22057782cc776f6d692556414f5daf031a1c817910c3bf61ff46af5a2e6422f1

Analysis

user interaction
yes
max time kernel
449s
max time network
427s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CFDI_20260930_224257.html
Size 2KB
Sample260930-31hcssxvfy
SHA256 22057782cc776f6d692556414f5daf031a1c817910c3bf61ff46af5a2e6422f1
MD5 d9bed3c4c4ac6d78c36e9389d15e2921
SHA1 f887f824e6a40d542420ecdc3e142d9c9f993480
SHA512 ade99180200ebc643d3c155fcf4f4e0cdc8b488933b54ff39d1fdf6ac7987c5a3338a5b07fd07cec6fea2a7decf7c4f56f92f2e30fde84593f31f756e9973b43
TLSH
T1E551317499E6009E6833DE43456211C63A6B1852A0E2D41C7DBD672987C1E3B13FF3DC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{1272AFC1-09BC-437D-AA0F-FF4A9848E7B0}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4760	460	msedge.exe	86
PID 460 wrote to memory of 2232	460	msedge.exe	89
PID 460 wrote to memory of 2528	460	msedge.exe	88
PID 460 wrote to memory of 2232	460	msedge.exe	89
PID 460 wrote to memory of 2232	460	msedge.exe	89
PID 460 wrote to memory of 2064	460	msedge.exe	90
PID 460 wrote to memory of 2064	460	msedge.exe	90
PID 460 wrote to memory of 1148	460	msedge.exe	91
PID 460 wrote to memory of 4376	460	msedge.exe	92
PID 460 wrote to memory of 1148	460	msedge.exe	91
PID 460 wrote to memory of 1148	460	msedge.exe	91
PID 460 wrote to memory of 4376	460	msedge.exe	92
PID 460 wrote to memory of 4376	460	msedge.exe	92
PID 460 wrote to memory of 3812	460	msedge.exe	93
PID 460 wrote to memory of 3812	460	msedge.exe	93
PID 460 wrote to memory of 3812	460	msedge.exe	93
PID 460 wrote to memory of 4300	460	msedge.exe	94
PID 460 wrote to memory of 4300	460	msedge.exe	94
PID 460 wrote to memory of 4300	460	msedge.exe	94
PID 460 wrote to memory of 2288	460	msedge.exe	99
PID 460 wrote to memory of 2288	460	msedge.exe	99
PID 460 wrote to memory of 4988	460	msedge.exe	100
PID 460 wrote to memory of 4988	460	msedge.exe	100
PID 460 wrote to memory of 1268	460	msedge.exe	104
PID 460 wrote to memory of 1996	460	msedge.exe	112
PID 460 wrote to memory of 1996	460	msedge.exe	112
PID 460 wrote to memory of 1996	460	msedge.exe	112
PID 460 wrote to memory of 2348	460	msedge.exe	113
PID 460 wrote to memory of 2348	460	msedge.exe	113
PID 460 wrote to memory of 2348	460	msedge.exe	113
PID 460 wrote to memory of 3600	460	msedge.exe	118
PID 460 wrote to memory of 2004	460	msedge.exe	119
PID 460 wrote to memory of 1160	460	msedge.exe	120
PID 460 wrote to memory of 5748	460	msedge.exe	123
PID 460 wrote to memory of 5748	460	msedge.exe	123
PID 460 wrote to memory of 4544	460	msedge.exe	124
PID 460 wrote to memory of 4544	460	msedge.exe	124
PID 460 wrote to memory of 3504	460	msedge.exe	130
PID 460 wrote to memory of 5636	460	msedge.exe	132
PID 460 wrote to memory of 5640	460	msedge.exe	131
PID 460 wrote to memory of 5636	460	msedge.exe	132
PID 460 wrote to memory of 5640	460	msedge.exe	131
PID 460 wrote to memory of 2092	460	msedge.exe	133
PID 460 wrote to memory of 2092	460	msedge.exe	133
PID 460 wrote to memory of 2040	460	msedge.exe	134
PID 460 wrote to memory of 2040	460	msedge.exe	134
PID 460 wrote to memory of 5980	460	msedge.exe	135
PID 460 wrote to memory of 5980	460	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CFDI_20260930_224257.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc3ffdc188,0x7ffc3ffdc194,0x7ffc3ffdc1a0
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,44089253224771614,10020289620751959196,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1676059334796501447,3469823257752501484,262144 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12566635824683255344,15690650554125375974,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,3102581837422662194,10259405605977902857,2097152 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,4054855802121157244,8806652916675737120,2097152 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,3734836164677037770,11737453171324148659,2097152 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,6936157836349807945,10353828464659077900,2097152 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,15137573382614426136,292401073393067272,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,15892537641546171911,11237846977416991987,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,12822454422077438563,12097020291243085169,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,12822454422077438563,12097020291243085169,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3624,i,1911804709982365942,17980292554180666869,2097152 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6356,i,12220990617347913581,12966974947679184325,2097152 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,8640236203357829487,16745318154419265031,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,8538899461983662860,733539714056898950,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,11828578268060901656,4876804924729415530,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9092370684603981564,3680326000578812566,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,5084741409907768426,16901956741791546806,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1212,i,8897409728460696966,10183011620986632841,262144 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,848327510958783850,16489206486697132666,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,9248489763397759758,7718734376659064970,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,17642472254295803974,9112568839378730995,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,1645346153304109922,9365030671824877297,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,14794573903821945112,9290252345018734647,524288 --field-trial-handle=2784,i,10176436584012327808,5072481912467684424,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fa6b0fcfe261c4bec97a288af4229e930b5eb3cd19f4b36599da944721e7aa02
MD5 abde969a75b0b5f5892b45ff61c8c82b
SHA1 7d2aec50037eadf7ef434caf4ced25381fd5ff8c
SHA512 fdb432a4805b40e319049fac198a28e3dd257ac9f71796e88567390d60d316e807392d55e3cf6736b7f759fa392411b2e6cd7a0ed291fa7160d08eecc6277f9f
TLSH
T1E8E07DE604E8C22EB25876CB417B630CD380FA1BD3C0690E1F01C58C7405648B7C7AA0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0274aea653a8aeb644a514658aeb7f513efe45dd1f2f74b2de23cae98dc8cb5e
MD5 e80d7786101617cbca23691c9e17d137
SHA1 d2a31293ff2d74a012f2cc7d46d5438eeb8136c3
SHA512 51b447a352e4c8cd96d1bde434bf7623c9613bd317949c9465111f70d2f09b5c651cf93a1a70466617f139cf24cdc2a8ef4f2fb9dde523fdcdd24a7208168aaf
SSDEEP 96:U9drQTsF19f79oMdtCOKCwNI9R3dyF99FdbhzU9iIW44wvwfiVfJka9pM2zV9s9F:mJ3bC/NzhTIL+MgwL2H
TLSH
T16EA1A6C600CB656BF797AD7064D424E776325A6402A39F3390BADA3A7E7A3E4C0C4193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594f7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594f7e.TMP
Size 3KB
SHA256 793b78d5e7d8999003d89204f57b84b4708acbef9f274082d37cae2d0b086709
MD5 37740f2943d4903f8e2e1e52cb28f693
SHA1 3b7f0f274a3b790f700abab1c8c58b830219bff8
SHA512 5a73923abb1304648874de28b9e3f7ea9b7445cf8d6288631aa47b0fcd5fd8a5198742247eb11372cf923953437f2d70381ab15bae2efe0116492359d64c9e26
TLSH
T1F5614CC511DB84AFFBAAED3489E830CB3A7756A043E32F7301B9D83B5E067A98541053
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f73e8c24c6f3f811133062f93b47c8544558f916847a724c690ac2cdff1acaa3
MD5 6a5f890dffc79ca40b6d65603dad70c9
SHA1 8fecc2784febcedb4564699f0302edfdcdf73282
SHA512 fd0b8cb8a249bef0f47ab82ee6fef43d888f5c8323a672bf1d74763011f1525097c0ad14186c39028b39e5204e51cecf87ccdf4f58ac16dfd1c65cd3c674720a
TLSH
T1FE814AF783B9552D992292F0DB08DE1FCF991811832CB979C9D05E5393A34B1E101B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 783a0da673fed7d698840fd6ad47a6d98702677e604895bb0f618d960511c3b9
MD5 2c3ebfe9b36433bab5ffd4d7579245f9
SHA1 6feb41dbcd5c5bf2512d4e835259471ce3501442
SHA512 ea2a116e9d9ff7e4ede6f74b26d53eb34ca448fb481d859341e149feca6f2eb3d05fa34d31372090109697a100ae4e19a7863ebfc1c813774ebdfb79586eda80
SSDEEP 96:DROTWRzcJQ3ZPRIRisXwkdi+U1Ra3DBwQ:DETWRgW3ZPRIRisXwkdi+2Ra3FT
TLSH
T1F0816DF783F9852D891292F09B18DE1FCF991925832CB939C9D49E5793E24B1E101B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 feb229fa59470dbd2e28fe61828a7f51a5fadc00118899640ffec2ab72f75732
MD5 efc47493289df6839eb3f8c448be6e4c
SHA1 227f14dd9af865c667feed9c85cf04362c24823f
SHA512 3b81504d00d96e013d08ef554bb800d61629b60de90fb56f3da1e1b1a4562a3117499d05dbaac0b609febb11d74e2cc6f1edfe3c3f91c021feb6b0815919c73a
SSDEEP 192:sxZeRZW5/f+sYkDIdpdENHW6+WNGYgUPQIgUa8J:sxZeC5/f+sYkceHbGdUag
TLSH
T1FE22A6526E68A97B8CCBD20DBB15BF03E6F9503265915E48AAFC861C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dce392b29b62d55ea34dbc5e076a599171146201591344643e19a72a8981c054
MD5 e78e818920884c08ff61d5727b7def62
SHA1 ea58a9aa82769522b84fdff8af81a2de4572bbab
SHA512 157a75c7f4e94c94bf218f61ba8f8a9ab9484ebd491b89258910b277438e769919a867d4a9bf1924db8b031762d35c8cc8f4b984e7c691d675d313bf4884c48a
SSDEEP 192:sxZeRZW5/f+stCkDIdpHENHW6+WNGYgXPQIg5Ga8J:sxZeC5/f+stCkckHbGagag
TLSH
T10422C8526E68A97B8CCBD20DBB15BF13E6F9503255911E48AAFCC61C05E7BCE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 eefd31232362fc1717de7914b70b06f8671d33e12e70023f60214ac8c553fea2
MD5 7f4b5089776baac00f6193e46cb8a43e
SHA1 16d9940947da6a6fd0aaee616d19088747c34b54
SHA512 af9e0de9ab502a78957f890ac472a719ac15f02fd4f40a695218a484f120a574dc254d4b8eb0f109a66e69bbe8144640e92b30415d5ec3c3f89bc42b6d585c37
SSDEEP 192:sxZeRZW5/f+stCkDIdpdENHW6+WNGYgPPQIg5Ga8J:sxZeC5/f+stCkceHbGGgag
TLSH
T1EE22B8526E68A97B8CCBD20DBB15BF03E6F9503255911E48AAFCC61C05E7ACE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 228c1e741f8846964c06b00ffe378326bae1e959cd60b3fe553cb012b44f0b2f
MD5 601cf489e24794550c732603e9efd9c6
SHA1 8259d91478cad8a2e24ab524a5b9d82f666a088a
SHA512 96f797d3d7ba6dfd0c65a36c68987f17d9545d2ce5a58ed7a45c03a711d7923c1dd406b7d143de3f44773f563d5ec31ed71d53e7441a5c74768300a265fe1df1
SSDEEP 192:sxZeRZW5/f+sBkDIdpdENHW6+WNGYgUPQIg5Ia8J:sxZeC5/f+sBkceHbGdGag
TLSH
T13322B7526E68A97B8CCBD21DBB15BF03E6F9503265D11E48AAFCC61C05E76CD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 83156c2cf8e6e4539b2a2220a3ca9e7141ddabac2700d7f509facd6f9f7a5fd8
MD5 0dbb9bdbfd8d2201306f33c3fbfea594
SHA1 65a0446cab9ac50351d74f177c38a3a0446664d1
SHA512 ce957c354fbb949b4bd035570a8f458bbe39b8195bfb6f3ae1c5205bd229c5d8dff734369ab88a5dbb10532eb3e795c9c9f8313765a8d9e4f33b295c3864eb0f
SSDEEP 384:sxZeC5/f+sb66s8qMpRiYnazAW8pZS15posJWeT+8CkckHbGDgag:s2C5/fF4Mnc7WeT+/kvHbG8ag
TLSH
T177B20705A924D87B9EC35D1C693C7E33E9EC506222C5CEDE1AECCA1C019E1F9AB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 af2afba2f4793cabbc15bcb57fea890150a297e12190e80102000b140c377798
MD5 a7d3591a62f1c0e939469b073d7700b6
SHA1 b6ecb8dda3e9f7a5375c45dea3dec1659a9093d7
SHA512 034ce41d8012c3c32b6d24584ae9e7f5cab6ab9ce780ade14eccd64259afb79aaef8fc73eb10f9182a0b601fbd27142d219d189d890186ee2b4a290bf6c52faa
SSDEEP 768:l6ichfPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzirofOP:l6ichfPWvPZhlu1jan+LKgz5mP
TLSH
T195C2F97B644CCB7E4FC01A9DDD1A6F9B7E9802C7A6588D4047FA984C02C77EE61264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 672B
SHA256 8ed2689f2fbc291552f7dc6e727281cdcfdb34837830e0464a333ae3842cd7eb
MD5 59ac16e37f0224690ed334274e932095
SHA1 f50c77def250c21276e8168219f2cc802da7f1cb
SHA512 4936738e08e95d22df1681afe9324a817aeaebf3b466e842b404431716dc07217a074e4d16549249898142073b884f16f40a168a8937e4735dbbe77605ae6e03
TLSH
T132010E6B4F125A1BFC940774687DA89966B102DC9352AA0B61BED11A8C63344EF42A90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d4c3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index~RFe5d4c3e.TMP
Size 672B
SHA256 c1bb0b526d40ff3a41df6fe00a3a91630893f00cf4119d2e7752f8eedb8bbb14
MD5 95be3166b9b5bd6af9156db6a210c842
SHA1 36063ac5bbda6dfa176be4244843ec2f3aaad938
SHA512 2d81405eb45e34672182ffe4a891909460055a0192c7339b370625e908964952752cf8ccfae33afa9873d493cec8042101c7e7c45d7664b3deb4915b41306554
TLSH
T1FB01D4D542135B46FC4402B5DD7DA95561754004A3517A4FA3FBE15ACC12780AA43FA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cccba827647ab67740bd26306858816d43f66e0510bc6b713ca04ee433e10c09
MD5 92377d0da14cde77d28dacc04efeb5e3
SHA1 4ad0b4a25cfc7e90fb58f7e36e1dcd9375ac3a33
SHA512 e85fc59550fd31df4fae1dd21168101aff33d0042f498918ff90387c4fecbbd0af11b5d0ed03138696e1b4eee2f9cf8ac50f39b40bfdc8f9b7fbe1de9c0742f7
TLSH
T1B4E020B72FD72854ECDF83D2103188D54105B964C544ED4F206ED1C7D2B1755385AC26
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a109.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a109.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6b751ec58e4d37f61648b1d8848c41fc82f00d65b84a7d707bc8b38731c8a71c
MD5 5ad0ba86b59a99609edf7566d2c0b8cd
SHA1 ece110b1316875c9f96f2219b1a813c6371f2ace
SHA512 3dfaa6e2726dc7233fed1dec5a8ef4e7e45af6c6e8853824d849026c75cebc03ba098c9e3426dae65bdfafac848dcc9873012ba44cb6599e8adf3f13581e4d93
SSDEEP 384:GZcIhsNglv0D5v1P2BGYX5E2P7ZgDzrVZh6DKhHwNoO:UhqD3PwGYu2TZCzrfYGHwNx
TLSH
T14B828D729CB8AC775DEBE586F4473A034FF89127A7C4AF8491DD5B0D00DA6982307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 310a61b6ce2211b0eeb209eb4a7cf33f325207132a6975e9dece3cd835793b8a
MD5 2b9b5a26917c16dfb981bf13ec976f5c
SHA1 5b546f89efe13b15819b991ba28081ccadb00ea3
SHA512 af65e1b1445e33e07ee842be05db86b15ec2a859fc501116fee6ae9a567100c564146f8f389c2c925720ae394a5b8b7f61b9af32aa4726a1f76f51a50d0a4583
SSDEEP 384:piFiZcIdzsNg8TUNTUlIlav0D5vwP2BGYX5E2P7ZgDRrVZh6DKhHwNoO:AFQl1wgFDyPwGYu2TZCRrfYGHwNx
TLSH
T1DDC23AF248E79876D9EE9743A77D2D034EBCC127B684AA50B3C85A0DCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 954e830836d8486f7c72f86ee1f52972fe7722dd9445d4343c745bddb98914f9
MD5 483a8179ebb5d58e144198d44884f4ae
SHA1 84c9ff52ffce3c96c8daaee952cca2fc48e2b7ba
SHA512 b83771a5a0cbae21fa60413d66c3ab3eb077a7e4e710e220f5fbf216714a937b3c6a730f2775b122528060e25d5d863196641494fcb52476684c9e8502b48158
SSDEEP 192:LJONl6DphmqQmiUyPCq8wGYX59ezvCP7zkk78KU6:lONl619ZRwGYX5E2P7r7U6
TLSH
T12502FA35E8787CBB8DE7AE55B48B2B135FD4212FAA906B84D6E80B1D00C764C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 657f911f9aa21acdfd4d18b40b0f8cc6d5b5547a8b1332b6b6586a279df96275
MD5 b84ea0fbad55b9f4c0db12a5c9dfb635
SHA1 6b8842cc2e9ca0759c38beaa8ab1c8d46248018f
SHA512 a8d85a5ec4aa00762ab0ece98009d3fca2d235afb5eaa382eeb61635380559360b6091bd1548ebc2c504bd672bafe843e9c426c9e4798cc085266e97fd98201a
SSDEEP 384:QZcIhsNgav0D5v1P2BGYX5E2P7ZgDzrVZh6DKhHwNoO:uhHD3PwGYu2TZCzrfYGHwNx
TLSH
T1E0827D729CB8AC775DEBE586F4463A034FF49127A7C4AF8491DD5B0E00DB698230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d472bf9932ce4cd6b927f09b064f51398c389bab23e18d4d3fbf40a0b719656
MD5 6370bbc70437b90c57d49033864383c2
SHA1 2035dba5b5ee8a9d71ad79a0a6142a7118908d5a
SHA512 eb5e8162df0f2a25b1d762186e37e07d9f1e4e44421b72dfe218775901ab51acc920791ab56561df32567a3b8b32a4daee9294b4d4267324e7d8144d2512c9f8
SSDEEP 192:LJONZ6DphdqQmiUyXCKwGYX59ezvCP7ZgDUkIIRq5AU6:lONZ61mnKwGYX5E2P7ZgD1rU6
TLSH
T141121B31E8B8AC7B5DD3A491F48736139FE4522BEB84BF94D5DC1A1C01DF29C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f2178092da9efc0db4d5f17ea727e95c2359af2eddaaf40d8a7ab75f17d7c76c
MD5 64c78b94d5dc810042cbcd4567a56302
SHA1 50b707616b11056f26dc7f49c35eeec56e07c5be
SHA512 f0638fc53b24b16f36aa9eb3e6af6d6ac2659dced9f81c1646edbc9530997986e66f5fcd6adb4b131440dc4441c9ff5d0934cbf52cdf13efd2768344893e5865
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58fe50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fe50.TMP
Size 392B
SHA256 4586eb828451fc45ae9aaef8ec3e0d91c11530e799e2df5789170d0e1425d37b
MD5 37b1adea1036a47303dde4594f5b718c
SHA1 496728193ce4bf097f012ddae5a0aefff285fc25
SHA512 3ca5fcd603496b106097daff4d8a9f06679ed2571b6f5e10c48e0817156015969eac07c4254156b8bd2bae5d8afa4ea076954758e416d6b8e692efae382981c7
MD5 SHA1 SHA512

Submit Download

df0f8cc5-c8f5-4581-a12a-ab6e2332672a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df0f8cc5-c8f5-4581-a12a-ab6e2332672a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fcaa96e17c4f0fc114d96ae01a626276de55e112d48b1bbd9d68f43d1c74e47f
MD5 300776a71d2f85ddbc1a0f8f071db356
SHA1 8392bbe393a086090fd4b94e2e20c9abf92fc663
SHA512 a49eeb65cbdb426e3357f9b605d2d5efc15231227d65d501cba01e4f1bd917aed572fa9f03478b989c3ed88328f468cbfe66dfab27cae0624268e2e404637093
TLSH
T1F0412958A7E91154B3B76E5AABF6A86D447E7D772E07D49E10100E4F0A23B40C972B33
MD5 SHA1 SHA512 TLSH

Submit Download