hxxp://keytool[.]cfd

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
899s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
22/06/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://keytool.cfd
Sample260622-sdaz4ady3v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266144794438571"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{F12A19D9-A430-4F44-AB53-A9E30C4B5C6B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4264	1996	msedge.exe	85
PID 1996 wrote to memory of 2708	1996	msedge.exe	86
PID 1996 wrote to memory of 2944	1996	msedge.exe	87
PID 1996 wrote to memory of 4840	1996	msedge.exe	88
PID 1996 wrote to memory of 2944	1996	msedge.exe	87
PID 1996 wrote to memory of 2944	1996	msedge.exe	87
PID 1996 wrote to memory of 4840	1996	msedge.exe	88
PID 1996 wrote to memory of 5116	1996	msedge.exe	89
PID 1996 wrote to memory of 5116	1996	msedge.exe	89
PID 1996 wrote to memory of 5116	1996	msedge.exe	89
PID 1996 wrote to memory of 2224	1996	msedge.exe	90
PID 1996 wrote to memory of 2224	1996	msedge.exe	90
PID 1996 wrote to memory of 2224	1996	msedge.exe	90
PID 1996 wrote to memory of 4232	1996	msedge.exe	91
PID 1996 wrote to memory of 4232	1996	msedge.exe	91
PID 1996 wrote to memory of 1076	1996	msedge.exe	92
PID 1996 wrote to memory of 4232	1996	msedge.exe	91
PID 1996 wrote to memory of 1076	1996	msedge.exe	92
PID 1996 wrote to memory of 1076	1996	msedge.exe	92
PID 1996 wrote to memory of 3740	1996	msedge.exe	96
PID 1996 wrote to memory of 3740	1996	msedge.exe	96
PID 1996 wrote to memory of 3740	1996	msedge.exe	96
PID 1996 wrote to memory of 4536	1996	msedge.exe	100
PID 1996 wrote to memory of 4536	1996	msedge.exe	100
PID 1996 wrote to memory of 4536	1996	msedge.exe	100
PID 1996 wrote to memory of 2548	1996	msedge.exe	101
PID 1996 wrote to memory of 3108	1996	msedge.exe	102
PID 1996 wrote to memory of 2548	1996	msedge.exe	101
PID 1996 wrote to memory of 3108	1996	msedge.exe	102
PID 1996 wrote to memory of 3220	1996	msedge.exe	104
PID 1996 wrote to memory of 4228	1996	msedge.exe	106
PID 1996 wrote to memory of 4228	1996	msedge.exe	106
PID 1996 wrote to memory of 4228	1996	msedge.exe	106
PID 1996 wrote to memory of 1172	1996	msedge.exe	117
PID 1996 wrote to memory of 3864	1996	msedge.exe	118
PID 1996 wrote to memory of 5008	1996	msedge.exe	119
PID 1996 wrote to memory of 4352	1996	msedge.exe	121
PID 1996 wrote to memory of 4352	1996	msedge.exe	121
PID 1996 wrote to memory of 4352	1996	msedge.exe	121
PID 1996 wrote to memory of 2376	1996	msedge.exe	122
PID 1996 wrote to memory of 2376	1996	msedge.exe	122
PID 1996 wrote to memory of 1780	1996	msedge.exe	123
PID 1996 wrote to memory of 1780	1996	msedge.exe	123
PID 1996 wrote to memory of 1780	1996	msedge.exe	123
PID 1996 wrote to memory of 5084	1996	msedge.exe	124
PID 1996 wrote to memory of 1388	1996	msedge.exe	125
PID 1996 wrote to memory of 1388	1996	msedge.exe	125
PID 1996 wrote to memory of 2168	1996	msedge.exe	126
PID 1996 wrote to memory of 2168	1996	msedge.exe	126
PID 1996 wrote to memory of 4324	1996	msedge.exe	127
PID 1996 wrote to memory of 4324	1996	msedge.exe	127
PID 1996 wrote to memory of 1860	1996	msedge.exe	128
PID 1996 wrote to memory of 1860	1996	msedge.exe	128
PID 1996 wrote to memory of 4788	1996	msedge.exe	129
PID 1996 wrote to memory of 4788	1996	msedge.exe	129
PID 1996 wrote to memory of 4788	1996	msedge.exe	129
PID 1996 wrote to memory of 2564	1996	msedge.exe	130
PID 1996 wrote to memory of 2564	1996	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://keytool.cfd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8acfc188,0x7ffe8acfc194,0x7ffe8acfc1a0
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,9315496931100308764,143919194036452135,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,9199667359738961821,131849192441985032,262144 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13259482525667686926,522603882273353765,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9065316985997510314,5731039746389624386,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,7790685081804076616,16725719630609555724,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,12180848534836417520,13931859054377070912,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4833306599629152043,10899760557479494415,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3584,i,2679377053399881075,1537224013888677430,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3524,i,7212097319295153228,17335241828018348070,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,3559764375737952094,9435263991355886116,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,18183453482348731347,17206616959238087077,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7473920992952319002,893814310277254953,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7473920992952319002,893814310277254953,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6228,i,487038731153077032,16517609763594728974,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,3785421410061638931,9403828481098520064,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,1808014809086446080,7778555387037902954,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,15877262095354357779,5298219532644057488,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5320,i,14436453421013208138,11331189633355859661,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10639917248221156756,14930798632140835019,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4480,i,8245712399960609766,10533026179316802141,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2156,i,2867498826127793427,13765373714082202205,262144 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,10999030352020132950,13753347357506409346,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,13282258079739969293,3998240028313785626,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,16053385620734627445,6400594662971169156,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,5132494062358360566,4869580523210438417,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4532,i,13522256677536237277,6094072990759496508,2097152 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,7620219240832882107,13013135242968466231,524288 --field-trial-handle=2340,i,2912400093363606243,6723374332026709378,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1fce1887-31ce-4b9a-bab9-52e94ea0871a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fce1887-31ce-4b9a-bab9-52e94ea0871a.tmp
Size 9KB
SHA256 2266033d90a3caaa3f3c36864f27a87f5ac912883e2a8be5e32b754e51798748
MD5 1703610f37e9a6d92d487f8768ad6784
SHA1 a2df2a5e4ac2ee02aa97e058daa582a30a85f8e0
SHA512 e92ddd1a548b2bdb2a036332915270c5e8a8d7af56057057f84038e60c268027aa14b6862a4853e96f224a9f366ce7a7ad479a7d6b520fdbafade67122df348c
SSDEEP 192:JONB6vMsPQmiUybWzhTf+FdLBR2i80I0lqxU/u:JONB6UsR7zKd0/U/u
TLSH
T152121A32ACB89C6B9E93A541F08736171EB4916BEBC46B90F6DC6F1C01DA6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33ad2c2ce29a9fc8ef72cc19e98c7fe82f90c000e675d01165e7a0d35ad7d635
MD5 03a13d2159c3ca878577f08947ecd7cd
SHA1 6f8c248ae2d14400231edd21077b92c8c69e2784
SHA512 a1f90a2b9a110f937adbe0bca7cc5bcd664ef68c83cf29e4e1751a42b6ae6ffa1ee1bc85177bd2ffb3954e85b7c9755e4ca066615c1bb4852515a9c8ba137a8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T184B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 b5ffdc6527f3ac83871037f6827cd9bd6f2b92871a7e1dd7b5fc447892904d44
MD5 a93987bce8c6638ce1b28c4ce08109af
SHA1 fa35ca8b14dbb76e33d5fefa377d1530e18ecd96
SHA512 65525584014485fa0b5b35546a5bb6feb6f2b0c7888b89a858f430c35bfead197783f8474a3c884231ce1dfb249a5fdb99d54f72c2936fbfab8a68bf0a707bee
SSDEEP 192:sjKid+yTTIk99KLLtDWXQYYXXXEEdddducMfLO:sjKid+yTTIk99KLLtDWXQYYXXXEEdddx
TLSH
T132E13A1686DDD7EA8F1520CA89A4A35C4070370EEBDCE508178D8ED9304EDDBB4B6BE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 da7e6c9a59c7e91c54d9b5a2c6900a3d7594c51ee9c76f6e66ff9cbc3526258e
MD5 677d2be8ae5494dcf467bdfdec3b1baf
SHA1 e0ac800877a536d4abbc72b8bebc292d3cc24d20
SHA512 97b29b5157021c62914187183f15ca31500894e3cdec9231967b195fbf1e5d31efa3da0e29766bbdb02a2a6c9881329e1c066f79f9ef12632620f2696e55b0d9
SSDEEP 192:NjEDoDDDxxxxxxxxxxxxxxxxxx77777777MXh:NjEDoDDDxxxxxxxxxxxxxxxxxx77777m
TLSH
T1C7E1EA27C2D4E39ADB2920CA49B8639C0470374EEBDCD91C079D9DED304F59AF6B56A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 276B
SHA256 4cd62a120df207c34ddfb8b79ad6fc2bf3eeff792b129b28062248d28090a8c4
MD5 a934e2229e1e36982947e3005c0a7264
SHA1 f65d4ccd31e253b1b9cf6c1328cd0b45ce34ccb2
SHA512 2388effd335e6c0a92081fb58c42149d0b30fbff26e4abef9f34719f1e715a90715b5e964a7e85e85571138167d8b058e680a4d7d6d33dab61d7dcbcf7f3da9a
TLSH
T1D1D02B79B48C6D8FE7A418FE8B6570000F5451D3A42EEF120159FE8536907F00F67130
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1879fe96ed5b6fd91e39ae59aee238d205b61bbe1f3edb19cf7fdc8bf7165920
MD5 dd44aca55bf4c1f24605d9ee088ce577
SHA1 1aa8ef28389fda39dafe1306ecc51f52b00d9426
SHA512 8c845dddd0dae1cccd16e9dfbbf1a8fac25dedae41e099adcaef4166b0d2900767464b9a62469d883f977eaf065083659c61ca761ba2a0f165907a11d78f5716
TLSH
T1EE715FF8012508F5D365CF30A3C9DE927D71A8E9FD9F1E5E2A946039DA14BD3048C569
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fc3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fc3d.TMP
Size 3KB
SHA256 d3d3ea1124c2b8cfd5ef41856303f03ad2eb50bccb60ff6a8288ecd1d8ed0a01
MD5 ccda575a62bf35a16a081bf29bf0bf1f
SHA1 b91a93a169256f822042f3bbd4fabf2576b33d10
SHA512 b44f94ed59640d27f276538d2add6bd7da0ed11953e641be86d120d5550aaf313bd0d138fd34a9cb55a849d0783952e49d244bb7ea52bb63996a93face0a2f1b
TLSH
T1AE717FF8022508F5D365CF30A3C9DE927E71A8E9FD8F1E5E1A946038DA14BD3048C569
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 2d15d1a30785666c49831a5f576a862cbcf96e20e769a85459f93b023a1fb8d0
MD5 8b81c51427788daa7c346b9f7679e4c1
SHA1 b466666ca62f4102f15a65b4b84907a97b184028
SHA512 170baf598b42456ff411222239f85c936c74e063f1b5677f763c9d2eb99ce633d4ec96e49eacf6a0981bb5447433c3c030c17b43ca40ca5aba08d9a798b5051f
SSDEEP 1536:RfEE4+V7loQNNGZqW3w5PDuVjbpBuW8vRZsM62UhPq:qSVOZi7ZU0
TLSH
T1DFB35227D6A64C6B01F16264EC754382F325436F9282A82F3A3C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 510B
SHA256 c584fc774d7e40bcc703d5062f735c83c22959388ea089f7d7966c8fcc045c5a
MD5 7bfc5d8c3e37de0550dae1bcbcdfdb19
SHA1 75804360cb5699e7e4a3a226f54188fb74b532b1
SHA512 3b856f006fa30b7f9fffc504f495023f7057b3ca5c54637df6c4d182514c0a2d1d5d4936470bd36d375f1e7cdeb9131074e9fccdda96258b9bfed6d11c7ed8f4
TLSH
T1F5F050B783E445BD9A1182F0A9183E17CE690841531C3D9695F0AA1B93E5468A404C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 705B
SHA256 3a069721162c1ab5c634bf939d28d4a139bfa73f0dece3ca0d650eafcbf91be7
MD5 b5d1f02f3b66d41ac218e7a4e3489eae
SHA1 448c54a29b88e7dfa4c9163cb023b030f9fa8622
SHA512 a1cba07b6ece00c5ceeb66bfc756d70cbca5503d4f3d6e30cbe1b5af2990c0e4fe8f0a5745275a5ba5fdff693279869cefb955115a9a617fa482e1dbcc7b0304
TLSH
T11B01C0F383D4416DC92101F0A9283E1BCE1D0841426C3C5A95E0EF0B93E5424A005D5A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 693B
SHA256 fb36edd573975692a117a376ee41ecf68d721b8c5d6185fd33169c6071654897
MD5 1e61032ffdb1770208ebbb987963f43d
SHA1 4cce2fe7de0cf918015a739dc1a5cb2f382abdb2
SHA512 21051f8b4938cc720e1c2cc12afe9ca34cef81cf5f9f2d8f9597fd740bd6eff796a3f674a630b2e5635f155e72309b85565bb6dc58d5adbf27de291ba5544f42
TLSH
T169017BF343B155AEDA2152F099287E1BCE2D0402435C7DAA96E0AE2793E2065E046E97
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 008acb992e4e02ae6352b688bb6341bf5bf15a03bf6c9c9e21576c95540c54d9
MD5 a04845e5dbf0080aa256f42f38ee9b94
SHA1 02d90116225ec86d8290f5f32552f0fe40b06a77
SHA512 b5453f3af49ea7e1f7a356ce597a7f5f8c36f30b0d981b2c0ff54c9f0fa3265907e598084725a4b6bf912369a69ff6a6c5f2cb77633e9a9667bd9b499dc35b05
SSDEEP 192:sxZ3/yirKOMl8UQWk1/ftsJBHVXIupq9H8z6+WNGYvwaah+szhIg54J:sxZ3Aq91/ftsJB9aHXGrhdzN6
TLSH
T17852E9566A3899778CCBD60DF641BB53D6F90472A2940E48AAFCCA1C05E7BDD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a78c5eca23f7930069e2f063074d88bd795e259e9411e562c2e7217e54fa3a76
MD5 0eaf6d32278dbdb55e2b53168a998bd8
SHA1 915d56d3e9a94402abbf74639a3863acc0497c34
SHA512 6eddba677a08cb3019a76cb57c9dd3a5138061abc467049f20c06c12f1af3f2a584d9e963d8255721223b2eae68db31f5ea4eb5d9a01a284c73153b9bafdf2e3
SSDEEP 192:sxZ3/yirKOMl8Mk1/ftskWHVXIup09H836+WNGYvrXIh+szhIgrJ:sxZ3AM1/ftskW94HrGxhdzN9
TLSH
T11E42FA526B3499778CCBD60DFA45BF53D6F90472A2940E48AAFCC61C05E6ADD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 485efcbf6cbdc0fef51ddc143e4a5005a5f14bc1e788802cd8a39ea8334aef0b
MD5 98f807de29279ed3b5c7c0c8fc3f747e
SHA1 27ad16cb8c4655b1bf9d3a0bdd1d2ce105ee8996
SHA512 f7fe7c934bacbda0e1116a4dbe353c75d099472736d41154fa952f50fbe8bb9edfd0677ea9d0ce85fbf408dc12fecf6336e42da4a89518919bc61fb25a2a3f72
SSDEEP 192:sxZ3/yieNKOMl8UQWk1/ftsJBHVXIupq9H8z6+WNGYvwaah+KzhIg54J:sxZ3Pq91/ftsJB9aHXGrhLzN6
TLSH
T12D52F9566A3889778CCBD61DF645BF43D6F80462A2900E48AAFCCB1C05E6BDD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 267434310a54a9da0562966e8dcc86e861fcff6e6b3be20baf7225b4400142b3
MD5 9729df7b1001870242a28997c66bed03
SHA1 4cc05f4e78d3ace6efe2cd66a0a1da4990308350
SHA512 ac9a03985ff1ac7e920b208b609c35a9ef79a168304417c928b2fb9e72822704d0888bfdd28570cf8519a038714cb1b0d6904b79de19f15ffb962940c80b3627
SSDEEP 768:zRseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppKrogc:zRseJ3xWvhfynu1jaVcL88ph/
TLSH
T145D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0e4e8dcf1d770f790f8e0d30e2ccd38f48d3b07077a0549fe4e216ae2187d94a
MD5 9faf211983a2f01fe2fef62b4956ca4b
SHA1 8b3a10dc6f0cfcb1b91c92d3ba7ae07b14fdc2db
SHA512 bd562e848be1eefaa94be757b591f6a34248c7f77e75ccd893d7b239de3ff2704c164db64bff4b0f3940f858a11a90f25351d2b3875b2e58102380e36d4c2f37
SSDEEP 48:KYHIhKggkXyxYIXKBe0ny1fIdK8kI/yFFIRKmssCdSB9LV:KYH+KggmCYQKBee+fuK8k6GFSKmsm
TLSH
T1B3C12356303B0256387F2548A29699764E4235E3785CF8AFBBB900B20F27E110DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599bb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599bb9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 fb75445f570a1119f6f9c020921d717a809ec5c8c521a0deb9fb5239de0b8835
MD5 4b507aaaa46129e0c1239a08efec39d3
SHA1 892715a416d7963780354501838c1e65d103e511
SHA512 f4f1a854e2b2d0ba38acc82b58517c277396246c3fa05cd10ec2c31a2dcc4795418dd5d3130b1acb170a1a22b30e95e414587535abb929afcc2712173f3af1dc
SSDEEP 384:rCNF1tNn/s3n9SpZzsNA8TUNTUlIl65j27Sj7B1do/Zm/:kF1j+9E5wgkR2Gvi/I/
TLSH
T17B824B339CA4893BAEE69A84F54A36075EF441A7D6C1AAA4F6DCAF1D01CB2DC0307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c7555c8072938b07269e8f2ad7066ed57b6422dcda97bc4930a648d13930c275
MD5 f3e88301137f3a96b3c3160c7f9adb6f
SHA1 b0d44ccea97a6bd5556d7e4e98309979828d2991
SHA512 817c9bae27f8d42fef07596a284cedada324a2f7bfd3b44f0ef9a1faea7e0015fc3636cc8cbd8ac46a5735c60bcb46e8397ac2a8713f72867f1abb2956e4cd56
SSDEEP 192:lONA6vMtPQmiUydWThTf+FdLB28470+xU/u:lONA6UtRfTKdS5U/u
TLSH
T12402F935ACB85C7BEAA3AD45F48A27171FB4216FA6D05B54EAE82F1C00D764C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 412c667436b9997c34dd0cfa15132f64ffa13f97b224323bf8b6e579aecad0b5
MD5 06f5ff0807498e8885993120fe12644e
SHA1 69b22753bb0735f4b0cfd41af3425539a5817c69
SHA512 9929da4c8f01d1e2836b777f91b84d362957a3fd2b4cf80e367e60438760d464ce9f90cf61baab9d6ddda70470c896a1834e27528fbc6812bfdeff8a8006e2e6
SSDEEP 192:udTSNWMsnMcPPQLz3XX9VofsNrUcA5QMrVM7b2FQmiU1MEe4MTf+FdLBR2I8z10F:OtNn/s3n9SfsNrUF5j27Sj7B1dI/Zm/
TLSH
T150626C32AC746C2B9DE6A584F04737071FB8816B97C42F94E5ECAF1D01CA6AC1317D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 20999d8044d9bbceadf240fbe01055f5c263084b7c8a6e1c7696a21f3dbc2b49
MD5 e59ab8037a2ebc2b563c88403707b1f5
SHA1 4b20d5e252944835f3eb3e3d828842e26aaba179
SHA512 efe3739859b5a04d920ca44c2219bec34fdd5f09889f73e90bb8cc30dc0b3ab1abd7eb30014342f4cf74dd16c9833736d73cb2d82d06f36c3762ebaec270b3b3
SSDEEP 192:u1TSNWMsnMcPPQLz3XX9VofsNrUNA5QMrVM7b2FQmiU1MEe4MTf+FdLBR2I8z10F:ytNn/s3n9SfsNrU65j27Sj7B1dI/Zm/
TLSH
T151626B32AC745C2B9DE6A584F14737071FB8816BA7C42F98E5ECAF1D01CA6AC1317D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c903f452a959ccd1c5c1686f9518b029648d632e9570097d0e22d2438ba8924
MD5 99d7cfc323400630b9efc9a98fdc9184
SHA1 0ea76ba85a750e0fb80398c0a1ff059db6cecda1
SHA512 f17aaa6b58138e727251b7c38c5892c93de0e7bb133c8e9fb5c1d13a8f44abcd54f1ddc8b7735db1ec3fda00120c1a540e432336f480c28903bbf833875aea9b
TLSH
T1C241265CB6E90148B3B66E5AABF6A96D487EB8332E07D05E11110E8E0632A40D862733
MD5 SHA1 SHA512 TLSH

Submit Download