hxxps://d2xxr104[.]na1[.]hubspotlinks[.]com/Ctc/DO+113/d2xxr104/VX5LBv3dylvXN2B6RGFCWgPKV9TLwZ5Vzw3SMNrWnz3qn9qW7lCdLW6lZ3m4W4zjgrK5WflPnW87FFrd2wp4sdW1gGh3l1pk1lWW5bs2vb6-3607W8c8tYr9dym03W9k8nPp2b3T1RW1rzntb1B1xxwN1Sw4nzcwZwtW1_2ykg95rg00W2TFGV150WtjyW7NzFhc4PkkggW1tDfK58S2z3WW14WGtd4WVYwjW7cklj42cYwQ_W6qkpBD55T1H_W4QXBqY57RgsZN8Klh93YTRDDW2KBpss2hRLYQW14xH1z5X8mRVW5kxZvx6BcjdCW6Qn6T15JLzjxN4j1d5Mr2N8zW6dv8xW86mSW4W8RFfNj3jT4X1f2pZSdd04

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://d2xxr104.na1.hubspotlinks.com/Ctc/DO+113/d2xxr104/VX5LBv3dylvXN2B6RGFCWgPKV9TLwZ5Vzw3SMNrWnz3qn9qW7lCdLW6lZ3m4W4zjgrK5WflPnW87FFrd2wp4sdW1gGh3l1pk1lWW5bs2vb6-3607W8c8tYr9dym03W9k8nPp2b3T1RW1rzntb1B1xxwN1Sw4nzcwZwtW1_2ykg95rg00W2TFGV150WtjyW7NzFhc4PkkggW1tDfK58S2z3WW14WGtd4WVYwjW7cklj42cYwQ_W6qkpBD55T1H_W4QXBqY57RgsZN8Klh93YTRDDW2KBpss2hRLYQW14xH1z5X8mRVW5kxZvx6BcjdCW6Qn6T15JLzjxN4j1d5Mr2N8zW6dv8xW86mSW4W8RFfNj3jT4X1f2pZSdd04
Sample260930-strmsabe52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{7919007C-87DA-4C39-A286-F101D03D4BE8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1988	1248	msedge.exe	86
PID 1248 wrote to memory of 3468	1248	msedge.exe	87
PID 1248 wrote to memory of 3420	1248	msedge.exe	88
PID 1248 wrote to memory of 3420	1248	msedge.exe	88
PID 1248 wrote to memory of 3420	1248	msedge.exe	88
PID 1248 wrote to memory of 4672	1248	msedge.exe	89
PID 1248 wrote to memory of 4672	1248	msedge.exe	89
PID 1248 wrote to memory of 1676	1248	msedge.exe	90
PID 1248 wrote to memory of 1676	1248	msedge.exe	90
PID 1248 wrote to memory of 1676	1248	msedge.exe	90
PID 1248 wrote to memory of 1888	1248	msedge.exe	91
PID 1248 wrote to memory of 1888	1248	msedge.exe	91
PID 1248 wrote to memory of 1888	1248	msedge.exe	91
PID 1248 wrote to memory of 3680	1248	msedge.exe	93
PID 1248 wrote to memory of 3680	1248	msedge.exe	93
PID 1248 wrote to memory of 3680	1248	msedge.exe	93
PID 1248 wrote to memory of 904	1248	msedge.exe	94
PID 1248 wrote to memory of 904	1248	msedge.exe	94
PID 1248 wrote to memory of 904	1248	msedge.exe	94
PID 1248 wrote to memory of 3272	1248	msedge.exe	99
PID 1248 wrote to memory of 3272	1248	msedge.exe	99
PID 1248 wrote to memory of 3140	1248	msedge.exe	100
PID 1248 wrote to memory of 3140	1248	msedge.exe	100
PID 1248 wrote to memory of 4112	1248	msedge.exe	102
PID 1248 wrote to memory of 1984	1248	msedge.exe	106
PID 1248 wrote to memory of 1984	1248	msedge.exe	106
PID 1248 wrote to memory of 1984	1248	msedge.exe	106
PID 1248 wrote to memory of 3356	1248	msedge.exe	110
PID 1248 wrote to memory of 3356	1248	msedge.exe	110
PID 1248 wrote to memory of 3356	1248	msedge.exe	110
PID 1248 wrote to memory of 2800	1248	msedge.exe	114
PID 1248 wrote to memory of 2816	1248	msedge.exe	115
PID 1248 wrote to memory of 4304	1248	msedge.exe	116
PID 1248 wrote to memory of 1096	1248	msedge.exe	118
PID 1248 wrote to memory of 1096	1248	msedge.exe	118
PID 1248 wrote to memory of 1096	1248	msedge.exe	118
PID 1248 wrote to memory of 2816	1248	msedge.exe	126
PID 1248 wrote to memory of 2816	1248	msedge.exe	126
PID 1248 wrote to memory of 3488	1248	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://d2xxr104.na1.hubspotlinks.com/Ctc/DO+113/d2xxr104/VX5LBv3dylvXN2B6RGFCWgPKV9TLwZ5Vzw3SMNrWnz3qn9qW7lCdLW6lZ3m4W4zjgrK5WflPnW87FFrd2wp4sdW1gGh3l1pk1lWW5bs2vb6-3607W8c8tYr9dym03W9k8nPp2b3T1RW1rzntb1B1xxwN1Sw4nzcwZwtW1_2ykg95rg00W2TFGV150WtjyW7NzFhc4PkkggW1tDfK58S2z3WW14WGtd4WVYwjW7cklj42cYwQ_W6qkpBD55T1H_W4QXBqY57RgsZN8Klh93YTRDDW2KBpss2hRLYQW14xH1z5X8mRVW5kxZvx6BcjdCW6Qn6T15JLzjxN4j1d5Mr2N8zW6dv8xW86mSW4W8RFfNj3jT4X1f2pZSdd04
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa4f60c188,0x7ffa4f60c194,0x7ffa4f60c1a0
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,12520551668700694465,18117248039090823761,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,14741033574395273753,1657300868016413188,262144 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,15275903873548128490,824671933574453835,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7699277611647203467,6809142552422466495,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9952498373074131906,1284647259873798683,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,16480273141540031539,17413365781149217319,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11540516031579521676,825276200606271319,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,913896121027433515,3704325379160789470,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,6307730180185262091,13407114002840271132,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3009723111691600499,12470489130777259572,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3009723111691600499,12470489130777259572,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,18042962078494574243,2894575170627082544,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3732,i,3391586865860710255,16550292402385107895,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,17719284236283065093,1340515859083835027,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7778765400160980820,10400121491462873780,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,16815792749740387787,13346381627514884960,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4012,i,16593398841397498548,9198464444777617803,2097152 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,3060953247330555102,2880414592335342527,524288 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5032,i,4726367009012094426,10533085084977935814,262144 --field-trial-handle=2456,i,735281762892893434,4347526560991533005,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 57KB
SHA256 2f37775ec1c033f9fcc7f3f820d15eb874a6835a301d132284c747acc9a670f5
MD5 9bf2b02e4728360834fc2004f36eab7e
SHA1 078bcc09bf62a0bf31077248845e8238cb6d1d40
SHA512 081703154c2e605f3b031ebe1d10d8e0466327e9fca4264ea87c904eac4fa5ba2f522d6389a0f7651cd79ce35d6049e9b942285b73ac82a7f620f6ab5c59548a
SSDEEP 1536:r/F5x/puK7dcFiFKBBI5gtp3qRcfcXskTF8mpFcGB+LClmemcPYiUB:r/PuMc8cI676UOsk/QGiClJQiUB
TLSH
T1B5430281D0093BA79762F5198F8DC554B02CDBF057EF2A43F5D757848289E1E2A248BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 39KB
SHA256 bcf46859aed16f989d94c21ec60f2fb21fb46a6c94b38e46c678269eb6295325
MD5 34b074365b323ad2445b1722de576bf6
SHA1 68e745fab95ecf7426309cf2d1d1afaef3b67641
SHA512 8dd186f1a3a8b3b0e774edcaabfcffbe2556c9b56123a8b1a94bfbe0a4579d40d170b9e399a10159c38959d56afe3dac3e3df45822f9f03470a01968766a41bd
SSDEEP 768:N73XZ3eQfw3m7meO6ehtvEefQoHTbB2WnX/aWBWbavnFdGx1Vg0toJz9:NrZ3Nw23AhtXoaTbB2WnXS82wdGG0tof
TLSH
T17603F18CC38AFFF4D4506E7E337B4B025459A21F1D05F9B71A9CD42D51C312AAA68E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 24KB
SHA256 d766bbed17845d6b7b3dc83b693901ea938049d53bda982b3f3192d38d0aef2b
MD5 06b593ac4d08ded270b53aa5d6ef84ad
SHA1 5fe7143b92b4ee9a265ee60e8cc9fe57d5ee6531
SHA512 db53127e5580b7c2e154c05cdf5ce9ea2cd5b8498dde9bc56c51d44c635baa8f4797bddc2b4a07188de38a5d1c34d8ffee0e334e9d82dcbaeaa7d35559c6cc32
SSDEEP 384:ua8mnnur+4v6YzmhEND8nyvKBDV7ZWb4BFVoY9EOqP4FWbz3VH/enbrzcC:p8mur/vsEN4WoDRZWOzHEvMwzhQb/cC
TLSH
T190B2011A464C535DADE375EEF8032CA21F859ACF2CD4E218D636A2878D9DAC20DC37D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 aa8772ec25f534ba64f009048fc1f238c1c058cad79f220df6ea7a4f453f2dba
MD5 36e405eaa441ac153b7cd4eaebf4378e
SHA1 4ca0bf22a309563e38a28084c5210d1584a3f72c
SHA512 223ef937283acaca2235da79f297f4bb5f58f227ac1034bb4aa3399b562d745a50e6022189cf939478866d42d27e7589eee67e8782b8445227e9700f001b86f6
SSDEEP 96:pedZ5LbV9OZYCO5YWpFFaU++NHNpkjeyT3+z7kh0bOgwYvikC:UTvsY93vkjeyT3+z7kh03E
TLSH
T1FBB17441E1DAC184FF801BB2D5C6186F7A74A28C94873F43BE57E4BA7E223B1512A7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b5647c51082c9f9e9bde6e9e7d522a1ab0435f3aef60413154a75b5a286ecfe5
MD5 873ba6c0665f05197743dd588803527e
SHA1 e48e2c65a5e514d2dc5f77bce02e11d3ee21e78a
SHA512 f76da33bf6a254d1c2756c638174e92cb4c9c079fb53102e32fc080f02a164811c6547cfad0a9b02520e8aaa2f518c1381c65e21216014663194263f4f844a41
SSDEEP 96:AWetLLhNK+jWct8rNZee3843S+a0TglQ1imV:A1tz9Yee3843S+a0tB
TLSH
T1FF919386E6E4C184FF941AB1D1C7196FBAB5A58C54C36F833E90F0B87E263B0814B754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 2feb53c7e8c470c113ec911e9565314e3f582e91b1ba672799f3c0baf30939b2
MD5 7e48ed08a220b623285dc49c29f8bde9
SHA1 83413ae1dc0fb2564090ec6e587692e612bbb131
SHA512 211f0f1ea619d43c6cc9d8e7c8a878a37c4ee2a0128397c2dcb711107e8f6470eee1b46b7847070ac154eeb45e4370bb77faa05d6e51ad6b8ecec549674aae59
SSDEEP 384:Dxza9Zgi9qnaRBezEQamIgQb6QCYeLQ4QV1LHoDfuAFi75UdCAlj0RaIV6X6ctul:uIyTl
TLSH
T16252C0E383E6852EDA111AF09A68BE17CF5D1514431C3D79C8ECBE86A7E2431E22175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2abb9f262cba1f2e8a565446ea9adb56c75896f1bf54989b7f891005160a8977
MD5 a3f9ce519e61034d2ef54822754a5e11
SHA1 530b4c9c263c4c505affaf8b35723f5df8d09916
SHA512 d31cb84664275b1db54ab388e62622258ab0ea7a8b0d8ea3099a9b650f1a7581a084705ad4e73363a986a50c38ff37832fa4e03294fcd738e82e0ea1483f2159
SSDEEP 192:sxZ9RkWd/fDsy1mvIdpk3LHW6+WNNuTo/YgVcFeIgrJ:sxZ9Zd/fDsy1mAiHbT/g89
TLSH
T17D22A6526E68A97B8CC7D21DFA15BB13D2F9503291D51E98EAFC861C04E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 14ff8509682196806e786f0d20938568c528d2bf5bad203c2be518974b4b0bf2
MD5 53fdac1e33b25b6e88bcb10b1c6725ba
SHA1 ebd6e65db49c00c988c7925787498f84ecd93642
SHA512 eb07f5cadddc4d8d5ab3c5d3508cdcacb6078f82fe4af61693fe0e794139e08f545cf0ade0f45683decaf7baf1523a35f4dcbb83c16d83937bb159d5425e4c91
SSDEEP 192:sxZ9RkWd/fDsO1msIdpk3LHW6+WNNuTo/YgVcFeIg5VJ:sxZ9Zd/fDsO1m1iHbT/g8N
TLSH
T17C22B6566E78A97F8CC7D20DFA15BB13D2F9503291D51E98AAFC861C04E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 acabca80b507c48b4c00b68c2372b1cdb4397d82af6285c62a394700fa0f294c
MD5 8efbe17522dc695556083a4ba7bde8d3
SHA1 44f20d33a091ca67435ce6085b47f9db4a681210
SHA512 e3dfda5229e5354587f3388459126a251a940ffc3b474140691528b8750143772e2cbbcdcfcc2e81896c860fabe7090f47a13b511002ec39e184a16a8f5cca57
SSDEEP 192:sxZ9RkWd/fDsO0mZIdpk3WHW6+WNNuToeZN4/YgTcFeIg5/J:sxZ9Zd/fDsO0myXHbTS4/K8D
TLSH
T1B532B8526E74A97BCCC7D20DFA15BB13E2F9502291D51E98AAFC861C04E67DE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f346d8b19769900b9670602f685386a32d2a74b3a7efd5fc03350936d4a725cc
MD5 109b677e20b91d6a7b4a841783213637
SHA1 89447ad837ffb78c0faad08d809859af5ec7da5b
SHA512 de35cc8894fe544f5b21b567f10671e3fc96612f8f8408cc72e5ae244eaa54eb4008522f01632636d4f8c4c2529d535d5c4c7a834c3da0de58e5a00c92d933c8
SSDEEP 192:sxZ9RkWd/fDsO0mZIdpq3WHW6+WNNuToe9qJYgdcFeIg5/J:sxZ9Zd/fDsO0myVHbTpJU8D
TLSH
T18E32A7526A74697BCCD6D20DFA15BF13D2F9603291D11E88AAFC8A1C04E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a8a2363a6518caed87bacf37d3b85d7c7d5b3a70e71cfd29fe43b422645d4459
MD5 5b037609a932d4b969253c2f66428906
SHA1 5e9d0b785dd798523389a1be8fb5b121e265b4d5
SHA512 296a9e58008baad1bff5c69749c0e49bd96ddff950b2e6fcdb8053e083d0f66dd70649852c40d746e2090a1be1d4dc0e17467a1989dc5316522e3b9485bcec3f
SSDEEP 768:fQichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzwroZqH:fQichfPWvPZplu1jan+LKgzbYH
TLSH
T11BC2F93B644CCA7E4FC01E9DDD1A6F9B7E9802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 52cab90293031aac8692c4c33e4037c775e3a13118bb09cab6d23299ff7166fa
MD5 36ced009c309ffb360b4e423ece4ddae
SHA1 dc3288ccd4bc8956094b1c405748e731ac1d501b
SHA512 5e6c689bacbb3e80cde3ae39fa5645e2fd13cb9fe64fc9b2c4ca9376862da7ac591304d8c6ca477fe700ff2bf24ff3a6cd9138a683b52392cf21a3b722e47dd6
SSDEEP 48:K00DCOcey7bCxKISm7K9C1Q7x0rYZ6SIyLZo1JTXrEbXyvIShEK9h1LExpUYSTP7:KoLWKQsSKeoKDiQMYKpqCuz
TLSH
T1F891DF51327B52457C7D298991A5961E024171F3706CEABBFFB824B64B2BE084CFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597b60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597b60.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c17fdc1e8facb68aa03a9be1c19be34c515c959db845aee20c5b53aafaad0d1c
MD5 208caeb7ef4444ad84bd6bd9c08fb55d
SHA1 fb320a2942ce59f073da4ff2e94a4e8bf41da1c5
SHA512 b90d318124482907dbcabc377c691b74ea0a74e9a76d5252045ffc505d3350faa750c9e77f0e3d8a860d70572c53dca4ab34af1d7d29d6d9e46e16fbda70a5b4
SSDEEP 384:oZcIhsNkU5eg5dE/4BGYX5EWS4It18UZGtgOIwZOyrSoi:WhhgE/iGYuWXIt6UZGXs71
TLSH
T184828D7298B8AC7B5CE7A145F58B36038FB8802BE7C87BD494ED5B1C01DA199030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9fff452c073f2e0e880d9c4c5b17227a25f2b7031596f4f611ca94aa131b6c34
MD5 39d3c343a8afa358e37636c5836287c7
SHA1 ba2600fb935e0ffed49da82fe27400976f7da766
SHA512 4ee15a3146ee67ddab2ac6d5fd4893802a607966de88bda8e4c3753494bb2a569f48a084a8df3867eb34b4c3a1a9d4d513f8131289b2dedba31f33265564a45a
SSDEEP 384:4iFiZcIozsNkc8TUNTUlIlkeg5dh/4BGYX5EWS4It18UXGtgOIwZOyrSoi:DFQUhcwgsh/iGYuWXIt6UXGXs71
TLSH
T196C22AF248E7887ADDAE5743A77D2D028EBCC017B584AA94B7D84A1CCC961BFC306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9743ca9467458df5ea2cf79302189670972ce654efbb02adae85be1b50e006a3
MD5 9c8708108d3c92b8b29b936cb1b644e6
SHA1 40f6c0747d2555f7c6c22cbaec26a44669f17328
SHA512 71cf94d0822e48f9de061d85e6a5ccbcfe697c9f56b699a2fac598ad01e63301ca12c85e5de200b5ad09d3a6cb62bf41b16d9563508dcb1ed8e2321e6a36b8da
SSDEEP 384:EZcIhsNkUkeg5dE/4BGYX5EWS4It18UZGtgOIwZOyrSoi:ihh/E/iGYuWXIt6UZGXs71
TLSH
T181828C7298B8AC7B5CE7A145F58B36038FB8902BE7C87F9495ED5B1C00DA199130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e10db239bd77c7d45d42125fb236562da73e773567516714a95ce4ae5ea29a7
MD5 8b59ad53b2046632800dd0b688aecadc
SHA1 5057aae6f086d06ee776aad2f8aeeec43853117a
SHA512 b12bec0a58b1203d1cb2e076b65f8900733b6c6ff9d1c77f3af10a5cb3b27d519a4c05e7b1582ac0ea448605876eb708f745c04e00f2527e860c009364e7eb03
SSDEEP 192:LJONg6DphmqQmiUyzOq8wGYX59eznCS3oInkk7ahLqbU6:lONg619ZRwGYX5EWS4IPQqbU6
TLSH
T1A802EA39E8BC7C7B8EE36E45F58736175F98112BAA942F84D6E81A1C00D768C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 241d5bfc0fee2f82a9820081877555273076710c994d91f60d551be1e38816f8
MD5 69e97f36671987f6d20da0ba8c56c2bd
SHA1 3dec368806669fedfd863d74d81432c0660bcb56
SHA512 fab2d09b1ac2ad9cb1aef23541d080ccf0abc961aa263cc17716eec108d8db9ea00a4be9943c7e833dca28e952ced7d48c7b68af30759bed8a10a48418815af1
SSDEEP 192:LJONAh6Dph4qQmiUy+O1GwGYX59eznCS3oIt18UYkIIagq5jU6:lONAh61LagwGYX5EWS4It18UhGU6
TLSH
T1EF122B35E8B8AC3B4DD3A551F48735134EE4422BEB887F94D5EC1A1C01DF69C130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0df193288160578f281f2c3282e72fde0c6e098b0a32999cb87bd918f66b2be3
MD5 57429878e55b562fcf4fe79bba63b29d
SHA1 5b17bc1ca072cd83bbac072e6022cc7505db2d2e
SHA512 973743413e37840a11d0bfafc1bdccd00e14f5eb5ffd0fa48316cce91de9c0fb877cc5fafe4749bd55536542bf686299e242709da220f58d03b085f1f3403b00
TLSH
T16041F65CBAF91148B3B76E56ABF6A8AD447F78372F0BD46D10110D4E0663A40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download