hxxps://forms[.]visme[.]co/fv/zzkkq9z9-4egqzy

Resubmissions

25/09/2026, 17:23

260925-vx51pasbkh3

25/09/2026, 17:03

260925-vkx5ba1glb3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forms.visme.co/fv/zzkkq9z9-4egqzy
Sample260925-vx51pasbkh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{540D8108-346A-471C-87A5-B26C52826032}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 728	1876	msedge.exe	88
PID 1876 wrote to memory of 4188	1876	msedge.exe	89
PID 1876 wrote to memory of 1880	1876	msedge.exe	90
PID 1876 wrote to memory of 1880	1876	msedge.exe	90
PID 1876 wrote to memory of 1880	1876	msedge.exe	90
PID 1876 wrote to memory of 5028	1876	msedge.exe	91
PID 1876 wrote to memory of 5028	1876	msedge.exe	91
PID 1876 wrote to memory of 4888	1876	msedge.exe	92
PID 1876 wrote to memory of 4976	1876	msedge.exe	93
PID 1876 wrote to memory of 4888	1876	msedge.exe	92
PID 1876 wrote to memory of 4888	1876	msedge.exe	92
PID 1876 wrote to memory of 4976	1876	msedge.exe	93
PID 1876 wrote to memory of 4976	1876	msedge.exe	93
PID 1876 wrote to memory of 3536	1876	msedge.exe	95
PID 1876 wrote to memory of 3536	1876	msedge.exe	95
PID 1876 wrote to memory of 3536	1876	msedge.exe	95
PID 1876 wrote to memory of 4700	1876	msedge.exe	96
PID 1876 wrote to memory of 4700	1876	msedge.exe	96
PID 1876 wrote to memory of 4700	1876	msedge.exe	96
PID 1876 wrote to memory of 896	1876	msedge.exe	100
PID 1876 wrote to memory of 896	1876	msedge.exe	100
PID 1876 wrote to memory of 2608	1876	msedge.exe	101
PID 1876 wrote to memory of 2608	1876	msedge.exe	101
PID 1876 wrote to memory of 3128	1876	msedge.exe	103
PID 1876 wrote to memory of 2840	1876	msedge.exe	110
PID 1876 wrote to memory of 2840	1876	msedge.exe	110
PID 1876 wrote to memory of 2840	1876	msedge.exe	110
PID 1876 wrote to memory of 732	1876	msedge.exe	112
PID 1876 wrote to memory of 732	1876	msedge.exe	112
PID 1876 wrote to memory of 5036	1876	msedge.exe	113
PID 1876 wrote to memory of 5036	1876	msedge.exe	113
PID 1876 wrote to memory of 5036	1876	msedge.exe	113
PID 1876 wrote to memory of 1060	1876	msedge.exe	114
PID 1876 wrote to memory of 1060	1876	msedge.exe	114
PID 1876 wrote to memory of 5128	1876	msedge.exe	115
PID 1876 wrote to memory of 5128	1876	msedge.exe	115
PID 1876 wrote to memory of 5180	1876	msedge.exe	116
PID 1876 wrote to memory of 5180	1876	msedge.exe	116
PID 1876 wrote to memory of 5228	1876	msedge.exe	117
PID 1876 wrote to memory of 5228	1876	msedge.exe	117
PID 1876 wrote to memory of 5972	1876	msedge.exe	121
PID 1876 wrote to memory of 5980	1876	msedge.exe	122
PID 1876 wrote to memory of 5988	1876	msedge.exe	123
PID 1876 wrote to memory of 5908	1876	msedge.exe	132
PID 1876 wrote to memory of 5908	1876	msedge.exe	132
PID 1876 wrote to memory of 2584	1876	msedge.exe	136
PID 1876 wrote to memory of 2584	1876	msedge.exe	136
PID 1876 wrote to memory of 5560	1876	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.visme.co/fv/zzkkq9z9-4egqzy
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe280dc188,0x7ffe280dc194,0x7ffe280dc1a0
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,560228779006559922,7729865497580010854,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16409853157071533909,5455268805103576091,262144 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,1290171887922066483,13706696317151371329,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,10467662577960385582,2741440674516196453,2097152 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7473430518970932647,88696357257117052,2097152 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,221661300480923619,17843646805342367612,2097152 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6314643465917510551,17755196069073351259,2097152 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,941463521643801417,473150429042765411,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,7958323622919694147,13871595505174038784,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,12057081542918303441,17603292178055953773,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,12057081542918303441,17603292178055953773,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6272,i,7177446643966336855,4404044319510262935,2097152 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2776792839972051432,5067689110027926028,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6612,i,2393182314982707815,1650508697129586969,2097152 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,11826126690026010399,726872283718259169,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,2267281487227285024,9557567340898390136,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,4204437347394905284,16169538394522672293,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,15164361678805910938,10235458986558539157,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,4799303433073352116,13863446363188011595,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,12193519619903283267,1263639031745018532,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,8248764241297746928,15513758157596439293,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,6657181211334095889,17557666594391778921,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4883094878286584901,4892525782597323527,524288 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,16172382878928591413,612026855960129499,262144 --field-trial-handle=3020,i,10477541858361019701,3835462357130448050,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b96cd1145dfc18b4c84ab20837be902380321ef260b69bd1fa7d0d9ee7c7436d
MD5 c17e4be7ed050d257fc35be017bd323a
SHA1 e7f271fca09210d3636f417f670e5cec5960ef6d
SHA512 de9bb353657869091fc60e794358c9d33536e1238cddb527a9c3b80c1336dd6bd926070f3eb2127a12f8b523841d1bca6b7f3c1423192d39826319104c26b7e0
TLSH
T1F661A563F1D08015F7E839B897E52693313CDAC1DB83DF921158D83DB84EB946A350E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\_metadata\verified_contents.json
Size 2KB
SHA256 6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822
MD5 c7182c4ef7a2cd6a57e48d44bfd4af9b
SHA1 2e1e4746da948d83baf4bcebee618784f8ab209c
SHA512 d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83
TLSH
T1BA419322CCA5BC1F293173704EB90662AB0595AB2081295A70FC099D3FF15666436EBD
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\filelist.txt
Size 134B
SHA256 543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b
MD5 3bf6b4eae5af15288bf0d79702f9cb78
SHA1 b8a052dc4973757ae865661ea0300dea1d27f3b6
SHA512 25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c
TLSH
T1C9C04C206C0494B7810CEF55C5F9FD34940616007E33DC8913584270101B68E8DB5324
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\LICENSE.md
Size 9KB
SHA256 4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63
MD5 e57b8dbca804bf4a2db759fa1a70b3cc
SHA1 8acc131b3698964249b08a0178f7c8c467337048
SHA512 d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627
SSDEEP 192:agW/NVo4UTo1YE+FNzFE6GGfGb2y1CVzho1oHqxQJbbLwY:a7hUk1+bXU4qbQ9l
TLSH
T18E12427F7748137B0AC30172B78BA4DBF32E903C3B9556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babylon.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\babylon.js
Size 1.2MB
SHA256 b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d
MD5 e1adfd8f62854c2d9ce65f13268c1ac1
SHA1 d564ea1d59305bbec12995ee43f1c28838e82519
SHA512 ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa
SSDEEP 6144:j7WIrpHJ1yA3d0xEWv/v/82mXgBYdnU7yTGpjGp8MTYgANTJCpzesRGvJaGpLsXW:vC/ErriNqfGp0KV
TLSH
T175450999B3217926478390A5143F090BA33B68DE940540BCF299D8DFACFD149667BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\typescript\typescript.js
Size 10.4MB
SHA256 986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959
MD5 d931cf27eb964f239e5bec661810abf5
SHA1 1616508213014fa7cdb50e691cf737169019c6ed
SHA512 9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6
SSDEEP 49152:noUsnsTsUGJR5dZjSB1FBUWx3pZzoYzuQRlbVbOFeWSeoMTNKtsL4IMltR6SMF9K:BTsUqRIb3nYz1q3X
TLSH
T1D3B6E6BE79E330B16A5B2136672F8001B735D257220CD8907E9CC3A95F1587462EBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 45d786548e86a989b4417f452ff1c7e398f33730d512b2f02521e207a1226f00
MD5 e73f58d4acddd47e662872ae4b45d6f6
SHA1 19bdc012cedb68dea0db49ee55bcc3daad14b56f
SHA512 f7051e54eaf8faf376a8187221d272c2c17d865c73eb724b7c6741a456f06f18e8d63a555f42235fdac047e2db6b90240e823011a275f7327adfd72678818bcc
TLSH
T1BF71BCB7C3B4866EC91192F49A186E2FCE5C0512871C7C69C5E4AF57A3F2870E281A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 589d23f6d9876ecb69c710bf7b5dc4f3795461f24badf12b4698ab90b2ef7451
MD5 1e452a45c2480b191eec62efbc151666
SHA1 2f472ff3d94ad81aab1f9ad5153fb78a744c3a00
SHA512 769ce069e9f7539e359b937e92633795555e2faa97e3d5debaa4c2b0e2994d9a36a60a08da12f34d30a7603cea6f1d3a2b41f5eb54ac3b02d101604a7609594f
SSDEEP 192:sxZQR8W6/fc4zSs0rIdpJluHW6+WNTo+8/Y3hH8IgrJ:sxZQd6/fes00KHbQ/z9
TLSH
T1F532D91A6D2469778CCBD21DBA257F63E6FD443351D41E58AAFC861C04F6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 30d50981e1e826ed305c47c548383b2bee6d0ee4be51c3fc03c5f996352f8113
MD5 1323b7d9caf708e7bcff7e334914f17a
SHA1 ae654eec0c1650928b7653e7d01004e61ad5f561
SHA512 f8f491185c27c53258d57c70f8f48fa719884da7791bdecd899119e22b28e4ec83631372a6aac3cc94b80f492417d74a6010eb8938b3ce59fc2aa0bcc82d5297
SSDEEP 192:sxZQR8W6/fcNkI0gSsZrIdpJluHW6+WNTmbXY33H8Ig56HJ:sxZQd6/fNsZ0KHbaXbAp
TLSH
T1D242D81A692869778CCBD21DBA657F63E6FD443352D01E58AAFC871C04F6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 80a96aa2ccb46b806c89322a8f3ba00d5bcc89732d09a96d815fedc5451056c4
MD5 99ffd25ef398f707d9086221aaa5e416
SHA1 eaac6af7d3c6efe83cfd07eb71398d8cdee55eee
SHA512 be4110fc9cba8f36414cf996bf8491d19c9c185492ce39725ef47eb69b734aac60a67391838c675969fbc455cf9b052783b4109a74ce44430194b82b593fc702
SSDEEP 192:sxZQR8W6/fcNkIMgSswrIdpJluHW6+WNTmbXY3MH8Ig56tJ:sxZQd6/f7sw0KHbaXoA3
TLSH
T17732E91A6D2869778CCBD21DAA247F63E6FD443252D01E5CAAFC871C04F6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a2a8bc7bcd3e86e1660daed71671505b0b93b59bd40373b224b41209626fabfd
MD5 01a78be6d07c11e0a509190f0bc34a16
SHA1 27753d567d03ecaf393d439b0354ebe8dcc70644
SHA512 5462adb150339cfefcc106777af81b78ac536c18ec8f487a058477891b1cfc63dd7c756003687a82ac66d2654ba74ce7c221892f594414c2551f0913c5a52196
SSDEEP 768:LyfH30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGrmLlLJ72UrolZMAmm:LyfH30AbSWvS2l9u1jalrmLZ12/6m
TLSH
T1F1D2FA3F644CCB7E4FC01A9DDC66AF9B6E9802C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fd5c496ba623a29dddcd095b364a2ee987c399e8271b94e4a1a671d25170278f
MD5 d0e9ce522489fb2033d181e5e9f2b5d9
SHA1 199b1df056c96217632ffd5637dad7979277438a
SHA512 ec1fee9ee591abcf51827d26ac3b451620ed1859b4d8aac6db35f7343142391896c1b0bb816d21c22a288d397bf28eb8fb0942b1543403a6fef3a3a7263ff919
SSDEEP 768:Ll30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72UrolZMPmP:Ll30AbSWvS2l9u1jaLmLZ12/bP
TLSH
T1F0C2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796644D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2d7f6101a9dfef9a740c35bdb53c3f67b146dc49b14c99ba9d140afc185834de
MD5 ad12138c7922680b4a515655461b5ab8
SHA1 f230f4679cc4faa09e59cd9d50432f280c24d2aa
SHA512 a62c92176af1ce0c41ef5ce040eea871a175bfa8d3963c79abd3ac3e3136e83eb25ef9166720d58754cbe2f1bb035731a07c1316398f32111bf728fb1c2d2444
SSDEEP 96:Kh4rk4iqqOI6FViYOK67i+OmAYdOIPPZY/DRT/zIveCiLzK6qitzmJhW3aKQKHqK:AdXszr
TLSH
T1D691008631B702103D7D294D81F0A66A126131B33058FB7BBBED15A65E2BE281DFF5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a917.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a917.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2101ae0ebb5358f48fa3809c279d2c89d6645b85803831e77a1279e306d381bb
MD5 69418a80b56dfb889bf143700f91a30c
SHA1 f751de8aee1bd197b00243d060291da801df9e68
SHA512 9e4096553eb457c90e48d2a41cabbd8aa37ff40cc37b797d6a784883ebbca5fb0b82ef465c0285ca4edf0d26c44678c9463b344196948b39e352a1acca7504be
SSDEEP 384:2ZcIhsNNtQqMupumC+9iX5F+JOJOtgOIwZOye8uo2:khvluMqaiJmOXs/1
TLSH
T1A3829D3698B89D3B9CE7D550F54B36035FB8807BD6D96F40D9FC6B1D06EA598030B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1e12cae217190bc8374680b229db394af5cff2acd0b5fca01bbcb955096e3f4e
MD5 9bf93f2571cc140e5bddf9ce28fddff0
SHA1 1c2edb87fff5402a9a8c1ddc905940d95e9e67e6
SHA512 b970dfca1029862c90a9148c71dfd2309457388abc5cca0bf107df1347c996b1ecbd8d28a806052c32004cb6b955f2917bc54b209483af9db6071e036c63077b
SSDEEP 384:3iFiZcIuzsNX8TUNTUlIlsQqMupumA+9iX5F+JO0OtgOIwZOye8uo2:yFQu6wg1luKqaiJpOXs/1
TLSH
T169C23AF688E7893AD9AE8B43B77D2D035E7CC067F5949A40B7985A1CCD960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 119efae62014d3af5bc384b258d83857abecd8bfbf4a14a70dc9fb4b02b581dc
MD5 7140e7796b195257137360a120faa824
SHA1 a95883da5a2735a9da0c1ab44a24eca7e84cd07e
SHA512 7aefd67053531a88009a5e772cc1f447adf1efdd724202a3d296b6d21dfd288fd75465fbc81a957b180832160db17285a97ada25b76fc8e9c5be87fe48eb1909
SSDEEP 192:LONQ6AmwpZQmiUyJI6siX5FbyhjkzEe+f1lRl/4U6:LONQ6ip3/6siX5F+JO+OU6
TLSH
T128121B35E8786C3B4D93D964F04735135EA4413BDB986F40D9EC2B2C06EB59C530B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63af55969a3000838aef818172477d3b6be7d20534ae96caace2fff98d57b1de
MD5 c54bba6be1baa58c6cdb9a3b5ca5b499
SHA1 9d96759a7e19925a15592ad7b2256d76f2cc46be
SHA512 0df02e1d9bc28f3bbb44fe02ce0e16feefc2dd9f01347d6664c46fc9854ab591891d8c7050a77d9e50f55a2f509d23f86f8f5c30bfad82340a3dafcb5e21871a
SSDEEP 192:LON96AmwprQmiUyhI6siX5FbyhjkQJiturU6:LON96ipdl6siX5F+JwyU6
TLSH
T19F02EA39EC786C7B8EF39E15B58736136FA9117BDA946F44CAE81B2C01D764C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c98c6713cf4512fbbbea7965dcb8f9b48cd159d98f3e6fab6da9bccd7ded7d6
MD5 cfa6ba423c6fbf09c4b141b7e60499ee
SHA1 06d386f14e433292a11e95a0fe5b93e64f736a6c
SHA512 d32df386b974abe9f2a8defaa8647f7aa0c8a1bb04b55966f84766fd287a18514f76f58e85f6e248a2b23a78993540c2b58e42dd21fd39dcb0b75cab265bac88
SSDEEP 384:SZcIhsNNsQqMupumC+9iX5F+JOJOtgOIwZOye8uo2:ghUluMqaiJmOXs/1
TLSH
T11B829D3698B89D3B9CE7D550F5473603AFB8807BD6D86F40D9FC6B1D06EA598030B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6e0f106-5846-47c3-9b09-ef89ea9dcaf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6e0f106-5846-47c3-9b09-ef89ea9dcaf9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dce9c064dc2c79b5f96fb5e5373dd7cf15ac0a72cab0d6108fddb31460d07cab
MD5 315a1a567fcea72ec05181eae1007ad0
SHA1 3354d8d018cc9d6d0613c1d593baa0e2339f6597
SHA512 dce66b23719a2dc0e9f55c79f5de686fe4fe6a30bd9e4fabf63be24469cd4e9b2eee47aa95046b8edba8036a155ca238ac838100a3d5d6588fd293b9bc448bd9
TLSH
T1D741F658A6FD1148B3B76E56ABF6A82D487F79372F0AD45E10010E4F4A66F40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

507ae75a-4dcf-4f87-bd18-57cb1856261c.tmp

Path C:\Users\Admin\AppData\Local\Temp\507ae75a-4dcf-4f87-bd18-57cb1856261c.tmp
Size 2.1MB
SHA256 efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07
MD5 4cd67032e35fa92f5182df10df289906
SHA1 9210bfc66bd808ffcd7c6443e160dc8d6754c416
SHA512 f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd
SSDEEP 49152:ykR5Xz/3zNOm3NOHF4+n/UlfmCSJdm8IKXmiQeujzX:DVEkNOHJQOtICGb
TLSH
T166A533BB93AD6C15F3A88C67DCDD498641C2798E6161B7F619837C282ADC07CB47CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76517ab6-bebe-483a-9457-d9966cd7fbd8.tmp

Path C:\Users\Admin\AppData\Local\Temp\76517ab6-bebe-483a-9457-d9966cd7fbd8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

67f4a665-2dc8-4c65-b669-28c7512f1973.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1876_1352551226\67f4a665-2dc8-4c65-b669-28c7512f1973.tmp
Size 3.0MB
SHA256 2d69203739eca77886457d27c0df44eca47da02810061a7f5e15288c2e643f23
MD5 06f47f5ad37fb94be87982adc116d012
SHA1 4899ca7b1be75f8607b00b59b8469c8072f514ef
SHA512 b9ccbc3f2c45eaefcc4e157fb19eafd10eb54465f514ad16ada25e81390c3d577fa52aa6fc03461de6726694cdfda15ea96c5420609ac7a426e7b5afa43cab46
SSDEEP 49152:nqSGYpZHVTcorMCTt7OQvYilFbQ0NyNLvTAIPvWcfbcFlTfTGquf:n5pXTcoYCTYQAybMg7cfbcFPc
TLSH
T159E53395F69FF0F4D9A5F3317F8C765F16AAD387A30091D84283204A7BA9E210A5DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1876_832047650\CRX_INSTALL\manifest.json
Size 658B
SHA256 fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430
MD5 2cf796650e5ad5bfb6c4a421d81734be
SHA1 79298d3cdd584b290d825d6fff4b857012e71992
SHA512 1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33
TLSH
T17A01233A268140F238347640087155A4F176620B9100F8053835E36EC460BFDBD79A6D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1876_832047650\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download