedge.exe	90
PID 3064 wrote to memory of 3132	3064	msedge.exe	89
PID 3064 wrote to memory of 3132	3064	msedge.exe	89
PID 3064 wrote to memory of 3788	3064	msedge.exe	90
PID 3064 wrote to memory of 4772	3064	msedge.exe	91
PID 3064 wrote to memory of 3240	3064	msedge.exe	92
PID 3064 wrote to memory of 4772	3064	msedge.exe	91
PID 3064 wrote to memory of 4772	3064	msedge.exe	91
PID 3064 wrote to memory of 3240	3064	msedge.exe	92
PID 3064 wrote to memory of 3240	3064	msedge.exe	92
PID 3064 wrote to memory of 5064	3064	msedge.exe	93
PID 3064 wrote to memory of 1324	3064	msedge.exe	94
PID 3064 wrote to memory of 5064	3064	msedge.exe	93
PID 3064 wrote to memory of 5064	3064	msedge.exe	93
PID 3064 wrote to memory of 1324	3064	msedge.exe	94
PID 3064 wrote to memory of 1324	3064	msedge.exe	94
PID 3064 wrote to memory of 2940	3064	msedge.exe	103
PID 3064 wrote to memory of 4536	3064	msedge.exe	104
PID 3064 wrote to memory of 2940	3064	msedge.exe	103
PID 3064 wrote to memory of 4536	3064	msedge.exe	104
PID 3064 wrote to memory of 4064	3064	msedge.exe	107
PID 3064 wrote to memory of 2488	3064	msedge.exe	110
PID 3064 wrote to memory of 2488	3064	msedge.exe	110
PID 3064 wrote to memory of 2488	3064	msedge.exe	110
PID 3064 wrote to memory of 3416	3064	msedge.exe	111
PID 3064 wrote to memory of 3416	3064	msedge.exe	111
PID 3064 wrote to memory of 3416	3064	msedge.exe	111
PID 3064 wrote to memory of 4936	3064	msedge.exe	114
PID 3064 wrote to memory of 4936	3064	msedge.exe	114
PID 3064 wrote to memory of 4936	3064	msedge.exe	114
PID 3064 wrote to memory of 2404	3064	msedge.exe	116
PID 3064 wrote to memory of 4644	3064	msedge.exe	117
PID 3064 wrote to memory of 4336	3064	msedge.exe	118
PID 3064 wrote to memory of 1772	3064	msedge.exe	120
PID 3064 wrote to memory of 1772	3064	msedge.exe	120
PID 3064 wrote to memory of 2224	3064	msedge.exe	127
PID 3064 wrote to memory of 2224	3064	msedge.exe	127
PID 3064 wrote to memory of 2224	3064	msedge.exe	127
PID 3064 wrote to memory of 4536	3064	msedge.exe	128
PID 3064 wrote to memory of 4536	3064	msedge.exe	128
PID 3064 wrote to memory of 2680	3064	msedge.exe	131
PID 3064 wrote to memory of 2680	3064	msedge.exe	131
PID 3064 wrote to memory of 2596	3064	msedge.exe	133
PID 3064 wrote to memory of 2596	3064	msedge.exe	133
PID 3064 wrote to memory of 2596	3064	msedge.exe	133
PID 3064 wrote to memory of 3452	3064	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.corranhouseoban.co.uk/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe964c188,0x7ffbe964c194,0x7ffbe964c1a0
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,15736795264328269827,16044365991220976139,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,4751819375419240624,15075523241301332674,262144 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,10253704980008740278,14655047071125537066,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,442081759480628513,11204184875195409153,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,9666930624245158194,13804528920188570498,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,15145545529094296839,558303675570357448,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,13028012072198770790,8519072958804963401,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11942496168427636013,3734971494212681755,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11427292987653815195,1233722011830700820,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,718353667055124320,4708204581833211587,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,718353667055124320,4708204581833211587,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6200,i,4414409332004748433,16328222111522048123,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3512,i,12045919421305126718,14694804422426320321,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4228,i,10943914963834966011,11896900920320486289,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,3223017461642646127,15566691541903577855,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13426086236319822905,6371083646299014212,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,12968253999088585707,12825886818910719110,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10466652351214848508,5601530620435665129,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4956,i,10482163518407020495,11271098595595424207,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,11952362811692205859,4134627046107959079,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4909555781583191532,9613665637807300476,524288 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2160,i,17987018517447340161,12495161165910956501,2097152 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,17672602770629648237,17184154595791600471,262144 --field-trial-handle=3000,i,3366841863954369981,14291605369820853036,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c325953-219f-454e-8bb8-a1f6c0c02917.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c325953-219f-454e-8bb8-a1f6c0c02917.tmp
Size 8KB
SHA256 73e106cf7e41dc7e9d99b8aa5b750bac07c00aad0dcd86415da02f0f2c63bd5f
MD5 404d75cb9d20ea773a050b05bdca1f6f
SHA1 8b6bd9b8af12f05828a2c426f7e0319cefea8c31
SHA512 f4d55ac701bbaf9906a3caae7e79cb1b7c01cc19ef3784f6e0adf94e42b781d19e15d7dc8e6320411654e390f4c99963dde0ff918cae3a23c6544a17ed11dba9
SSDEEP 192:aONk6IEdQmiUy31TjuIGmF0Lk90FXD27HI/TU6:aONk6DbOjuIGmFAk9wXwHSU6
TLSH
T1BC120A35EC78BC775EE3A544F4873A235DA54267DA887F80D5DC1A1D01EF25C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 be8ff30fdd9e08b7fc4967a28e6bf72261d936c41cfb588b4bf8d600505f2daa
MD5 6894695b61cf8eabf33ce493627336fa
SHA1 7fe6ec9ecc33391d76b02be1a796adf321b7b71b
SHA512 790bf886992436f2685cb010c1c663617e2989fed58bc30f56eed3223e4bdd0f89b40eca7feca1229688c7d474256179af727590cedb25b3198f6a7741c1e593
TLSH
T11DE086985ED9C2AEA718684B81AEAB6CC3D43B4BD7CC6E4E1704C4897181588A3D2692
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 628deb4ed08cbd4db758cf3d90a355dbff7fb80080508ca7e3019599b09f67d0
MD5 09b39df7d49b1e7f619da979e424d32b
SHA1 14342b7d79000eba171631fbad368e511011c677
SHA512 ac36196835f0ada504c501c80c3e24ad13ed9cc71ce7d46bcb475b242fcecd0ffb629dee66024e85efbc70dce338b23012f83ff8947250b48e060de272ebaaa2
TLSH
T12451518016A25370FF64F87E99E4136F3B38D481D3CB6E5A08A6DCBC7BCA39E9102044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58de55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58de55.TMP
Size 2KB
SHA256 33b0d7d4d5a9817949f5873986fa556bc7a969c436173d5706eafec4a7c4a36e
MD5 e65c65054e729c6f62a3442ea916c653
SHA1 3e6b6ea31110e8ce40d9cc6f7b4998464db290f6
SHA512 6d8a6df28973dc056d54f95339d00c67db3c2cc8d72a8247ef71c6117d42a7077ea142e775b989c620949ebba134517aa2647ebb586219d2281ed3c2f91a1648
TLSH
T1FC51538016925370FF64F87D99E5136F3B38D481D3CB6E5A08A5DCBC7BCA39E9102044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 cd63aa90b6a9c03b43c2b07fa6d3995a78177b1a6e722594f1a7704c0424c875
MD5 519608595e3abdd5d756a7393ec50797
SHA1 d392b0f1eb94bffaf175ba54e8a26b88ba2eaea8
SHA512 926a452d5e568cf05e1dabfc2087146d00f00ed7d3323a1b6c75c8f0e402308a7e1caeb5ba29b3f4593c3855171b6175b4d5b2a2ceb478e538a2b2a162f95be4
TLSH
T14F115BB3C3D5856E8A1116F06A28AE2BCE2D0605831C7C1989D4EF6793E3465E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 778d9f462e562e0f09c9a95827e3cac4d15a15cf7fdc6a56b7c37cb089ef39e8
MD5 58b73414ddc54451c0a4ecb8a27b7e88
SHA1 76014482c63186eb0d2d80fecfd6bd19b157e7d3
SHA512 62d6149e2a70351303c1642c06087e9b29af860b1a568f1cf93c2fda01cf224b6dfa496ea2e1a4dd02888376a53e6e345cdfae53f5b2c4c34684b4817ef5322d
SSDEEP 192:sxZYgR5PWWe/f2DsWIb9IdpD+HiV6+WNGYapYmlIgrJ:sxZYguWe/f2DsWs+6HTGp9
TLSH
T11A22A6166E28A57B8CCBD21DBB65BF13D6F9503291D11E58FAFC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6d40536dd9de339f8d283d492097ef4642bb51d928a266169959ec7e4f6b45ec
MD5 4ef688fc6d8efc0b9f594e37a9aace07
SHA1 b082a07a5fec9e5788ef8793a799a05d4d680d2d
SHA512 432821b0ed37e2cf9fcb9e29540bf4b82d6ec165492903caad958203f35887ab6bf367fbe6393d4bb2d98c0864b8c61861dc33ec04476366793c37d7f09f9d25
SSDEEP 192:sxZYgR5PWWe/f2Ds1Ib9Idpd+HiiQ6+WNGYappmlIg5hJ:sxZYguWe/f2Ds1s+MHfGQR
TLSH
T14422B7566E28697B8CCBE31DBB55BF13E6F9503251901E48FAFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 bce74061f48f2ef8055c433cc9f190f21553152bf4a856e78cdc510b0595b924
MD5 ede400e42907e4a6f59e2a3884396805
SHA1 4256b79b68d7cd14b0a73b3342fb44f2a8ce30d3
SHA512 da080f099e5eaf495770d3e2e72dea094044c0a49f6d45f4e15785bc9738e59e798f3c24649ae7f0125cc2aa9a668b4d9e859c491b7bb6d5a107def2d5979b6e
SSDEEP 192:sxZYgR5PWWe/f2Ds0Ib9IdpD+HiN6+WNGYapYmlIg5TJ:sxZYguWe/f2Ds0s+6HbGpP
TLSH
T12822B5166E28A97B8CCBD31DBB65BF13D6F9503291D01E58FAFC961C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ca01e2ba7db1c2c59f366157b6762deb10e8b6965b4a315d50c1e5eb24fabc82
MD5 575b8f3705c70fa513f31ea59be2afcc
SHA1 24a479fedb9688815843a021ce720771520f1100
SHA512 f13daae83a4edbae5a50230904cb0c4c5befd2ecf407dae8676344e6804e1233b0e1c5a337b06e3ab48be2a52e244795708206c451355effd22843d7e918322f
SSDEEP 192:sxZYgR5PWWe/f2Ds1Ib9IdpD+HiN6+WNGYap0mlIg5hJ:sxZYguWe/f2Ds1s+6HbGRR
TLSH
T11322B7166E28A97B8CCBE31DBB55BF13E6F9503251911E58FAFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b9db8ea0fcf1967c609820e46c58531a5326d4ac296f7af7c09d1d308db0a5dd
MD5 0d6f8b24cf879d4b587f9c76ea1e5fd6
SHA1 585a2b70399e0ed17630e9cfdf52112fcc0782f7
SHA512 08774e0224aa961cfba854abea10dba3292bc9cecdba3cfc59aea85b6fa0b1963f556e9a984db6f87f043028cb8a158890f9276f00139e6f37707a10e942fc93
SSDEEP 768:3RWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Uro4dfeMmRp:3RWPcLKWvKeEeu1jaClLiF7/4dWMmRp
TLSH
T191C2E92B640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b45e2670be3e027ec76493e9f219360a83c89de080aa0f8cffbc4de2a95baba9
MD5 eaede359bc4ece1d434951812e865495
SHA1 828251b74e60269d7578e065cdcf1da5f3cd624a
SHA512 db80ab1dfd276837bef638157ef0df8280b6104276465d14d89574e84f2e335cb4e5a9891c21f75cd4dd71df108d500ddb93e61db8c7411cbe2e8fb7aa0d67a2
SSDEEP 48:KMIIbKZa0fyFPIlKoEYLk/YU+aWkmahPIhMkKAB42k800PB+05yj5+9pb3jkz3Q6:KMIAKZa+2PSKoEjt+K+AqK6y
TLSH
T1DBA1E00132BA024238BE691981B58B2E529135737516F62F3FFD44A65E6BF180CFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597a08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597a08.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 620f0c99a35fe680f3d33b0ef537b15e795e63121363770240752281ac84450d
MD5 70a8e6c83a1a0fa6c3947967ef9e8fef
SHA1 42a02c0d45957a8b94f6d1e69fed98aeffa721c3
SHA512 5c9984feaa626f99ec81c1edb0d9ffd0d93ef516e7604f6ffedba59a9ebefbffcc96b01b47d267f74bb4d0826607220d7e6d87ffbdbb7fe1e3dc9c52df2e8633
SSDEEP 384:6qZcIhsNRyHW6/1nOEouzIGmFAk9wXAiStgOIwZOyFioS1:6Ih1WAXdCTAAiSXsF/1
TLSH
T131826D769CB86C7769F7A244F5873B135EB88067D6C86B80D4EC5B1E01EB658030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 876d14d91c21e50f4503f13534977ee38a4b5c0045537f88bb81e41d0c0d5990
MD5 79cd1921399bb47a6f7a5e1c348e77b5
SHA1 b04d65d2da4bc20af98ea73c23294b19d4e945c2
SHA512 f51f669a7fabe182e0574bfc55cd4aac1525364a258272d84c41e81cc4eaa417ffb9ec92b5a65436cbbd53aa8bcc3eace065e9cdfd5655cea569858b177bc50f
SSDEEP 384:VpiFiZcIQzsNj8TUNTUlIldHW6/1nOEouzIGmFAk9wXbBiStgOIwZOyFioS1:VAFQMewgHWAXdCTAbBiSXsF/1
TLSH
T12BA27D778CA8997BADFB9B44F58A37139EB840A7D5C4AB90E6DC5B1D00DB19C030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd2340918948327254635ec2baaea2ec7df3009931c74b724d0ad1cd7c0f8411
MD5 14f6ebef577ae138adbc12c42072ff26
SHA1 c7e5a46ba7e870b96c18c771da0654af2ab2451c
SHA512 e58fcbf8dd904c4b25bdf184371599ed9e9dd96d7f0f054fc726ff58fdc9a6fe6e1e02294bde8b89a5f9bfa5e9c6deb000701456968232f188a3111ea07a65ac
SSDEEP 96:3qONkgQsjpfe/tyng7X5ih/cIPURHl8h4otop5zYD1NBnP9ZvEI0IG2jbg00Lx6M:aONI6IE7QmiUy61TPuIGmF0LVC7sJbU6
TLSH
T14002E839EC7C7CBB9EF3AD48F4872B236EA5112BA5952F84D9E81B1D00D725C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8508b104f6b92ca5ce856ffd8a3dad31e69926281e319a2e95d4a5237015bbcf
MD5 c647d9605aec89b732ba3c4c47b9ab40
SHA1 d314c1f82588acf20b4a32e0f18fde301ce6b3e1
SHA512 6a3430b3854f9edbdb91ea18e48d1b59f1912ab3535141ed77f91917f2e931a0533260147b38f7d0021c3fa2547e7f606b6486eff4204386a1f8512f41c9d419
SSDEEP 384:NqZcIhsNRdHW6/1nOEouzIGmFAk9wXAiStgOIwZOyFioS1:NIhWWAXdCTAAiSXsF/1
TLSH
T19B827D769CB86C7769F7E244F5873B135EB88067D6C86B8094EC9B1E01EB658030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b78ac277-4e4b-4359-be18-3ec4081b04b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b78ac277-4e4b-4359-be18-3ec4081b04b9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 391acf99f94a0444b5ca9418630d799c58cfe1850fcf32dafb096515b23814c1
MD5 23fec02e5484b38175826525d7396ddd
SHA1 4fbf8035d82b637594e7c423df35a171d09be2e4
SHA512 3aca7f03bc2fe0f7f12a97063acafc999f0bbc5ad59c7a13cf243d0498707f78a3fe214c6ca6d09a043da001b098d7b8e29b4ec6cb194c228a7850e365339e47
TLSH
T1EF412A58A6EA1148B3B77E5A9BF6646D487BBC373F0B945D00110E4E0A63B40C971B77
MD5 SHA1 SHA512 TLSH

Submit Download