hxxps://hl2-beta[.]ru/index[.]php?action=downloads;sa=view;down=355;language=english

Analysis

max time kernel
900s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hl2-beta.ru/index.php?action=downloads;sa=view;down=355;language=english
Sample260925-wax71aseqe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{542E2774-8870-4F94-B49C-E52F5AE10598}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1160	1384	msedge.exe	87
PID 1384 wrote to memory of 5084	1384	msedge.exe	88
PID 1384 wrote to memory of 2996	1384	msedge.exe	89
PID 1384 wrote to memory of 4556	1384	msedge.exe	90
PID 1384 wrote to memory of 5084	1384	msedge.exe	88
PID 1384 wrote to memory of 5084	1384	msedge.exe	88
PID 1384 wrote to memory of 4556	1384	msedge.exe	90
PID 1384 wrote to memory of 2508	1384	msedge.exe	91
PID 1384 wrote to memory of 2496	1384	msedge.exe	92
PID 1384 wrote to memory of 2508	1384	msedge.exe	91
PID 1384 wrote to memory of 2508	1384	msedge.exe	91
PID 1384 wrote to memory of 2496	1384	msedge.exe	92
PID 1384 wrote to memory of 2496	1384	msedge.exe	92
PID 1384 wrote to memory of 3476	1384	msedge.exe	94
PID 1384 wrote to memory of 3476	1384	msedge.exe	94
PID 1384 wrote to memory of 3476	1384	msedge.exe	94
PID 1384 wrote to memory of 3328	1384	msedge.exe	95
PID 1384 wrote to memory of 3328	1384	msedge.exe	95
PID 1384 wrote to memory of 3328	1384	msedge.exe	95
PID 1384 wrote to memory of 4312	1384	msedge.exe	98
PID 1384 wrote to memory of 4312	1384	msedge.exe	98
PID 1384 wrote to memory of 4312	1384	msedge.exe	98
PID 1384 wrote to memory of 2764	1384	msedge.exe	104
PID 1384 wrote to memory of 3580	1384	msedge.exe	105
PID 1384 wrote to memory of 2764	1384	msedge.exe	104
PID 1384 wrote to memory of 3580	1384	msedge.exe	105
PID 1384 wrote to memory of 3292	1384	msedge.exe	107
PID 1384 wrote to memory of 2932	1384	msedge.exe	117
PID 1384 wrote to memory of 1084	1384	msedge.exe	118
PID 1384 wrote to memory of 1472	1384	msedge.exe	119
PID 1384 wrote to memory of 2180	1384	msedge.exe	122
PID 1384 wrote to memory of 2180	1384	msedge.exe	122
PID 1384 wrote to memory of 1816	1384	msedge.exe	126
PID 1384 wrote to memory of 5088	1384	msedge.exe	127
PID 1384 wrote to memory of 5088	1384	msedge.exe	127
PID 1384 wrote to memory of 2468	1384	msedge.exe	128
PID 1384 wrote to memory of 2468	1384	msedge.exe	128
PID 1384 wrote to memory of 1176	1384	msedge.exe	129
PID 1384 wrote to memory of 1176	1384	msedge.exe	129
PID 1384 wrote to memory of 5112	1384	msedge.exe	130
PID 1384 wrote to memory of 5112	1384	msedge.exe	130
PID 1384 wrote to memory of 4852	1384	msedge.exe	131
PID 1384 wrote to memory of 4852	1384	msedge.exe	131
PID 1384 wrote to memory of 2080	1384	msedge.exe	139
PID 1384 wrote to memory of 2080	1384	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hl2-beta.ru/index.php?action=downloads;sa=view;down=355;language=english
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffb8ecdc188,0x7ffb8ecdc194,0x7ffb8ecdc1a0
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,1799422405362758043,13792216901132500503,262144 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,12487516761251771175,9019063487153247559,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,2025821002750574397,14837596489859593395,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11404478611046466579,5381529874532780958,2097152 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16942074242784798921,10477553924410093849,2097152 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,14570062312348629767,6138951522702549953,2097152 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11586075821156592101,6999406209292034867,2097152 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,5898997364528060295,10485053873163327344,2097152 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,8031922255139661848,9518836742301494683,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,7203921756516044434,5562583852491831280,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17993806516756845413,5235159906412820632,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17993806516756845413,5235159906412820632,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,15747769141630312311,11049829430862280204,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,2211475707830796270,18445039956320183850,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,862842615950585976,4204695037912310854,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,13561911439489063681,4875700696802484283,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6008,i,9061913278861236843,7218179543865852367,262144 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,13045216928960277859,12958611315787339590,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3004889175869922952,5020624613880824390,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,16424433417122235766,13553135390314650656,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,2362745466832133702,9974193984247702465,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,14641287731532936829,4715212905750939404,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,11565103785528629220,16079910993954706146,524288 --field-trial-handle=3044,i,6513478515866171386,5241431716917611678,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3106bbbc2fdbcb9afd0a1f9a8f8ed721328ea2f6402ca898725c0fd81cc347e2
MD5 325bb0efc7a9fab55d70cb4869d6cc9e
SHA1 4cb3dc8c6400c60dafe1e9f353221083bb2aec4e
SHA512 5566b74c2a23cdb337f8728c10c0333eab23a2bf9e2c6d5c17fcdecd61c4a6f1634f1a9644f428eb836400712cfe69c7fb50f1e9d08c59d71673558bbcf4bc7e
TLSH
T12FE0CD9905C9C26EB7047547426C6B4CD3D0770AE7CC6E5E371C9C857582544B2D3AD9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 589fade8e61b6f5ff1a62d5272b2a7f3f2940fdc8f1256d7798bae514e4b279b
MD5 95d2f48691d9a59826a514efaca50569
SHA1 4a4ae68969e3e09ca18ff5bfa7ebd0e6ebe41c13
SHA512 8fea28e6699cc0ba7078fe6699881efb6c351229f9e7908102bb74ec9114cc4bf91bb7fa4cfb59857d7c5df9559f5511b8d4f1cd0f3df683d2495c16c3fc349d
TLSH
T144E026C906C8C3BEA714A4C741BC6B2C83913B0AABCCBE1E570C8484B403840A6CB691
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 675b5fc1e30aaec171e1a00a21ef6ea84a775d723afb24af7bb150ee9a8e08ab
MD5 300bf9395a1525228f39d7214a1b2b96
SHA1 dc20ed6c88218750528fabb8aeaf8096b9d98713
SHA512 fd11123f9895181d3216ed62e98b6497a2dea0681de1381743bb7e28ae27f4748b7dc126560b1602f4b5d3c0e8ad6b3373e1f01d66e53dc8bac8e1ce61a59347
TLSH
T1B3511EA1CDEC8468FB9C59BFA9C77E973EF05A40294F1FC530D8E7B85B0A30181008A5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b4eddfc2bf6bee147d52234c400e860509955984245573ac9b1c5c17ebe48656
MD5 5447392fff974e7a1d88d190e29db155
SHA1 ccbba4a930fcfe1068f8390aa2a0292cf9bd6947
SHA512 86fb41c45f5df87a3e2aa0f7a4099348fcd16c0bb76012cfbe24964bce8dd6d2de0eb5531bc223192224c1b5965d5985525c328f7c9ed7c4d3282a7a289430a1
TLSH
T19A417BF783E4856E990256F4BB14AF2BCE1D051543183D29C9D8EF5BA3E2461E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8a581242e863b972fbdf777a524580a4c1224c3f566e6db9c0414c925716f43e
MD5 489a27ce6db9a09f10dab91644eb09ed
SHA1 3c4ba72ec01f707394e8273dbc26e37e94787344
SHA512 0301f3ca961dc39db6f777e2d402d9ec3f6542729f3500b747e1d7bf6806681300b2e368ec997e6cb1bd78d46b59fc261bbcfe5bc204878f6ec25652b1835897
TLSH
T10D4198F783A0856ED90296F4EB14AF2BCE1D0515832C397989D4AE17A3F3471E201B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8853a23eb5a42c28d621437721075141bd2ce0d5a97c19b9e193c363d7c304e1
MD5 6fbcf608805d9752116bb1d4a76a6892
SHA1 0c8267c4ca5245147c9281e69bcfe5e14dbdf430
SHA512 382e2e2f3b509ea9ee4fc514ea32361e5e62a9809c6269f3728f05065973f90d60980486109d224e094da5163cdbf2ebc1732b5971024567534b58cecadd0cf5
SSDEEP 192:sxZdbRiWUr/f04sHcXlMIdpBL2HW6+WNBQhW/YaprA5IgrJ:sxZB7q/f/s8fBCHbBr/u9
TLSH
T18022B91A6E38697B8CCBD20DBA55BF53E6F9143291941E48B6FC961C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6e2baf5a2a7110bf5bebe885be4bb9f3c4c0904a8b00272b2a674edc87484fc8
MD5 8c73e1e6944e5202ec22636a9aadc540
SHA1 bde3144373910ba3172a2f15dae048d697dd28a6
SHA512 6f0771a5bd7a435089dc5644aa8b7ce2ec8ddfb260a746d124de0cbd30716029f3ad6fca72a5bce87d9b5ad9c9f7e4062c40905df18bb86ba401d5a7a71fda5e
SSDEEP 192:sxZdbRiWUr/f04sndDTlMIdpbL2HW6+WNBQhW/YapgA5Ig5VJ:sxZB7q/f/sxLbCHbBr/FB
TLSH
T1B632B81A6E38697B8CCBD20DBA55BF63E6F9503351941E48A6FC861C04E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2d5679a31e7812ee50a22ab5a3192939ca08263d631b2b58f2dea3b9869e50bd
MD5 87f81f672cac142515b599786227bdf7
SHA1 5a89a091969fd319c6427a9baf931bf77e29dcfd
SHA512 6e94bb8131abac56077eb747fc43758bd749eca6f0ec87145b45ff2e364fd09200a92f3e117b253e8ae6860063a9d10d9f8cf54b84d3ce19cf5e99b2cbf02986
SSDEEP 192:sxZdbRiWUr/f04sndDTlMIdpBL2HW6+WNBQhW/Yap5A5Ig5VJ:sxZB7q/f/sxLBCHbBr/sB
TLSH
T1BE22A81A6E38697B8CCBD20DBA55BF53E6F9503351951E48A6FC861C04E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2bb7f929a00244aa73bc4842393cf6547c2e9d67d480bfd137ce1ea9c6e70b1e
MD5 4a672e5d1e76abf0fd525be2f59ae4cb
SHA1 df94cf44cc26a30f643dcef21dcd4271584a4cae
SHA512 e985473b2834ba74eb368b38f0ef824e9d5863e135d0021139ccc80f68cce080aca4892b87beb95601a2a91c1a36fa97959e62dba19b22a14a5871d0eab9aecf
SSDEEP 192:sxZdbRiWUr/f04sncTlMIdpBL2HW6+WNBQhW/YaprA5Ig5HJ:sxZB7q/f/scLBCHbBr/u/
TLSH
T1BB22A91A6E38A97B8CCBD20DBA55BF53E6F9143251941E48A6FC961C04E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 47178eb61bf4dc8252d9a7d12638f1af6dac72ce6e0417ffb7b0b3b72213723a
MD5 ea93543fae6519717b77ac9541b4efa6
SHA1 befef795f487e6dd28a8d44cf66e3e340d3d9e7e
SHA512 67c74a1effe5ae420e4ec49461e839b9afdf023ff6633727a7586368ca475c19ce628eb081ae7ade1c9363b4302febf9022284ceecd2561bfc2d5cba150999f7
SSDEEP 384:sxZB7q/f/sq66s8qMpRiYnazAW8pZS15posJWeT+mLbCHbBr/WB:sZ7q/fb4Mnc7WeT+miHbFS
TLSH
T165B208099924C83B9EC39D18643D7E33E9EC506222C5DEDE5AECCA1C019E1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 279a8bce039032a684278435efbc26baa63736b3643c097c760fdd1f9ad7142f
MD5 83dae3acbdf9e8745753dff6e36ba65d
SHA1 ed10cde0641a6f8b985d495a90c679fde6bffa85
SHA512 b5809a58b0efc01995600a9a9ee75e53fba2fb3eb59042e25a8b4e03ec0cecf1344e3b1a0bae3a650922f01935eba90cc1d5606e898977d4f3c7eead6d2cb89f
SSDEEP 768:oUWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7dro4zfermRO:oUWPcLKWvKeEeu1jaClLiF7W4zWrmRO
TLSH
T19FC2EA3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e55ce8fe-8efe-4696-8113-5d5320d6d7ba\index-dir\the-real-index
Size 120B
SHA256 fa525b7fe73d891fc9236acf882f7ec980d432ccfee9932783d138150445f8f6
MD5 a24517c925d318d43347a4499d0031c9
SHA1 f2eb015c88d3073c3bfc9cfc683827e433798c35
SHA512 e76da65e36e852c35ab084a7cedbe8749a0c5856813feb98818b428a281579b9ee7c999998a6debf5e256c8d4a676905ffb705675b9f95a49f47b298a96d088c
TLSH
T16AB012985D435980FC7141701ABA11611A1008FD5410430708ECC7458C120C44080104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d2f31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e55ce8fe-8efe-4696-8113-5d5320d6d7ba\index-dir\the-real-index~RFe5d2f31.TMP
Size 120B
SHA256 75860cad32857e567af7fe95a05c92a483ff730e3c6ad18c791fe3c471d9262f
MD5 c7e048d7b2a5b0607d7a59327f9bc87a
SHA1 6619309003161d9ac195b8a8334c9c3d10890302
SHA512 25e10ff6334b06620016245137ff156c45439e271b5f6f478aec8cd748e10ff6b06358fc9885eee5ab4d49c6a69cb314af1d3e83dde20414a4f1ac091ea5df80
TLSH
T117B012148F412D80FC1241B01CC3127115004C18A030135345FA83005D030E40104254
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 253fafd9ccaaf88e7ce423d6b92401fc5425baf18ac08c93e469b6d7b97ffc80
MD5 6a399e3689a761b51a8dd987bfbb1022
SHA1 a831db0e337885b90c5c2e3fceb04e0d60346733
SHA512 d22adab8327bff74dc3a84b5c42560fb7d6565a7ab2feeece492855e815bef3458780d63020d81640d5cdf83ebe125612538b76f590ab38c8ea305d0ed0a5960
TLSH
T1C4E020B22DD72830F96BC7D5247150A90043FD69C605AD8F645EE1D7A4A23012415C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 05510bfbe8e331ab819e8911d37be388ee3fa34441186a9b78c8c144f2fe1ecf
MD5 83507279ade69d482ac6ef36bc9793f8
SHA1 73f6f14ea43d1bce73157bf111919441e364f2b9
SHA512 c36ce9c7af463a62acc4950d68e292b9150a04894146d68a963ce257e8c2cdd960a3f8e90d01d66ffb51837d018be600b63dd8fed398242b6b818233c1200928
SSDEEP 96:KyFkBFnvvu1/21HluKfbHjuLtluzVvYtMpNv3H213+9HN2KfTHb2LltWrBCQK7aG:5FkBFnvvq/2VlFbHjmtluzVvYtMpNv3u
TLSH
T146A1211171BB1210397E2A4990E0876F425232B27159EE3F7FBC14A25E2EE694CFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

779b8dad-c896-41dd-97b8-21c3e4d72c7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\779b8dad-c896-41dd-97b8-21c3e4d72c7f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b0418385c1017d3412cd4ac8be1b560780dd4209304cf799d1609cc4b9a815b1
MD5 fce908c8d0b23cf0993476449843e377
SHA1 364811d02167ccd2c12bac5514dfdc7d2f6d705d
SHA512 5618394a499fb942e8dc2cde0199d1bcda7dcab83a656b41e26574eb867681fdbaccdba0db0e9379d2854a9970f96df826adc73aaa3ba2b8acd3ddfab696cc10
SSDEEP 384:rZcIhsNgTUz51IOVuzIGmS/IIC0iLtgOIwZOym6oK:zhmHy1gkiLXssl
TLSH
T130828D3A9CB8AC776DFBA544F9873A135E788167E2C86B90D4ED570D00EF258130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4df25c22d78de038c4410c1f86e064e11780e92d9cc874dcac7f0e0206d52b35
MD5 531996f8a4ed5fdfb98b6171715d534f
SHA1 a1d3386ca2a011f42ed592a6837dc2f0e2f1744d
SHA512 4dc0dfd2794f0cf5392c1c3ee2c44185c2dbdcaad56353637c22bf5cb61398a42040bdc8cde34d6e9041ca5658d7ae55d97d09230d47497ee1e634b33bf1aaae
SSDEEP 384:LTiFiZcI9zsNg8TUNTUlIlmUz51IPVuzIGmS/IIC1/iLtgOIwZOym6oK:6FQF5wgX+y1gl/iLXssl
TLSH
T1C7C22AF648E7987AEDAE5B43A77E2E034D7CC067B1849A50B7C8460DCC9617FD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f7ab7402c400b16fb728793c3d79e993e8e9b6601a28249a5e22d57003f292fc
MD5 5db81517ad6afcfaad34f7b8ac2970d4
SHA1 19933a08c0c1fd5b658c4ce10d4994f7c746657e
SHA512 bd81ce1494a8f443d09447eb6ab78fc7b1fd2655810a856e58884c32f8324df178ee1e016d66c5704b253ad40c98436bb71bee3cd4c0facb5ad14b4df1c974df
SSDEEP 384:kZcIhsNgmUz51IOVuzIGmS/IIC0iLtgOIwZOym6oK:ChJHy1gkiLXssl
TLSH
T199828D3A9C78AC776DFBA544F9873A135E788167E2C86F90D4ED570E00EB258130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62df914e496024e0f36bc8a69c74e194e2f3ffa6348f148222bd1ea2eb7de81e
MD5 24105d24341d0f4db3820ed573a395fe
SHA1 ea622125c9a687116da1a296bce2aeab6cafbe15
SHA512 3c250ceab51088cdc932fa0a88fce14c51b92abf29caa9e31d7a3602484b4456e51bf69bf98b7aa2f83cff427677d6898f7a96a5d2f56026759be300af86feaf
SSDEEP 96:3qONk2Qsjpfe/tyng7X5ih/cIPURHl8h4otop58YDGNBnP9ZvEI0IG2jbZ0rLYyn:aONC6IE7QmiUydGTPuIGmSrLRC7sU6U6
TLSH
T14602F939EC7C7CBB9EF3AD48F4873B236EA5112BA5952F84D9E85B1D00D724C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebdb4fb33624ca285e519ebd8603cb8ad3ae53c033ce05787a572094286f59e0
MD5 1596dcdd4509b4dda50b1fc29b19f1a8
SHA1 f91863e517a7421432ee48d7e6e6add4937306e3
SHA512 a1b7edfb9baa71ca8039aaa622ca727f973a5833eca7b8bff4b90b6bcb3cfff257ed29aa808a3da3987edff30695e79202b87692ba6ffb111bc3415a3df75a70
SSDEEP 192:aONh6IEhQmiUyLGTguIGmSrLIICR27HT/XU6:aONh6D/LguIGmS/IICeHLU6
TLSH
T134120A36AC78BC775EE3A944F4873A239DA59227E6887F90D5DC1A1C01EF25C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0a11602-f20a-4f6b-94ff-d726ef045c51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0a11602-f20a-4f6b-94ff-d726ef045c51.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 df72ca4ddb129b057b775da085cf7699e50b457737c5813ef62ac3b4b8b3e4aa
MD5 645eab5f2d0ba291fb38be38a201ee31
SHA1 07e371f584a1f1a3db3ac3bb5ed83649fed49356
SHA512 584b40f05fd4638c81ccdcf2e4a09252da6053923cc58d8af9ba3cf744a5e4725d37ab502bd84952d58e514e78ab956839862225ddf799ca52e6e3e330cfb051
TLSH
T182412B5CA6EA1148B3B77F49ABF668AD487B78772F0AD45D00110E4F0663A40D971B37
MD5 SHA1 SHA512 TLSH

Submit Download