hxxps://www[.]google[.]com/goto?url=CAESWAHrOzAV4Vd3kPtTRlV3irncqaLJsYT9x93LcubG2Al9aaTBAn2v0qjTbP4ngRiYRax6LHc4ZNpHQwT2qap5ler3tYUOdu5cEpxgI-OjDX1pJW39p0qiNaY

Analysis

user interaction
yes
max time kernel
300s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/goto?url=CAESWAHrOzAV4Vd3kPtTRlV3irncqaLJsYT9x93LcubG2Al9aaTBAn2v0qjTbP4ngRiYRax6LHc4ZNpHQwT2qap5ler3tYUOdu5cEpxgI-OjDX1pJW39p0qiNaY
Sample260929-xy4kcsvfra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{6F912888-0FD9-40DD-8E9C-CE44AC561B6F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3272	1032	msedge.exe	87
PID 1032 wrote to memory of 1936	1032	msedge.exe	88
PID 1032 wrote to memory of 5020	1032	msedge.exe	89
PID 1032 wrote to memory of 2244	1032	msedge.exe	90
PID 1032 wrote to memory of 5020	1032	msedge.exe	89
PID 1032 wrote to memory of 5020	1032	msedge.exe	89
PID 1032 wrote to memory of 2244	1032	msedge.exe	90
PID 1032 wrote to memory of 3692	1032	msedge.exe	91
PID 1032 wrote to memory of 4140	1032	msedge.exe	92
PID 1032 wrote to memory of 3692	1032	msedge.exe	91
PID 1032 wrote to memory of 3692	1032	msedge.exe	91
PID 1032 wrote to memory of 4140	1032	msedge.exe	92
PID 1032 wrote to memory of 4140	1032	msedge.exe	92
PID 1032 wrote to memory of 3880	1032	msedge.exe	93
PID 1032 wrote to memory of 3192	1032	msedge.exe	94
PID 1032 wrote to memory of 3880	1032	msedge.exe	93
PID 1032 wrote to memory of 3880	1032	msedge.exe	93
PID 1032 wrote to memory of 3192	1032	msedge.exe	94
PID 1032 wrote to memory of 3192	1032	msedge.exe	94
PID 1032 wrote to memory of 1224	1032	msedge.exe	104
PID 1032 wrote to memory of 1224	1032	msedge.exe	104
PID 1032 wrote to memory of 976	1032	msedge.exe	105
PID 1032 wrote to memory of 976	1032	msedge.exe	105
PID 1032 wrote to memory of 2804	1032	msedge.exe	109
PID 1032 wrote to memory of 1716	1032	msedge.exe	113
PID 1032 wrote to memory of 1716	1032	msedge.exe	113
PID 1032 wrote to memory of 1716	1032	msedge.exe	113
PID 1032 wrote to memory of 1028	1032	msedge.exe	114
PID 1032 wrote to memory of 1028	1032	msedge.exe	114
PID 1032 wrote to memory of 1028	1032	msedge.exe	114
PID 1032 wrote to memory of 3796	1032	msedge.exe	115
PID 1032 wrote to memory of 3796	1032	msedge.exe	115
PID 1032 wrote to memory of 3796	1032	msedge.exe	115
PID 1032 wrote to memory of 3492	1032	msedge.exe	116
PID 1032 wrote to memory of 3492	1032	msedge.exe	116
PID 1032 wrote to memory of 3492	1032	msedge.exe	116
PID 1032 wrote to memory of 4772	1032	msedge.exe	117
PID 1032 wrote to memory of 4772	1032	msedge.exe	117
PID 1032 wrote to memory of 4772	1032	msedge.exe	117
PID 1032 wrote to memory of 4944	1032	msedge.exe	119
PID 1032 wrote to memory of 4340	1032	msedge.exe	120
PID 1032 wrote to memory of 4388	1032	msedge.exe	121
PID 1032 wrote to memory of 3896	1032	msedge.exe	123
PID 1032 wrote to memory of 3896	1032	msedge.exe	123
PID 1032 wrote to memory of 3896	1032	msedge.exe	123
PID 1032 wrote to memory of 3244	1032	msedge.exe	124
PID 1032 wrote to memory of 3244	1032	msedge.exe	124
PID 1032 wrote to memory of 3244	1032	msedge.exe	124
PID 1032 wrote to memory of 2644	1032	msedge.exe	132
PID 1032 wrote to memory of 2644	1032	msedge.exe	132
PID 1032 wrote to memory of 3492	1032	msedge.exe	133
PID 1032 wrote to memory of 3492	1032	msedge.exe	133
PID 1032 wrote to memory of 3492	1032	msedge.exe	133
PID 1032 wrote to memory of 3704	1032	msedge.exe	136
PID 1032 wrote to memory of 3704	1032	msedge.exe	136
PID 1032 wrote to memory of 2676	1032	msedge.exe	138
PID 1032 wrote to memory of 4760	1032	msedge.exe	139
PID 1032 wrote to memory of 4760	1032	msedge.exe	139
PID 1032 wrote to memory of 4760	1032	msedge.exe	139
PID 1032 wrote to memory of 2688	1032	msedge.exe	140
PID 1032 wrote to memory of 2688	1032	msedge.exe	140
PID 1032 wrote to memory of 176	1032	msedge.exe	141
PID 1032 wrote to memory of 176	1032	msedge.exe	141
PID 1032 wrote to memory of 5056	1032	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/goto?url=CAESWAHrOzAV4Vd3kPtTRlV3irncqaLJsYT9x93LcubG2Al9aaTBAn2v0qjTbP4ngRiYRax6LHc4ZNpHQwT2qap5ler3tYUOdu5cEpxgI-OjDX1pJW39p0qiNaY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe4499c188,0x7ffe4499c194,0x7ffe4499c1a0
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,9692367480765617925,1317835643391607066,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,10279612550398588088,7571309258644231333,262144 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,14126022822432492799,1870360865257066571,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,10382097735266618097,4556743540832777469,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11327201310881483358,8817316326463395969,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,12516514594000491082,1398732545746712264,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,18304866346758006670,10850877261978477099,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,7940971250615836425,358841210831531343,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,18230361437309302353,6925188796418879261,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,6074683619712300044,7874521796632648270,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,6074683619712300044,7874521796632648270,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6292,i,7968843995223044796,5513854518097238059,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3792,i,7208396246847704046,17693834732387084670,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4508,i,4944370950324544559,15143895588063833799,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6196,i,3551813771564496196,17679019697289703164,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3728,i,5379497588933909430,14044325340908642391,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,15884601257417658431,1781724441541350078,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,11058327515691641019,4841696108695442320,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,17716765149616958420,14316116681106029163,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2932,i,1619963739277061557,16928005778462129942,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5956,i,15302445321294615819,13311896230796295849,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1028,i,17798376126721936790,2890181324820785583,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5876,i,9626203604244498768,11937926589372739381,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,7959308305081998574,8298061999988646013,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,1823236248016181485,4660042725427760656,262144 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6128,i,9909491578173140671,9885080715379677025,2097152 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5832974545376969106,4902232649504627345,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,3730224935363473161,7993511827540633609,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,15698461517263646581,12982611757673169126,524288 --field-trial-handle=2980,i,6017146141463788301,10148599791784560086,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6a710ea6ed116461e381f19797606f67d65e1423d0c803fd9a6256a968285bed
MD5 d5a0e8d796a223c1f829ea340d21f5ca
SHA1 3c3a023e9c405144ce0e962710554637cbdcfd32
SHA512 74e2c1fbbaa062a4fcdc2ac9c13441b5941bcb47f6558d374ef74022487194bbe5c7ce1794bf5ad9485c011e938e075983715a4e67977de3357d4d68577c6be6
TLSH
T1CBE026CD46CCE32EBE00A457436C870C83A13B8A92CC7E1F1700848E7485042A3CB6B1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2c4b6e3ced5c6dc4d3c583f40203b8d6b822f18e175c567a601c08fc924517f2
MD5 8e5fa670cf0587231b11c9c648f40ea0
SHA1 51abf4f49d62eab1816221af0d2367a6bb407155
SHA512 a2a6d1bee95ebf49596f849adf238e46424a150b12a7c25882af4a08438e7b4b8fd0c2ad3dd32b3896d44b8209b4bddf97f66a44be8510dfaaad151cb18c280e
TLSH
T10CE026AD49C8C72EA60064C782B8970C82C03B0A93CCAA1E1B0488C9B44284DF7C6AB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 11ffdda9b2c5fded4f0fb36cd51a3b8adc907c67d3f1b0b2d415528c525b6471
MD5 30b9b572d5718d525140b326351de2ed
SHA1 f27699859c2e11d18a05062fdd236887a1e522b7
SHA512 f23696b36812a87ecf4d99cacc0e3291347b8e773699fa5701c24e4a78a47f70499849034c0eb79b7bd830a9953da7dff7501002aa49bd496e94d0fc18e7301b
TLSH
T17E61A5C055A3B448FBA8427481E9389F3E38258F55AF1DC29DB7E8759CCAB5C60B3244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59014e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59014e.TMP
Size 3KB
SHA256 00e1f1d89f267000a11f2b992ac1d946989688a1f8e91266742556ee0a0952e0
MD5 27c4bb4025f370295446ea742ea2dae2
SHA1 adece9283724cf948ba3f538819c6aa2431369ff
SHA512 f19d0eede87cc30a6fb65a4c9e8c1bc3b829e0d35d8d6936cafa48ffe646e8e7e219e3d3d6e064ca04ee80f5af80df18b54a9433b9abc99bc4c8157259494b93
TLSH
T10961B4C059A3B448FBA8427481E8389F3E38258F11AF1DC29DB7E8758CCAB5C60F3244
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ce756ae63dad4e6af09b5d60ecc22eeb021ad54bba09c7f436da7b1499204c8f
MD5 c0cbe8e0ee963e4eb9acee02ea29327f
SHA1 d28f3edf4993b9349b416d4e10d762626fbd1fb4
SHA512 9c5270362a225680c51dc6e2fa13ae00bbe0765f9e40b638b5022ff9004820b3e12ebbf386193c27b5842df38c82e98a11209d909169092fb76aee670345ce68
TLSH
T178316AB7C7D9C26E891156F09A14AE1BCF1D061983183D2AC9D4EF5B93E2471E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 85f3b31b2ac4bb89ab98d9a1fd528432fce05750fc10b12f941a7b66d5a47361
MD5 5958ffcda2e7fd76cb4f613ac6946c7b
SHA1 4e8ed670f2f2556d6f0a838a0266215001dc43a5
SHA512 14af0cfcbf1e181ccffc2894fcec5722f1cc9539c59e6feabc8c7b74e2b74b11b220c5edc8668a1bea046d51d818cc8d36bffdb6811ea473ac09be78a39eee64
SSDEEP 192:sxZuRrWA/f9s0Ay7HIdpJHW6+WNGYYBY1lOIgrJ:sxZucA/f9s0Ay7IJHbGfWk9
TLSH
T11B12A612AE38A57B8CC7E21DBB65BF53D5F9503261941E58EAFCD61C04E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d3dc3909039a7f11f6a19c7f39ca47e143fd25109e618ba1ad8771d573c46ffa
MD5 d70c6db303921b5bbd4412e009023532
SHA1 b620a0a2d2b2b0f8fde3971e7e0b4e910848e323
SHA512 49c524d3b65384c02882c0dbf188c389d04d893a1e0a699c093f8f2c9b972147bc6cd30c0de2eaeec7b2613ca9941d24a3345700fc7bd3c9feb8c2a3ed68b7aa
SSDEEP 192:sxZuRrWA/f9sa1yiHIdp/1HW6+WN0Bh/YYB6F1lOIg5nJ:sxZucA/f9sa1yiItHbw/f6Lkj
TLSH
T11622C852AE38A97B8CC7E21DBB15BF53E6F9503251941E48A6FCC61C04E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c8e067d57b78d5cfa9c9497c26550bfa3c5d7520f83eaf0cae7b473bb31f3cf2
MD5 6d50d3d183708ed582a9a8bfe1174b58
SHA1 5366b4578b71029acf2b426df55bd3774ccd395e
SHA512 0fd77609d83e1efd1eccbe3db4fbb0b1cac8055a4971470f2b7d181dfbc0dd9f55ceb84ee29ea3f5d40100a0a6c9a01400e662c08ed8c64c718a5df3ff6e57ef
SSDEEP 192:sxZuRrWA/f9sa1yieIdpp1HW6+WN0Bh/YYBXy1lOIg5nJ:sxZucA/f9sa1yiP/Hbw/fXIkj
TLSH
T1CE22C852AE38A97B8CC7E21DBF15BF53E6F9503251901E48A6FCC61C05E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1a85fb660c84868a50268548fdef83f99d8d1c6686666bd96f48dd13ae1e7499
MD5 ae528c1a354a23bdbad0dd716b5d6e0c
SHA1 df9aeccf2663d4d913fa4b2ac6fec97dc9d44980
SHA512 c61e0339bc1deaa36e3352ff1143d5b0413f7c68a6f99e3fb9d3c86fe4dce67bd9455fdf5dec2b3c0180a1783722caec12d2a605c1d2950e3153484d6825fdb2
SSDEEP 192:sxZuRrWA/f9saAyiHIdp/MHW6+WN01K/YYBT1lOIg5NJ:sxZucA/f9saAyiI0HbX/fxkt
TLSH
T18F22B752AE38A57B8CC7D21DBB55BF53E6F9503261941E48AAFCD51C04E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4ddc8b1110c001d9e532e7d438bf8166a6c49e112fd5a77e028ac6b42dcaf3f9
MD5 56740c1149a05d548ed711fdf9e8224d
SHA1 8bada7eb68b6efa3559a0b2a8c7b7773ebdcd05c
SHA512 121460309638c8ba82e9ffb8e55d841997a72100a797be3d869c3e0101d4bd62315234c6f8202f0644d37b08c054a7d86c7541c41ae4dc1c72f9a782641797c4
SSDEEP 768:6zyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX1ropTbh:6zyYR7jWv3NpBu1ja/CL8OXO7
TLSH
T1FEC2E93B644DCB7E4FC01E9DDC5A6F9B3E9802C7A6548D4047FA944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c12959b6989125f50195580483fdd07c10b7c93f56481b4fcfa5b18707343619
MD5 cf46dab5a85c3bcff180278e51244014
SHA1 e559d9b294fa64949ab4584bc0a155e16ca73ef6
SHA512 1e2733606046ce439628dfb328d7b3b8a36ba04f8be39e74493b859823067e6c30b38725a120eedcab974e34c42763dad8e5fe690d7b631c177ff4f392246424
SSDEEP 48:KgRAthrvzMb/KXIS5MK9Z1zMxxcYKbRVyLeZ04WcMFbwX4ISQFK901GFx+VYvws3:KAWEKXKKWdSK2gKGfyKsoaqz
TLSH
T1B291665071BB070539BE688D9375A71F124131B3B498E67BBF7C00A58E6AE050EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9e916ab65183e4be1c7e05e4caf8856b3ec59f04d15be86e60bf08cf2502b845
MD5 dd406ed14d6e444ac2f0145ae2dc0984
SHA1 47621ec40bfefbf22f20605971ae949e7f975442
SHA512 147cfd8ce501d560decf7b93638ab00a7b76cd747f9a1a9937db16a06406cdaf414aa142021e151e4aa0decfc642faf8cec893b675d09a54caf693235567b50f
SSDEEP 384:8ZZcIhsNU0gZv9inPyQX5+DtD8PXq+2jndtgOIwZOykmHo9:QhrvmxkDSqljndXsk6
TLSH
T197828C32D8B89CB75DFBE144B48B32039FB85067E6C4ABC4D5EC5B1C01DA699130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f5c187365058af304704419a21f04f2cb20cb26aed2f1762cc44aa5f101c6d7
MD5 2cd5b05296146e5cd339e8f3fe487347
SHA1 10b793da20154b788d4e2ad86c9129da87f75c5e
SHA512 505c93af5a944b606ce79cf301b0f0b771c5633894f8dabf3d1c680cc0930a2068e2f40997fc4f9184d1e2a7c6a92306be4a08da57f4ad2e07b7af366c0c832f
SSDEEP 192:EON56nnHGQmiUyufQYcX5hQDP1Tjzor6s1mmMcalMU6:EON56nC9QNX5+DtD8ZAMU6
TLSH
T1C002CB34ECA86CB78EF7AD49B48637136FA5216B95942BC4DAE81B1C00D765C2306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 99c5b16dac7197810a42958c657fcbc6c7ae6354592f8767a4a50a686fadd356
MD5 3f9e489e489464a580435766b2a8ccb1
SHA1 644346b95827e111d37e3d7cc3fcd1e7a2444bd5
SHA512 1ed594622d1beae28ed7eada2659cb9ca4fbfc6e7c80ead81f0ad0530fc301c8cb7a7111e5df22e2cdf74083b15333d2d1ba4ef64a650709fa21b6e9ba66f14d
SSDEEP 384:NciFiZcItzsNU88TUNTUlIl9Zv9inPyQX5+DtD8PXq+2/ndtgOIwZOykmHo9:hFQVr8wgDmxkDSql/ndXsk6
TLSH
T1FCA26C33C8A8DC7BADFB9684F58A32139FB85067D5C4ABD0E6EC5B1C00965D8130BD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 80b00f2324ba556ea6321de7b5a4004d8ae0aaff867285fca9d20fd82c5938d2
MD5 ff2451167b7346bd674db945c2da8630
SHA1 1ecd3c08b0080b3bad66087da386a4f36818998f
SHA512 771a72b9828523130fadb0a3b6cf7833a65de69cbce71abd2222b562e44f0796e97dccabdf27eb00a441c8a3389e1f3646794c58e360fbb1091f0727daec67a1
SSDEEP 384:VZZcIhsNU09Zv9inPyQX5+DtD8PXq+2jndtgOIwZOykmHo9:7hromxkDSqljndXsk6
TLSH
T1B2827C32D8B89C775DFBE144B48A32139FB85067E6C46BC0D5EC5B1D01DAA99130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1680c2156e48ac8557791d6a5fcc8845e6238064af7bcad588eb8db85a6780d8
MD5 f8f86792e9a135c383ffb7fbb3f6cfe2
SHA1 ba0bcc34a26254f6bc1bf36e21e9dc2f52db980f
SHA512 78235f1cef30a2b405c05e40b3ce7e5ed19d11482bf63154a2cc73146d314516e61e2d72ff7058e355451092a3c97d93aeeb56586c365cb0f48ca6f0f22f6c2a
SSDEEP 192:EONAB6nnH6QmiUycfuYcX5hQDP1Tjzor6s1mkXIx+2ng3cq5dU6:EONAB6nW5uNX5+DtD8PXq+2MndU6
TLSH
T194120B31E8A8AC675DE3A595B0873213AFA55127DA887FC0D6EC2F1C01DF65C630AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cb638948d67fdc9e89676228790ff22aab71875a74b2f5a9649cb04ffa4305d6
MD5 0a320d8cff8c038320037fa3ad08aa6f
SHA1 ad6003fe48bbf2a67eedf4855325f61eb3448e30
SHA512 c5df2bc35546ced4322db22282475bfcec54d0fea800f84a7c7ed22e110e48db3d96281437a7b069eb825d07234cee0d7232d6cd9eeddcb2137e04f473930b3d
TLSH
T1AF413958AAF9100CB3B76E5AABF7682D487E78732E06D49D00010D4F0A63B40D962B33
MD5 SHA1 SHA512 TLSH

Submit Download