hxxps://t[.]me/dsns_telegram/76228?embed=1

Analysis

max time kernel
898s
max time network
730s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.me/dsns_telegram/76228?embed=1
Sample260930-g65vdsvakf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{FA3AEAA0-5073-4A99-93BF-F8023DA9856D}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3300	3284	msedge.exe	83
PID 3284 wrote to memory of 1648	3284	msedge.exe	84
PID 3284 wrote to memory of 3584	3284	msedge.exe	85
PID 3284 wrote to memory of 3584	3284	msedge.exe	85
PID 3284 wrote to memory of 3584	3284	msedge.exe	85
PID 3284 wrote to memory of 952	3284	msedge.exe	86
PID 3284 wrote to memory of 952	3284	msedge.exe	86
PID 3284 wrote to memory of 4848	3284	msedge.exe	89
PID 3284 wrote to memory of 4848	3284	msedge.exe	89
PID 3284 wrote to memory of 4848	3284	msedge.exe	89
PID 3284 wrote to memory of 4732	3284	msedge.exe	90
PID 3284 wrote to memory of 4732	3284	msedge.exe	90
PID 3284 wrote to memory of 4732	3284	msedge.exe	90
PID 3284 wrote to memory of 224	3284	msedge.exe	91
PID 3284 wrote to memory of 220	3284	msedge.exe	92
PID 3284 wrote to memory of 2396	3284	msedge.exe	93
PID 3284 wrote to memory of 224	3284	msedge.exe	91
PID 3284 wrote to memory of 224	3284	msedge.exe	91
PID 3284 wrote to memory of 220	3284	msedge.exe	92
PID 3284 wrote to memory of 220	3284	msedge.exe	92
PID 3284 wrote to memory of 1488	3284	msedge.exe	94
PID 3284 wrote to memory of 2396	3284	msedge.exe	93
PID 3284 wrote to memory of 2396	3284	msedge.exe	93
PID 3284 wrote to memory of 1488	3284	msedge.exe	94
PID 3284 wrote to memory of 1488	3284	msedge.exe	94
PID 3284 wrote to memory of 4984	3284	msedge.exe	97
PID 3284 wrote to memory of 4564	3284	msedge.exe	96
PID 3284 wrote to memory of 4984	3284	msedge.exe	97
PID 3284 wrote to memory of 4564	3284	msedge.exe	96
PID 3284 wrote to memory of 3364	3284	msedge.exe	99
PID 3284 wrote to memory of 1328	3284	msedge.exe	100
PID 3364 wrote to memory of 5072	3364	msedge.exe	101
PID 3284 wrote to memory of 1080	3284	msedge.exe	102
PID 3284 wrote to memory of 3168	3284	msedge.exe	103
PID 3284 wrote to memory of 4960	3284	msedge.exe	104
PID 3284 wrote to memory of 1660	3284	msedge.exe	105
PID 3284 wrote to memory of 1660	3284	msedge.exe	105
PID 3284 wrote to memory of 4552	3284	msedge.exe	107
PID 3284 wrote to memory of 4560	3284	msedge.exe	108
PID 3284 wrote to memory of 4560	3284	msedge.exe	108
PID 3284 wrote to memory of 4812	3284	msedge.exe	109
PID 3284 wrote to memory of 4812	3284	msedge.exe	109
PID 3284 wrote to memory of 4476	3284	msedge.exe	110
PID 3284 wrote to memory of 4476	3284	msedge.exe	110
PID 3284 wrote to memory of 1116	3284	msedge.exe	111
PID 3284 wrote to memory of 1116	3284	msedge.exe	111
PID 3284 wrote to memory of 4036	3284	msedge.exe	112
PID 3284 wrote to memory of 4036	3284	msedge.exe	112
PID 3284 wrote to memory of 4740	3284	msedge.exe	113
PID 3284 wrote to memory of 4740	3284	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.me/dsns_telegram/76228?embed=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffb235cc188,0x7ffb235cc194,0x7ffb235cc1a0
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,13435687093350105723,8371877285835802185,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,6219674064225511364,2209302936022996710,262144 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,9592229112400820744,17587926986604067342,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,261253948320650847,5657265539487304837,2097152 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11015984484408143727,7302787524883981493,2097152 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,6678760503990019864,16388411309843918711,2097152 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,3941070435774227138,3590268183078188507,2097152 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,797508800744421775,7578366303727887889,2097152 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4340,i,11381472718302939574,14964710730044757883,2097152 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:9
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,8903787564070946310,11469447424127464384,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,6230231505269091503,4340704340426116120,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,2572890871574321787,12538013795416632284,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,18423391826522444005,266838470175735974,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,2572890871574321787,12538013795416632284,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,8471272977365869657,12785745074350605315,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,4175693210610566604,12014344614511840802,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,2507454150644742775,10985222361543552451,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,13939801193766435358,18331745408025430527,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,4414039437156503121,2686423587363567940,262144 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12100047945036454936,10149337288028704843,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17142496952418453049,14543110265046022308,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,792240722361646909,2677029940934380474,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13362955487018669152,6742276374029101238,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,3540490252667712464,5499550876503034913,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,13211412118650580838,12118395910395776609,524288 --field-trial-handle=2192,i,8602654871381248624,10486311742432864666,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
  2⤵
  PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0714e6f61cb4ee87df081093ea45647348bd6b088c2ac1e6188d495c78e99d7e
MD5 2fe08827a42341294e10b9edd0b51268
SHA1 9825b24ae78e2cde9480297e7e4013d6c0959b16
SHA512 7a0465cafbdfbb547a5cef98322581d1e80a528dd4189337fb6b5b13ed414e2f42b21bf71aa7a23f7a751b405de9800d7ecb96c64b25f954ebb7a1f0780507ac
TLSH
T19CD0112AFA222E02E000E232802ABA82020080828C8208088A800222A8C2802882B22A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4da83f7c2db56b3b267d8673cd329c9ebe11518ed1355fee48e02e2eb7dc667
MD5 da5bf6bf079a2d0b72f1ba828bb869c4
SHA1 c5b477ca5fa0737bc5ec1d3971d7c5864a969233
SHA512 4bb0cdef8b5998fe4d7dca2c5da777f9d5541df6ec2a269e22d862e25cb11ad1dd6794d959246e60431138d67653ebeed6d6a8ad98885459f62f51a91e4f6048
TLSH
T17CD0222EFB232E02F800E332803CFB830200C0C3CC830A088E800222E8C38028C2B32F
MD5 SHA1 SHA512 TLSH

Submit Download

54bcbb90-0706-4682-9103-5f520668f71b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54bcbb90-0706-4682-9103-5f520668f71b.tmp
Size 28KB
SHA256 5dc2d7936b727a7417b0feb39d3496e07fcb55415a56112fd4f58798a4997e51
MD5 fb2b00a7434bce59e0976be4204977ca
SHA1 39fbf1a913e15cb5c8bdb2c3a0b5f137ca46400b
SHA512 954db086cade8139215b4724e5b04dfc99a0f9e50dd78bb3098c2326ceb3e22c4af93221dc8a9ac408ba257f1741df81d45298ef26776a1fe0484210c7f99646
SSDEEP 768:iulTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80fddroRp:iulTj8Gr2ymWRm+KQECu1jaKMxLpCNfG
TLSH
T164D20A2F640CCB7E4FC00A9DDD566F976EA802C7A6688D4047FE984C03D77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 325B
SHA256 f245e979c6816ab9c619663e88ddf857ff67ca1aaa308836b2442d803694f9fa
MD5 12f8161212fb4b17dff4ad207bdc46b8
SHA1 7f5441065fb48cdc01903a67fa4ce002c3dca884
SHA512 9df88b47d4175ee1bf3eeca585d7c3c861867a9a39abf9efa24ea6d3cb6b8e4a46bacdc8e2185c84d81a2f5f12eac60849d45a6052e1bbcb511ea49b3ef6c3ef
TLSH
T11BE07DA4C7CAC32EF3486447416C574CC3803B2AD2CC6F9B170487897182040F2E67D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ddd25146be3a5cfca399008d8e64591b632b859cebff9a112ac79e7e964ccb39
MD5 764714756ccec49598f3520cfe1e4873
SHA1 db7c8cd2cb19cb646fb412b5c6eca303c098b3ea
SHA512 b88d9edd6d1b7b72a01c8987bef9b550620744bd2807dbd69628958ac7ffafe68426b73a44a6cd0359ff8f67c6cec59e8be7003603efa45ce9fb1f327e2610da
TLSH
T1A2E020F585C9C25DD14474874158571CD2813B0AA2CC7E5E1B04C58D7109044F2917D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 aca09c988fd36500f7f1bcdb1416540c75ad81e4e15c2350c65854446620f01c
MD5 771ca98d0c6f00dfdc9626dc68cbf544
SHA1 21ed54254fee4e063991cf8afc64d521b9b72cee
SHA512 a15e142b9a48f70685a117463e668ace2c16bbadfc828c8ccdd6b2778abac733a16725756cda448c61076aa91fcbd61e6b3d81b7e36832284ddec87445e14024
TLSH
T17CE02094C7CCCE1DD2446567456C9F0DC3903B1E92CCAE17170095497142090F2D9BD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 43906a4ab9e907c1876ca4203164dd555f24b77ffd265254c64bc29f71be5be5
MD5 c5cba96b42955bbcb7cf7edd7e80d295
SHA1 3dd349f485f6302c92af556b805d7a22364249b0
SHA512 0ef2ce26f59e6187e31713524adaa820fe298d2bc2d4e62d9016ff87ec49085c90cc8ddb2928df03d985f70708ce889f7fa7a49daf03596d0044d095ed493c78
TLSH
T1B2517F80B1B754E4DBACC1FE83D419D73D3750B0BE83AE522794FBBA5A0AF05A0E4048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ccc1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ccc1.TMP
Size 2KB
SHA256 c61b2fa9646529066b7a1f6a963a844a3a0c86eb16638f9c61a3654b389fb3d4
MD5 a91e3b1cd4b136da38c22550b2f5b13a
SHA1 b48212618b83f2624e972cf9d053e1ab3cfbb7d6
SHA512 7ce11017230e4d21ae09846190a786d20660ba145da30fde3e390f5fe183fc9f955100873a4354a9cd41eb58e81c85488cb04145d7ba197c30dc38a32031791e
TLSH
T1FE516D80B17354E4DBACC1FE83D41AD73D3750B0BE83ED522794F7BA8A0AF01A1A4088
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9fa3e13097162dca1e2d6986c326ec7b886187505175dbcae0c046fb8f724d68
MD5 2df45d5b6e023b1ee5f853b3c16ba560
SHA1 c5b55b53fc18551a1e9a1666805ab3747b27090f
SHA512 3c65043ab6419c8d1c7d6fbecfd5a922aa5b00f1345fc9b80a8fe55b18aa04533d9c9f59944e65a942a4f06cc0a252695ab51eebfeda31099d0c901e414f1015
TLSH
T19C31C0F783B1566EDE1256F0AA14AE2BCE5C0416431C3C5A89D0BF5793F3071E101E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 90c04aac31069f528a6a4b04718972bba62799eb6f45a511ec0aaf625e9361d5
MD5 b9addf412a0a81a9ebcf7d3876e2fc11
SHA1 53e01b5a308ba0b221ef1a19b4a04a34ce81b891
SHA512 b811cfd9d705cb75c98e2b04eb0e3cb84ba897b92a106a55ada0a47e5684ed7b0b6f151a6212dff2782afc2b50c2da1a2945dd08692174359d043af72abc5285
TLSH
T15221A0F787E1566EC90256F06A24AE2BCE5D0517431C3C1A89D4BF27D3F3475E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 43de6c2666c9da1d1f3cfd867a24edac8e897b5f7febbea3a3d70f0afc85a9a9
MD5 2bf59b4c58f2ff2ecb1ff99ed16d4169
SHA1 f6ab7ab4caf9c78761ad4dd19c6689a9a0c7a7ce
SHA512 43505d0f9499dbdb4d10547c8d727a3b1ec94c8c251c99b579c3e84a46cdfa5eb9eef9f8a6397e6453ef9709e0636c4f1807eaf2df508fd309aefd7c0ea37b36
SSDEEP 192:sxZGRlbi/f3sE97OfIdpCS/W6+WNcCO/Y0C/T9SIgrJ:sxZGji/f3sE97Bd/bs/5sk9
TLSH
T11B22C8566E68697B8CC7D21ABB19FF13E6F9103291915E88E6FC861C04E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b547fed5db156c90a279bb297c7045b5bac27595effbf39d24d03522fdc020a3
MD5 44895763c4633be80c8c4cf934dc545a
SHA1 d9256829218b6e11bd1aeb39174e2484fd9a22b8
SHA512 39e9df26708ba6b821daa06bd7dcf91b426f5d95913f710e5871062a9cbb42870dcb8c734234a3c6eeb7caab417494c8062b1a461511769fd7976fdcc8393b85
SSDEEP 192:sxZGRlbi/f3sC97OfIdpCS/W6+WNcCO/Y0CDT9SIg5hJ:sxZGji/f3sC97Bd/bs/5qkB
TLSH
T12422D9166E68697B8CC7D21ABB19FF13E6F9103291911E88E6FC861C05E77DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b66c18ca7b4bb4b1234b04a951bfc3f61a77251ea04fc9dcee1e835a9bb8140e
MD5 94641b80ce576a208f481dc13376726b
SHA1 e19e119194203d6ae26128d62f7144e5dd8f5615
SHA512 ead38cb823ae73a19d48f801ab024548d36de52dfff2b470b24132fb3287eb9acde6913e99ab277de7fd01c9f77c041a77f8185412310febb502793749cd25d3
SSDEEP 192:sxZGRlbi/f3sm97OfIdpCS/W6+WNcCO/Y0CJjT9SIg5bJ:sxZGji/f3sm97Bd/bs/5ykn
TLSH
T13E22E9166E68697B8CC7E21ABB15FF13E6F9503291911E88A7FC861C05E7BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bdb1ae73c60cfc90ff162bd4dd9c28c04dac0ad7676d0514a862771cea5e672d
MD5 b0d928e022a871ac727b98659d5f77f1
SHA1 3cc9c703aa3dd813df906b9c5500383f312971c6
SHA512 b5bc3ead33799ffaf061b17e5b82dbdb116cc957dac0e2735cf3e07844f923d1d1b5e096153694f4381852e134c04b379099b7473577be7c7c8eb11e02c06e8f
SSDEEP 192:sxZGRlbi/f3sm97OfIdpwS/W6+WNcCO/Y0CJIT9SIg5bJ:sxZGji/f3sm97Bv/bs/5hkn
TLSH
T1FF22E8166E68697B8CC7E21ABA15FF13E6F9503291911E88A7FC861C05E7BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 b1d0427e3560435dc515d1cf4466d4126bf85b3ec4295272190471b44d30a04b
MD5 e24b8d78a72010d9b0c215f1782f536a
SHA1 8ec6f5355a23f773715691593065807dcc40b8ac
SHA512 c1a6c0b21b523edd9c9060035bc4f4bd42ac75970987c96a93878da236c1919edc386c8a7de61dc3022bcf0dbcca4e01958b8146a9b0f9e80bc7c8594773224b
SSDEEP 384:sxZGji/f3sy66s8qMpRiYnazAW8pZS15posJWeT+o97Bv/bs/5hHn:sOji/fD4Mnc7WeT+Ux/bO5hH
TLSH
T105B20705A914C87B9FC3AD19643DBE33E9EC50621285CEDE16ECCA1C019E1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cb68c1b84cf6a810f78a48d33905dbfd141c34350629f86042f6ac03ee11c8e3
MD5 89e094e37705213d031ca774527afc4e
SHA1 daedb9b76871dde079d18c9c78e79695ac9b289f
SHA512 1baaa281ac69f408f1b21f88f0db26c38a97997a0bb964789e755330a528e528c1a25045f564c482b856da95952d64c8fdb300d9a43ac4dae29b78e37ba11d52
TLSH
T1DBE0C0F73DE72C80FC6FC3C710B1A4A1018179588204BC8E205952F350F2305342AC72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 94fc8d09a123362a92486c85a02a2716b5879e7efe1a19ed0b40ae7a5ff87623
MD5 360bd0b180eeca828179680791e9c756
SHA1 48de00f62a0aac6ccf96c92fdab1da8ada54747a
SHA512 1c26482fb4427832da30b6051122a9840df6fde8d52b4532e45dcfe67e19f1bffcc8be4e4b7feab188225d26ce923cde507f7d490bbf3cca38be4387b4ef42b9
TLSH
T14E810F113176134139FD290899E986BF038132677018EE7E7F7914A68F6AE098DBECC9
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 bf3090b542a0ecf4dc2ae547dc23b04242938aae1fe50544a1135677a68e8abb
MD5 fbd17a1f66c1ed3e72722037ebf195dc
SHA1 5225955ad3ce398ecd1f3195e9898e1015cbd40c
SHA512 42f8795be151c8d5b8f5f6c25befffd1832be8f3f5dc3a65f936d3b724717db2409151f09ee51943c81810119a7168d898754f6090f2a2ca46014e5611638ef1
TLSH
T18B115090B2EA32D66F89A841C21D64AB50A13F16211D9D72332E80F81F8881ECE2FD20
MD5 SHA1 SHA512 TLSH

Submit Download

5b2997be-41be-442c-85de-63a5939f08e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5b2997be-41be-442c-85de-63a5939f08e6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3d921c9abfc779554d8ef01117f9f28af5aece548b778d4b572373e90fa3139f
MD5 60d0444d6db58a47cbc390163c567da8
SHA1 f4c87a501ef7edc28adbdea7d914657e3b4bfd7b
SHA512 44aa918528690c997708ea6923697a0065c508c7bfcde525abbab3c49b1200a1a05c886e13fb4752c1953ff8d6fb0facba9b1ccfcfeec9cff3da171c19d7ef1c
SSDEEP 384:pZcIo8NdUi0C6MDv5SIbmYo8ktgOIwZOyILHoR:hoHqbC0kXsXr6
TLSH
T110828D3698B86C7A5DF7D545F48B76035FB8812BD7C96B8494EC6B1C04EB6D8030BE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a2fe20a18fe76e6905d269cce29dc3032dac76855fe3f7d42f16759258c85602
MD5 6b94c625687ab18c7ce3bf4a6f29167c
SHA1 f6d3d098f1f26d8f1a83f65e94d2760cced44249
SHA512 ac8543b0ea070b3320e87949fac96972d367e5a218ff93bb25f753655ea473499c88125cd66b7b0919aad9f44c0b6d1fdbc33dc637cfbea8ceec11df3312b153
SSDEEP 384:FtiFAZcIU8Nn8TUNTUlIl3i0C6M4v5SIbmYoCktgOIwZOyILHoR:FkF+USwgBVbCakXsXr6
TLSH
T1D5C229F248E7487AD9AE8B47B77D2E034EBCC127B585A694B398560CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3f087a996fa8ebe041cb8ab95d686af4211e85ec18dc875be82f2c2bbfb26b52
MD5 f5c9f8cfd90e7ac53e48db2615011d3f
SHA1 f963f61484af38e7b2ff0a3e227664a1f9c10feb
SHA512 d19dbb40e6342cd10263050010e4d19d89a5d477a78fad1924489b4f239a216c551f45cba69d2e5671cb011668a579fedb0772994c2865001426febad7e480fd
SSDEEP 384:1ZcIo8Ndwi0C6MDv5SIbmYo8ktgOIwZOyILHoR:NoXqbC0kXsXr6
TLSH
T109828D369CB86C7A5DF7D545B48B76035FB8812BD7C96B8494EC6B1C04EB2D8030BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ade457ee004ecf1ab1077ed031835adf65bd61624865975b1d803d7e32c90a7
MD5 cf6e8cbe930d77356cb0b6b6dc09673a
SHA1 0a3047e1c86e209a44446cf7bee6f05d239c28af
SHA512 e05b6b928ba2cb425a40bb580e3098159cfea3799a648e92b75617220a50f26ce97bba6dd3166a570e8979977f98bcaf64045d884faf84deea341cd716635c41
SSDEEP 192:9GNS6UbxQmiUyoJpV+W9XPaIhcQr5XeU6:9GNS6IPPJD+kSI7uU6
TLSH
T15C02E738A8B83C7B9EF3EE05B48736135FA5112BDA952F84CAE81A1C40D768C1307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3dd5f86839e4ec8c58e903a61ba8b7cbc223b3d9d23b52fc12a6110e3697504a
MD5 e7ea10f426e41679d180d5479484c85f
SHA1 fa725e7e294dcef97799310aa43a29c69abf5574
SHA512 253d46311e64f96472b5e31892be96e7e7d6cdba7377b11908c614b78e67ee35d35f7ffb960cf474916f62acea0d0e95699f1811c7b9a075578c04a7ef0a12d5
SSDEEP 192:9GNQ6UbGQmiUyrVtW9XPaIhcUAPbPwoTPKmqYU6:9GNQ6Ii0tkSIbmYoWkU6
TLSH
T1A1121B35A8B87C6B5EE3D955B48735035EB5422BDBC97F84D5EC2A1C04EF29C130B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5e3d5b4c5f9ffd0a7198474c36a4c79cfb2be6069d928b9ee8609e900b4f55e4
MD5 81918a7de11e41eac38355888ee69f85
SHA1 77e8a72c7235be5a675a091ac715078bdb20c74f
SHA512 53ed75c339ae59c8c724907dd9031ddf2f539b9409cd3a17881c67538bb53cb296692e71afb78bcdad654aa02ac679be9a14940c165eceb955ca4ff57833cba2
SSDEEP 384:fZcIo8Nd3i0C6MDv5SIbmYo8ktgOIwZOyILHoR:3oiqbC0kXsXr6
TLSH
T124828D3698B86C7A5DF7D445B48A76035FB4812BD7C96F8494EC6B1C04EB6D8030BE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46ef2f08-7547-4939-9b98-b6ad2bd244af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46ef2f08-7547-4939-9b98-b6ad2bd244af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download