hxxps://fab-package[.]zip/

Analysis

user interaction
yes
max time kernel
898s
max time network
729s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/09/2026, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fab-package.zip/
Sample260928-y7bflsshkh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2100	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{22EF2AF6-B8BA-444E-9399-D0A4CF8952FE}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1724	3812	msedge.exe	81
PID 3812 wrote to memory of 1756	3812	msedge.exe	83
PID 3812 wrote to memory of 2100	3812	msedge.exe	84
PID 3812 wrote to memory of 1756	3812	msedge.exe	83
PID 3812 wrote to memory of 1756	3812	msedge.exe	83
PID 3812 wrote to memory of 3528	3812	msedge.exe	85
PID 3812 wrote to memory of 3528	3812	msedge.exe	85
PID 3812 wrote to memory of 4648	3812	msedge.exe	86
PID 3812 wrote to memory of 4648	3812	msedge.exe	86
PID 3812 wrote to memory of 4648	3812	msedge.exe	86
PID 3812 wrote to memory of 4832	3812	msedge.exe	87
PID 3812 wrote to memory of 4832	3812	msedge.exe	87
PID 3812 wrote to memory of 4832	3812	msedge.exe	87
PID 3812 wrote to memory of 5052	3812	msedge.exe	90
PID 3812 wrote to memory of 3208	3812	msedge.exe	91
PID 3812 wrote to memory of 5052	3812	msedge.exe	90
PID 3812 wrote to memory of 5052	3812	msedge.exe	90
PID 3812 wrote to memory of 4064	3812	msedge.exe	89
PID 3812 wrote to memory of 1772	3812	msedge.exe	92
PID 3812 wrote to memory of 3208	3812	msedge.exe	91
PID 3812 wrote to memory of 3208	3812	msedge.exe	91
PID 3812 wrote to memory of 1772	3812	msedge.exe	92
PID 3812 wrote to memory of 1772	3812	msedge.exe	92
PID 3812 wrote to memory of 4064	3812	msedge.exe	89
PID 3812 wrote to memory of 4064	3812	msedge.exe	89
PID 3812 wrote to memory of 1916	3812	msedge.exe	93
PID 3812 wrote to memory of 1916	3812	msedge.exe	93
PID 3812 wrote to memory of 1916	3812	msedge.exe	93
PID 3812 wrote to memory of 4968	3812	msedge.exe	95
PID 3812 wrote to memory of 4968	3812	msedge.exe	95
PID 3812 wrote to memory of 4968	3812	msedge.exe	95
PID 3812 wrote to memory of 560	3812	msedge.exe	96
PID 3812 wrote to memory of 560	3812	msedge.exe	96
PID 3812 wrote to memory of 3904	3812	msedge.exe	97
PID 3812 wrote to memory of 3904	3812	msedge.exe	97
PID 3812 wrote to memory of 2576	3812	msedge.exe	98
PID 3812 wrote to memory of 4804	3812	msedge.exe	100
PID 2576 wrote to memory of 3808	2576	msedge.exe	101
PID 3812 wrote to memory of 3320	3812	msedge.exe	102
PID 3812 wrote to memory of 3320	3812	msedge.exe	102
PID 3812 wrote to memory of 3320	3812	msedge.exe	102
PID 3812 wrote to memory of 696	3812	msedge.exe	103
PID 3812 wrote to memory of 4640	3812	msedge.exe	104
PID 3812 wrote to memory of 1832	3812	msedge.exe	105
PID 3812 wrote to memory of 2052	3812	msedge.exe	106
PID 3812 wrote to memory of 2052	3812	msedge.exe	106
PID 3812 wrote to memory of 2052	3812	msedge.exe	106
PID 3812 wrote to memory of 4816	3812	msedge.exe	107
PID 3812 wrote to memory of 4816	3812	msedge.exe	107
PID 3812 wrote to memory of 3624	3812	msedge.exe	109
PID 3812 wrote to memory of 3624	3812	msedge.exe	109
PID 3812 wrote to memory of 1804	3812	msedge.exe	110
PID 3812 wrote to memory of 1804	3812	msedge.exe	110
PID 3812 wrote to memory of 1804	3812	msedge.exe	110
PID 3812 wrote to memory of 4420	3812	msedge.exe	111
PID 3812 wrote to memory of 1144	3812	msedge.exe	112
PID 3812 wrote to memory of 1144	3812	msedge.exe	112
PID 3812 wrote to memory of 3244	3812	msedge.exe	113
PID 3812 wrote to memory of 3244	3812	msedge.exe	113
PID 3812 wrote to memory of 1936	3812	msedge.exe	114
PID 3812 wrote to memory of 1936	3812	msedge.exe	114
PID 3812 wrote to memory of 1976	3812	msedge.exe	115
PID 3812 wrote to memory of 1976	3812	msedge.exe	115
PID 3812 wrote to memory of 2632	3812	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fab-package.zip/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa4a37c188,0x7ffa4a37c194,0x7ffa4a37c1a0
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,3786727457921280731,15894153409913322754,262144 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,15035780397951861079,15394609979385650623,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,15621610963764174650,14594941797411928702,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7934986469633547688,242513125707434053,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17787070851553343567,1439095561379265336,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,16753453165250176047,5013560940439402135,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,2950981214508195841,16203569781302827995,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:9
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4168,i,2568146813994945665,13716945202237910985,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4180,i,12169730174882048239,205617608109480968,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:9
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5092,i,3803784885413109476,11113768096173826115,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5392,i,13141383813680793720,4737314823898060263,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,627775587024226354,622541337425697718,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,5674073581759991234,9165355541817805924,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15923111537214645358,232236383378631513,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3227314008260086019,11475538662901643341,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3227314008260086019,11475538662901643341,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6704,i,13508141798057782111,8288996513608936037,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,2265753110814252789,8696190792252283893,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,15782133418685634963,3001446095882690452,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,12827487253763821384,14443412242357739699,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5660,i,17207665940781382644,7301955465349025468,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,15072683891691125568,12101704084350301185,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,2501238630245076977,12317283529183803910,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5088,i,12393293382150690296,11923409988142215248,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5788,i,15482204050515117756,14555880916260700596,262144 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11596477579542908476,10347668648401323026,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,8733699350201113270,5036426268687109733,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,16754532649762103704,6647178846915870574,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,2630244834398547053,16490140061303309707,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6048,i,6640327713580897615,14643362180621400558,2097152 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,11963359379329821800,5367437162081689604,524288 --field-trial-handle=2132,i,6037416385139084857,15566421817051358116,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
MD5 d57c7e44d35c9cdb36ed14dfab0dfab0
SHA1 8b9d00e4fc1ace8371328737a28deb3bfb8ed61a
SHA512 00b1b35765c219cf319043400cea5573885f0ec520a41bbd3dbea4d771ffe15fb3bc1f53440e052b4e9c0fedc69b2f606d82e0faabbe997cf35324282c5dcc03
TLSH
T11ED02280FBA80230E0323833C3E2C323220AE0E000802EC808E382CE3F22208000FCEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 798df09e54df6f20104c3db421e9c171028a1a3e0e66d5471b3e5f70d71b3aab
MD5 a8d604277fa08c1ca035a64d150e5c89
SHA1 0f21b4b451362031a3bad7986a28d45ecaf37f33
SHA512 511b21bc43d186ed2da4a7845c0b0553e5f98ab9d99a323e62613b5d11cf8975342569def41fa657cf266f300f402868edef6111697d02a19b2e4a26ae2a709a
TLSH
T18BD01240B7940520D431243382D082121105909000405A850492418D2E12104000A898
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c2191dd0c18da0baed07c557d67a9a42114fbb5e29a8ec7906a8dca39d658a9b
MD5 5c8ec3d6e5a44dd8539d350f3c49bcb9
SHA1 b4585e80aaf9ffb76c0fc4e719e0f39eacebbfdd
SHA512 6f877404674ebf29a11106784b4a7b763a787c33037910712817419f764313c5817d23df89aba6217850311bf47d3605e38d99f5a384ae25de4044da3bf41df3
TLSH
T1E6E07D8854C8C32EE35064474968570CF2813B0BD2CC6ABA1F018CC574830D2F3C6EF1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b3d1a9146600d66d5284a91757e2e680495803c2a4b6b7f55e86623cd2d99288
MD5 c0a88f77e930f86e064c722a5bfff49c
SHA1 778a850a9a508f8f1435e6bd8d354c3171d8c868
SHA512 6919ef5b90cd4639a5aa6eae82dba5f888f4424356ea6fef5c5b17a6863624c65bc57a96246aa3d0b36238bb9180064a68e45cb163e935b9bb0776fc25dae22a
TLSH
T12DE0D8C8F4C4C32D9101644742986B0CA1C0370E96D8FEA55B048884F601141F3A5672
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1c2920a7981d4da0ef0eb63cfc26fdb2aed26ae0f21f06d9c2f39701c61339c7
MD5 51d63a065b1de185125f1020523153de
SHA1 0902db9e657a7b38af21b07304a0eb04ae2cf69c
SHA512 103ff1fbd4817f27e01966a8ccb9807170497e4aacd9254d37897b448bfe3ce0b31a6e34758315f966324cf77241091f7aa9b9f009790c352425efced100c1b5
TLSH
T1DCE026B856C8C3AEE204648793784B0C9280370AD2CC6FDB37048885B482588F787EF1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1930aeb9ed3cd39925f19c0b2abdc81e2d35b1a16817dd0c731acda9ddb4bf07
MD5 b4b6081cfc06f270868967435071df16
SHA1 527dcd983d7cb8cf525f9b84955b7d34e550b9b1
SHA512 bffb3bf38943980a1b9e93260cfbf59882eb79e78c0e6d0403d7f0d18d449406bdd72b352e95cc0bc71d4a2bdbf1cc357371f8e3f7741e2de20ee59553f4cc3e
TLSH
T15AE020E8A6D4C31D7200A4474254D70CD690374B96CC7AA71B0088CD7841144F397EF2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 11f3b4713bb8d0020db707f89d2d0e6e1aaa48db19eb2ff1822047927af394c4
MD5 a7b82f04345ad42bd6e407692eca0c26
SHA1 c73a8be9130599df1ace2fe36a7032d5bc241a1a
SHA512 aba902f0fe1951fffeb680e22b46433a324af0f60e02c887812a875f0cb375cf62f13390575d88a158fcb4c3e5288cf894015bf99cb9d146d102c3e50e6a0e0b
TLSH
T13B615D40FF9C6066D7D848F585DE3097362C8A99B9835DF21FA3C8FADCBB35150808A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c81d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c81d.TMP
Size 3KB
SHA256 d3c6d9006e73006ea7a3ee096f0ca1980768587cd4152dd33227cb1f33bcd8f8
MD5 50c7218dc59b2b24ba2c7a436888b86d
SHA1 38dd405b5dd44a3ce17aee0f306b939cb643c80f
SHA512 77635fa32bb0e858f0c690e9210d31b5c77acaec6ab16750f553ef3af0f633a1329f55833bd9276946e51c3dc1b6b9504ab3a2e2906b5f689daf41aaf72df9f1
TLSH
T15F615D40FF9C6066D7D848F585DE3093362D8A99B9835DF21FA3C8FAECBB35150808A0
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b2673b9380a19ed00b66b85253657d708dd9a4cb0878d10085cb439f18f4bfdf
MD5 8abd0fcf2d85dea6585a94adecee0354
SHA1 3be96126a5290e3cd755b9a45e56a9fb87cec832
SHA512 dfae829cf71630edcaac40c49a4c5df469b4ce427b570ae3407e7479e9289edcf23a8d000feabd7dae15c6db7932ac3423827f7a4a2a7a6867b05960913702c6
TLSH
T13A1157B3C3D595AE8D1156F05A24EE2BCE2D060642287C2989D4EF2B93E3476E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 395c57f1598b6215a2c10d89b51b81864e0b6c46527048fe273ffb80e0b87841
MD5 f37930ea926617e95a81186fc7bfca04
SHA1 f74c716304726c834a727698e0252b78537309a8
SHA512 b22de539e1a9caaff65bb76b8b0d63959b6c63d418f33083565d0b7f73eed05eccd0b249bccf3f530b3b9565a914f47d50193147383e8995c56e899929df661f
TLSH
T111115EF387E5855EC91156F05A14EE2BDE1D0506421C7C2985D4EF27D3E3075E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 687643aacb59aea2d021a4dc42c9f63cbc8ce155c95592967c94d95aa24e7409
MD5 1805c8a3f0cfa90a19995b8cb08986ba
SHA1 d0e5ffde4dc24d147d93294f0dda0fb34e34a7fe
SHA512 f076ebeb1d7bab979a76b77ba484cd74627baceda479b74c605616b5acc44c3304e743e851e1d508599be9d8775f0e2a38ef33a1bc2f73c544294c439cb6b8c6
SSDEEP 192:sxZHR4b9/fisvURIdpMgO/W6+WNGY0gSWxIgrJ:sxZHc9/fisv3MP/bG5U9
TLSH
T1F712D7526E28B97B8CC7E20DBA29BF43D6F9503291D51E58E6FC861C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fcb7208b17327ab117b3578214eaa6fba88a8328fb0d67cfa607e755e9db0cc2
MD5 063eb2f4f2ae93fffc325bee173ae174
SHA1 69be7eb67e45177a019060e83508407066216155
SHA512 e06c14726081c4878f1495324746e8b2c58542752576fa63cce56e7487a4b56bfca7ed6f5e5af57322856c82a4b25de61255a9e97de961489984ef398e2c126a
SSDEEP 192:sxZHR4b9/fis7URIdpMgO/W6+WNGY0gSWxIg59J:sxZHc9/fis73MP/bG5Ux
TLSH
T1D022C7526E28B97B8CC7E21DBA19BF43D6F9503251D51E58E6FC862C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b7004606e5c22cfa948aa37a7d391a5b186852adbe89b9b34ceeaa693bedb1c4
MD5 7b7bf67bb2f8544b401af89c536e2117
SHA1 3a6d3f9c04405a4b4782800b39ec5f8d117b903f
SHA512 215683b5fa624fd651356020a5577a4b54f24de625cc5df9e0b38368f86a47328df7729c36effbaf3d460c0e90ee7289cb5ed6a827446c1ae7d06893eb16e63d
SSDEEP 192:sxZHR4b9/fisVURIdpMgO/W6+WNGY0gBWxIg5XJ:sxZHc9/fisV3MP/bG5lX
TLSH
T15622D852AE28797B8CC7E21DBA19BF43E6F9503251D51E58E6FC862C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 11e05b0034801b986592eb3ca74cf727336fa2805153b93bd154183d5b3eeeba
MD5 2b507967295353a17765e7b2ad70aaf3
SHA1 a41056f84c6f2ef3edf65c3918cbdfdb6665b136
SHA512 043e44304dff9293e748751ba1ee28f5d953276deec37d3d575d6d7e4de6e3b62e7a91f4b8c44b9a7079c0f5389ae0fe149994551eefb1073b4779d5acdae96c
SSDEEP 192:sxZHR4b9/fisVURIdpygO/W6+WNGY0gaWxIg5XJ:sxZHc9/fisV3yP/bG5SX
TLSH
T1FA22E752AE28797B8CC7E21DBA19BF13E6F9503291D51E48E6FC862C05E76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 f3f2354a96ca367ca813c3384f7351752a7cfc7c7277fc601feae441b4791676
MD5 cb1b2f0671f72b47804087ca87f4c092
SHA1 3be21a70bcb8525510c36fdbbe7128164d8fb3c5
SHA512 8602238239170e9bb6fdc4f63b449d879a2db455d8810359ba96c5b88c558a469552a072bd2b05d398fb1bb94c14377617baa9972dc6ad5c04e2d1d36b9b4f1f
SSDEEP 768:Iinh588N24sWRmUUQ6I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CrLl/Ii09fxroef:Iinh588N24sWRmUUQ6Iu1jaKCrLpI79b
TLSH
T152D20A3B244CCB7E4FC01E9DEC566F976EA802C766688D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1b25e85c0bf9914db71e527d1e68981c4503f3a76289f603e905360af042e404
MD5 81d40743048447a8b70939b441df8aa5
SHA1 c1fbe9130aedf674410cadf0ca2257bcc2bd214b
SHA512 c114367083a9a4a188a1c4ed391ef40965feead988db8a900fbeaa7688d6e007d0e9e09532aa257e17a49607cbef334a295bc2d45909c9ddefad90c898c07344
SSDEEP 24:KQuZWA8ItKChE1eSL4VyX+RLRR0RnRI8RNbR3RXRxeRDRBYRsINRbRxKEROh8R90:KQLItKUEIryZQIrK1ybXItKQU4TyZKIQ
TLSH
T164911F0471BE4244397E294C91B89A1F425133733418EB6B7FE846768E6AF081CFEDDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d14a253-77f5-42ad-9c34-d87ef285ab22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7d14a253-77f5-42ad-9c34-d87ef285ab22.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 380798c78230d68f90a88bdf2c6cd8b30e8db44020d5d939bc00bc9e2f916184
MD5 4b8e35014efab5dac004f099e4a61973
SHA1 bdf3324ed1c0ebf63db8df71044f78b85a747a5c
SHA512 a329a6457794f2a1fd0ea7b550e04e3a27a79499b86f84635626fd5ffece75f3a881322ba05ebebe958470ed84c334f0f23a438135c30d02fd3eb0062996c49e
SSDEEP 384:ZZcIh8NkNnnEqesVqGuugbEXBIiB2YtgOIwZOyL9oR:xh9EqNTfKEXCiB2YXsEG
TLSH
T114826C3298786CB75EF7A145F54A76135EB8C16BE6C87F8494EC6B1C01EB29C030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 474250db38ca9e6fd0628280380d7a4bbb83d05fed6ddd5f7a34b39954b9ee9c
MD5 1854d75f1a70df1f8f055f8ef3ff7d1e
SHA1 1cc0392a34faebb47ae3179d7c28709cd590b941
SHA512 1681b29f1a29b9186b4306f35d95e20d8c54af87e980694ecfc7b5794fb97d12f8eb2f2ddcdc33d8d9269710493210818268099a56a23e95c3253b8ab1a71d29
SSDEEP 384:riFiZcIw8Ns8TUNTUlIlannEqesVqGuugbEXBIiBnYtgOIwZOyL9oR:GFQwpwggEqNTfKEXCiBnYXsEG
TLSH
T10DA25D338C7898BB6EF79645F94A32138EB48177D5C5BA94A6DC5A1C01EB1DC030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6eeb92a48b3ed92fd86137121d52c677af49f93eb074de9cd45729484db2275f
MD5 28fa75f489bcd24507e08c07ae15dd0b
SHA1 567f5a2cdad6bcbbc3cadcc60a00df3449de7d6b
SHA512 b7425974fe39dac3db4ed22bf98240f519a192d2bb1aa408e8e6580cff6938d7dbbd72f752eb8fb16238d5b668012e5fb0a6c5ce08bd088fcf680e6622ab275d
SSDEEP 384:aZcIh8NkannEqesVqGuugbEXBIiB2YtgOIwZOyL9oR:YhGEqNTfKEXCiB2YXsEG
TLSH
T1AD827C3298786CB75EF7A145F54A36135EB8C16BE6C87F8495EC6B1C01EB29C030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebad133572eb7d230f74061b5f8f547791d56ab806ce6e74df131067d414c02c
MD5 5ec2c463132058e6fe05447a6d596f93
SHA1 5b4f452f269bb5d614ea9152f31f742ca8321619
SHA512 12ff92aa73c551eefb24e7059c9747e9162304141ed129c07747771a972c3d4690daf0e5bc2e1113a17b16edce1042c1f4384fcb81835d9a3eee8c65971f878a
SSDEEP 192:DGNb6KsE7uxQmiUy5U3gxuugIoEvu9kymU6:DGNb6LEqPKYgxuugbEKXmU6
TLSH
T18902E739AC786CBB8FF3AD55B98676235FA4112FE9943F84DAE81A1C00D728C1307426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4877673f11df8cd2b2ee6fb72e75204d8b3d9cd06389995dd8b46be06c170f76
MD5 ac3fca7556895e1e3e33649a209c9a58
SHA1 411ce3be2789bb6d2b4c3e19c73c6ff8f4654683
SHA512 abfe3927419c45d96216d73d935a4105969318551488a583dd73b06049adb162a46f2141fe31e83f95abc75179f76a3836fbc543b078055790d6fee7c06f2e25
SSDEEP 192:DGNl6KsE7ugQmiUyS32xuugIoEXBYygiBZ62DqDU6:DGNl6LEqgB2xuugbEXBIiBzYU6
TLSH
T1BC12FA3698787CBB5FE3A851F48735135EA4826BEAC97F84D5EC1A1C01EF29C030B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f4fc500-c6ba-4ca2-9fdb-f522eb5f281a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f4fc500-c6ba-4ca2-9fdb-f522eb5f281a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download