hxxps://signshop-va[.]com/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
728s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://signshop-va.com/
Sample260628-2ekqcsfv6v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4604	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271594232021505"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{EF5B8C66-2E3E-49AC-965A-0257EC522711}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 5312	1820	msedge.exe	89
PID 1820 wrote to memory of 4432	1820	msedge.exe	91
PID 1820 wrote to memory of 4604	1820	msedge.exe	92
PID 1820 wrote to memory of 4432	1820	msedge.exe	91
PID 1820 wrote to memory of 4432	1820	msedge.exe	91
PID 1820 wrote to memory of 5872	1820	msedge.exe	93
PID 1820 wrote to memory of 5872	1820	msedge.exe	93
PID 1820 wrote to memory of 3060	1820	msedge.exe	94
PID 1820 wrote to memory of 3060	1820	msedge.exe	94
PID 1820 wrote to memory of 3060	1820	msedge.exe	94
PID 1820 wrote to memory of 2544	1820	msedge.exe	95
PID 1820 wrote to memory of 2544	1820	msedge.exe	95
PID 1820 wrote to memory of 2544	1820	msedge.exe	95
PID 1820 wrote to memory of 1212	1820	msedge.exe	96
PID 1820 wrote to memory of 1480	1820	msedge.exe	97
PID 1820 wrote to memory of 1212	1820	msedge.exe	96
PID 1820 wrote to memory of 1212	1820	msedge.exe	96
PID 1820 wrote to memory of 1480	1820	msedge.exe	97
PID 1820 wrote to memory of 1480	1820	msedge.exe	97
PID 1820 wrote to memory of 1200	1820	msedge.exe	98
PID 1820 wrote to memory of 1200	1820	msedge.exe	98
PID 1820 wrote to memory of 1200	1820	msedge.exe	98
PID 1820 wrote to memory of 3804	1820	msedge.exe	100
PID 1820 wrote to memory of 1328	1820	msedge.exe	101
PID 1820 wrote to memory of 3804	1820	msedge.exe	100
PID 1820 wrote to memory of 1328	1820	msedge.exe	101
PID 1820 wrote to memory of 5632	1820	msedge.exe	103
PID 1820 wrote to memory of 2996	1820	msedge.exe	107
PID 1820 wrote to memory of 2004	1820	msedge.exe	108
PID 1820 wrote to memory of 3060	1820	msedge.exe	109
PID 1820 wrote to memory of 5108	1820	msedge.exe	110
PID 1820 wrote to memory of 5108	1820	msedge.exe	110
PID 1820 wrote to memory of 4820	1820	msedge.exe	112
PID 1820 wrote to memory of 5596	1820	msedge.exe	113
PID 1820 wrote to memory of 5596	1820	msedge.exe	113
PID 1820 wrote to memory of 5596	1820	msedge.exe	113
PID 1820 wrote to memory of 1968	1820	msedge.exe	114
PID 1820 wrote to memory of 1968	1820	msedge.exe	114
PID 1820 wrote to memory of 1968	1820	msedge.exe	114
PID 1820 wrote to memory of 3028	1820	msedge.exe	115
PID 1820 wrote to memory of 3028	1820	msedge.exe	115
PID 1820 wrote to memory of 3028	1820	msedge.exe	115
PID 1820 wrote to memory of 5200	1820	msedge.exe	116
PID 1820 wrote to memory of 5200	1820	msedge.exe	116
PID 1820 wrote to memory of 5416	1820	msedge.exe	117
PID 1820 wrote to memory of 5416	1820	msedge.exe	117
PID 1820 wrote to memory of 5576	1820	msedge.exe	118
PID 1820 wrote to memory of 5576	1820	msedge.exe	118
PID 1820 wrote to memory of 2132	1820	msedge.exe	119
PID 1820 wrote to memory of 2132	1820	msedge.exe	119
PID 1820 wrote to memory of 1488	1820	msedge.exe	129
PID 1820 wrote to memory of 1488	1820	msedge.exe	129
PID 1820 wrote to memory of 4092	1820	msedge.exe	130
PID 1820 wrote to memory of 4092	1820	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://signshop-va.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8ca90c188,0x7ff8ca90c194,0x7ff8ca90c1a0
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,10562731872234358804,14970593896243739392,262144 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,14749019461049430888,15380956895649572548,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,14498617744572109763,6549201174337335284,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:13
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,2120010275463732671,10204259265679006168,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,387524682160056251,10475890647976655111,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,511463269785493052,3089028823819085959,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,4779667187625066421,12605522931154898106,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4880,i,11769211200678198480,11093903728737463849,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9109507400930573541,7426746058996162053,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,8374624591669539274,4762238730206646944,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12204595884921418458,14628828013725823853,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12204595884921418458,14628828013725823853,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,1367396614646335978,1967318796635731155,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,7686333146630352277,8739912123638281338,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,14226613789872764953,17644638135421543261,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9360172859909746790,13584269141631195830,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,10604589717192900305,6025893910759764043,262144 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6452,i,8175579692836091450,84618708935840924,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3588,i,10608608611000454416,5165608854620758954,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4472,i,12830914177025930991,14512803236734474851,2097152 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,15297571629099563021,17248263236637876234,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,255780716038264727,3084705378071772883,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,11253919297629852035,6730297534118044221,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,6500928173639587217,16113673423309305979,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,4070181413202755622,4485556300985568285,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,6955973133870067945,763346563475435276,524288 --field-trial-handle=2760,i,9485562015491874084,12036413212218996160,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
  2⤵
  PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1404

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:980

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4280

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 ccd0b8b4c3959a6c7caec161c4c294eb179c690f92942d32f0dd7fa42e1970c1
MD5 a8fd56d816fb9741c23aa21ad9459ef2
SHA1 41e613cdd7b9e716ecff155d1e825d4e3a107fe8
SHA512 32551e98540da95f4e82cd48d1d7e618b9285fc73b24b899d43072461259fff7ed090aac36d58f42ca9bf18db138c1dff39d584ee40a580c92e1029db2c1661a
TLSH
T108E0DF66FBC6E7A80B02D686A09F721A4191702E9A9DC9EE2258B8CA288020052C70D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0d285bfcd9c67ed607b8693e075691f61f0c7efb6235b56548073536edb1d2a3
MD5 b8b7a6a37d93757f229fb7ba7ac04a9f
SHA1 fb1ee0ff986c2b621670bd3c9e767ec2bb27c6e6
SHA512 05089671d764fe9b5966a381532eb5df48c4a4fa8ddaf9c905b7e052fb2dc4adf8114fefb3cf5fe8064029c1cd3a23e701e71379538d931e07ee1ad0531c9b98
TLSH
T12DE0269566C8C33EE640B44742ACB34CC3D0360FD7C8ED5E170484B5B441A40A2F3698
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57b488e0b30adbe7bdfd57384c96e7e874985654a1e7f81ea65b99cad0b90275
MD5 8a6b339a1714f83c0c8906480886272e
SHA1 c547094784b716969ad213a0f920fa1a31c8474d
SHA512 82eb24d7f0a6e638464603a5d5378508eb00a04d4cccebe3a06d138fb60db4a6954bfad2ae7a3247190a47d4b03f426646917cb88c4e933a7bd60b4c7ee47bb1
TLSH
T10F612E7C25DF39A2EFD8EAF165E2308933B0C5220E476F534499A13F4BE9BC55191431
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a3b5edd30ea38e30bdf2ae94f62a4ee54a01ae0cee5ca603ae2053fe18d1feb
MD5 734cf7085c6d9294d7e6d1361591dc80
SHA1 df4908e9a5c43cb56413f8fa08b907b5f5277f5a
SHA512 ffbf972549b9fe2831523b6a7b7bfc8372ad2b47f3f3cb15fcc61878f551a0cc4c01e51a2b73a2d7d2f378d6db91211a57980efbba8b12e7a58b19f8a13285e8
TLSH
T12D713C7C11DE39A2EFD8EAF162E2318833B0C4220D077F530498603F4BE9BE49191476
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7feae488ccf8577935ba1324a15d6a36ece17afb9b0650bb31b47d010d180370
MD5 7e49db28460da00dfa3043603caeab17
SHA1 a088af3c3a1c2240a69df1e600ca5f2bd0faed85
SHA512 c5ce166df32bb3e4a38c36e1c9e35ad0afeb093950423a104c0a3c10a4b08c04bbe2802d2af2c2dfe49f087d64100cc5c6616ba939fb339c7e949676577ae3f5
TLSH
T13F61DEF783E4866EC91146F0EA187E2BCE2D0954831C3D5A89D4AF5BA3E2431E145A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4621a92715364a5153662840a8e53275afe663a5ba76b54c1ad887680e327a4
MD5 75ba8fa420c364cb9900539f19c219e0
SHA1 b0b8d824586db9c93c70e6f3d607b30c49d8c0bb
SHA512 44b76b95b3413f1c31572fa4d82c47a7e263f62fa3123c2a234fe9c81623135ada0c15d5e191ba1a98a82cc9885b797afa31607b66c18f0623449e5ac81681ea
TLSH
T19551EEF783F4966EDD1186F0EA087E2BCE2D0554832C3C5A89D0AF57A3E3471E141A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 42d46c5efacbd7adca770993f0afc399068e9716b8b86590425ec2e4d553fb4b
MD5 e3097fd6b944767df5fb1ddb9ef9f837
SHA1 ec46bb4362a60f52032b57de6b16d541d1d7b65f
SHA512 a02de2843e43611eb4901e597db63e76d626554a3114e7e7b38791f38042bd297c2cd03e1dfbc44dbaf7ba68f112f55bdec9f61a60580c001695e9647dc87dab
TLSH
T1B94189F7C3E4856EC91186F4AB146F2BCE2D0915832C3D5A89E4EF1B93E3871E14195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c819e24d6abe8f0b667009a433350c9f17bc39f50b5e84a0271ddfe7628c4676
MD5 300ae6b2de4853fa773325ba8d4beaf0
SHA1 14fe25c6ebc950d53e8a0316b66fdc208075730c
SHA512 7d18732fc05f9b9d0043982f79ba617378e7664a19373b74114ea08a79b81f9b90a94409c687068d7d4ca44e76d81542e2c6ce53489eab3cfdd26b4d91182516
TLSH
T14F4189F7C3E4856EC91186F4AA146F2BCE2D0915832C3D5A89E4EF1B93E3871E14195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ef4b661cdf8f7edc88a7d26330917ea42ef94be3422c00697ebe4ef23749d0e7
MD5 e1b901a8fa661da3ada693b29029d6da
SHA1 3d6f14597984dde9124e4d12cc76f56fef4e1f49
SHA512 aeace77676ad28a4c90ba6ed78b1eb078df54c2669af1126e7eb8a1985928f75e262890cf73b51170e2984a5e9fed3acfc8f754b75cbe820c72490a71a4ecfab
TLSH
T1E151BDF7C2E4966EC91146F0EA183E2BCE2D0954831C3D5A89E4EF5BA3E2471E105A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7fe515d6aa86432a892a16ee11c3be681b6049ef4c09bf184fe86e97cb16e36d
MD5 f9af9536b050be9c6db6008482485783
SHA1 1a1577c2850a53ef6f7ef66cc259b6dc05296b8c
SHA512 c2f6cbed07b4150ca06e9b49f3245f655186f927d6525674d077910d21a3f9e7a4777ad06a687a3ada44002e5ebddb8d41a67c649034ba4d12c58fdf782eaf66
TLSH
T18651EEF783F4966EDD1186F0EA087E2BCE2D0554832C3C5A89D0AF57A3E3471E141A9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 503b5ec42aacc8a7545d86c65088bffd9128687d629e41f98130ca8bd58b6706
MD5 237e84a019a38f82f83d9216955db063
SHA1 152d111a9930d750f5a16c0c7288a59370b9ba2b
SHA512 bec1800f9b20db9c084c4621894c1c4b883e3e8e8f8e39ad4815d41c57167f0f7f66120e385b56a3e48b67c2a5781c38cbab0228ef151417f326f5d8528c5b5c
SSDEEP 192:sxRSR9yM/jK1Ml8UQBkFq/fysPaNkUs9zoA8pC7/g6+WNir5dYZZGUGSIgDHJ:sxRSXqByq/fysPa7V0/5W5dut
TLSH
T14562F816AA249977CCDBD219F6417F53D6F85473E2940E48AAFCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7a7a59dcf0e8c28d2dbf1ff79f286d989dcc7a598d874a6a35994915cc089d77
MD5 cfc379e6d448a7709079dd5e4f1aae61
SHA1 d778478fe24637d8dddd7e1c193b23efdf4f0543
SHA512 dbf188c165f9df81e44a40d5c97f004a68b2ef817a126f620a3a5208a4fbe0b48e795059b88b616589e02d8739e8ca29fb6367959f0e50f5ffa033fb04e89456
SSDEEP 192:sxRpR9yM/jK1Ml8wFq/fys3bNkUC9zoA8pEI/g6+WNIYZCGUGSIgIJ:sxRpFbq/fys3b7LV/5Its
TLSH
T15652D816AA249977CCDBD209F6517F53D6F85573E2940E48AAFCCA0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 03f259daccf2629802091203a668cf4a950731625a1c455c77b15bbffe23d573
MD5 76ca1fe65def7c9f64477cdc62cb6d51
SHA1 3e46941bde860b74dc4bb9557f921d09d7263af4
SHA512 5990c80490307b0ad3ae1423cf98a7e3ebddc6b7a6ecb9ab24875d0113ab331f154938f22d446286ad529a2a74377e0e870989c2ee387b0d61cbb40a409a227c
SSDEEP 192:sxRSR9yMqZjK1Ml8UQBkFq/fysPaNkUs9zoA8pC7/g6+WNir5dYZZGUGSIgDHJ:sxRSaqByq/fysPa7V0/5W5dut
TLSH
T1A362F816AA249977CCDBD219F6817F53D6F85473E2944E48AAFCCA0C04E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78f1cd6459cb01e067fe529a5d37a89526f0401a4c838c1280f4843787df0a3a
MD5 01a4858bcac30a5a36d2ede1df10e285
SHA1 1ca3c52d8e9b21d2caa71f61c33c41cd4e5b3b2d
SHA512 0969d2a6f6d052acaf387c69d59408e3ce323e683bbd5050d1763a3f74443a67ab9773a97c17742e0389d74f09bcfd736b76c784541e78a150bcf3508edf9d9d
SSDEEP 192:sxRSR9yM/jK1Ml8UQBkFq/fysPaNkUC9zoA8pCI/g6+WNIYZZGUGSIgDHJ:sxRSFqByq/fysPa7LP/5Iut
TLSH
T10A62D716AA249977CCDBD219F6417F93D6F85473E2940E48AAFCCA0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2bbd39e7335d04983812ee11a5e7b93946a7d53e0aea27f4195020079f0515eb
MD5 5e70c6deb2bf2083091d0b676f004221
SHA1 43a9027379d60f1bc623067674ad2a2d2ac28a8e
SHA512 0f7b7a58ee6462e21ae2120f058cdd1c8dce649d1767f41359785fb36d34a1ecc0ac976d95a4446dbe318e32da808b3106fd221c995e7e24c6aed8f6b17be08c
SSDEEP 192:sxRSR9yM/jK1Ml8wFq/fysPbNkUC9zoA8pEI/g6+WNIYZCGUGSIgDxJ:sxRSFbq/fysPb7LV/5It/
TLSH
T12852E716AA249977CCDBD209F7417F53D6F85473E2900E48AAFC8A0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e38d00ab5674e955a45171aaea56d6b2ad6b42b4a348965e0a4948165295134f
MD5 32f021b5dc8c4559e447cc3ef34c7b36
SHA1 602355a9e639d6699353ba438098e558db0ac1dc
SHA512 d4652768c6cf985e37ebc3d4582bbefa6ddc9640a384b94813e80527f251c7543e155985e62caafa87b9d888fb35250ad2dae221b8ad3672b9f4c3e4b73a293e
SSDEEP 768:eOEt7IWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQiro7ov8n+T:eOEt7IWgKgf16u1jaZ/Q588+T
TLSH
T1D2C20B2B240CC77E4F844E6DEC2A6E976DD801CB9B988D4447EE890C03C77EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index
Size 360B
SHA256 de89889888602ce291efa58c05ffbf52a52cc05665641852e7abbf804d5ca083
MD5 65966f9d974422e0d1b4865b4eb1c788
SHA1 5a1fd68a0dbdbdce869802697a37e0c94ab5c719
SHA512 916a68ab2dacfb3d978c2dcda6fd190bd943fbf0a67dc5b365c4a6666d31431e34b8712f1d1ed74b395ade19390742e169957bed976eb14675aaedeb3343833c
TLSH
T1D7E02BA16CC02229C75118391D7134AE133789FD250C8E02116D647D483161C969511C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d713b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index~RFe5d713b.TMP
Size 360B
SHA256 7ab6f177f15accf9a20def70055e3a765810eeca4ef074ba9a2a78144263f368
MD5 341e3bc03ed95a51a0eb91959b9c8f71
SHA1 9355187d17eb0ea3be5687c844576c1025ab43fb
SHA512 9b35b0cf4c77d6fd9ba1b76fefd174e6600d0124bac8177e6ffb9909a7d34e24f3b001233f4f69a85b67674b63609d35126daa1b61af2fdde01a3a4f6da9e5ae
TLSH
T17FE02EE21AC0ABA6CA8620FD48A1612E6276CC2829088E1320A1B0BD497271523D821D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 731f683629a681b75a0ed8547a81aff02e87eec4a5fe2496e832d47dac358571
MD5 b7d33604c7540fe41bf0d499978d96eb
SHA1 e848f6ff4a53391b57951d7220e7b4c91eecfbaf
SHA512 9c3faed0add91cfca655ff33bd34e3daaa21f50bcd6f0183fa0600c5d001bfb29897ceb4019c12ed52e3290f3fb9af078fb0cd3ece0dbbe9e2067d7f15e6d765
TLSH
T102E0C0B77DD71C04AC7F93DA1471E4500002BC58C704EC8F202EE5E360B1321284ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d93a84bab3dc73fb9ddadd23c5df0e8dc01aa6bb1dfd4e34c2fc021fac19db4
MD5 84afa56db21d6389a19298c7b6aecc9a
SHA1 6a8434757746ef224f2b4004d4b40a7bcbe690ef
SHA512 90548e9b61216fe60126e4ec699be2138d3445e8e3ad9f8eac09e3ec3439c022226f949d8883eb581fef57bc0e6b53d900228b632c35c727a8dcc0c8ae87469a
SSDEEP 48:KLy3mig8Yko81PI16kKOBG4kqC0HVgC5yFXIBKQAEgtIBKeMcTyJ/6zPdZP:KQ9OKuIaWX+KQAztGKeMSs/6zPdZP
TLSH
T140917450727B679438BF258881A5A51E468630773216E92B77A830F35F6FE000EFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cdd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cdd5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6f5fc843cc82c975a439f93de564a0612f7653553eb85e5e2e7c5d693ec04587
MD5 2032c315e4c9bdd970872e36ada53b0f
SHA1 8060b5252f85b587f72ee0d128ad71c4f6005d40
SHA512 717edcbe5f1691aec1b65981037448c5ca79d100be2c6b90b67074bb24d1dfa348d41e9b4e29712d3ded1053a093d82bb7ffcb9eb957e664ead86541cfaa1422
SSDEEP 768:VjaeqD4MlshiLdMmP3tm7PfcOsfDXfDUwV5R4HTytYYqgHvPwohG0fF+TO:VqcjhIdMI3tefwfjf/WTwJFhG0d
TLSH
T13C13C0B2ECB45CB75DA6C685720236C3AEF48267C3C43A68D9D81A0D06DF5DE1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1b852f9faf40e78046feb683dc8e4f7b42837bdfef37d5248e7e7d2843e0087d
MD5 73895877b1548e892004633ec974aa10
SHA1 86fee00034ff03bef928a2691979f7711c3a2ef6
SHA512 50528a1e51c2494bd1fb6da799062c5088c1a5ddf7b0746756325ee6a22a83dfe69926e319de2e2697d366acc6c0d001ec95557df52f83e64dbe290d6f9ff5b2
SSDEEP 768:ej+9l35w7PfcOsfDXfDUwV5R4HTytYYqgHvPwohG0fF2:d9l35Ifwfjf/WTwJFhG0k
TLSH
T16FF2BF72ECA49C675DE5C6C472123787AEF48263C2C42A64D9DC5F0E0ACFA9E1747817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3ce028918b9c342c64d1601f94dc85defd3b8de521a6820d165a0b68ba434fc5
MD5 fcccc39a714a48854e23f919e4438506
SHA1 acb6f75cbe0040d360c617cd22dc2a50f20660b4
SHA512 932f31efd78af577e27071de5143e51debbbb728b4e04065dc957bf8465c57215317b7da6d5b6df8e82b81ec8909e42dd844c69892e9cedd0f180bdb25c0a8b0
SSDEEP 768:kj+9l3uw7PfcOsfDXfDUwV5R4HTytYYqgHvPwohG0fF2:z9l3uIfwfjf/WTwJFhG0k
TLSH
T16CF2AF72ECA49C675DE5C6C472123787AEF48263C2C42A64D9DC5F0E0ACFA9E1747816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b4c6de14581af1d69ff49e0e75706984e5af142e2d42ca0690fe2f7c1a77f8a8
MD5 8306cdd998fe22a81ec7fce4bc317cbc
SHA1 08aab4686abe3a406b290a55ce7407051894d218
SHA512 6ac90c727961a493e59b36d8e1558900e89f83a496820240ee76178bfa58cf63e80f1956bf78cd7ef2ccb0c6ed28925fb7b8969989d3bab64498a6b33f13fcf0
SSDEEP 768:9F1j+953WwgSw7PfcOsfDXfDU7V5R4HTytYYqgHvPwohG0fF2:U953HIfwfjfkWTwJFhG0k
TLSH
T19003AF73DCA4C8776DE5CBC4B2123782AEF48263C6C12AA4EAD85E0D06CB5DD0347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f253a3f20e6a668c8951479a30e425ca9fa0f20c6a2fb01bdfa45e73d659a3db
MD5 baa57214332ee52e28c5f74c0b6014d2
SHA1 780d6833ae71e0fdd7e65c008713682f716456af
SHA512 ab54066ef3d809bc678906f8cf27708d253dac35b3836d82dadfdf78fcb108b98a32484f9dcf45f0758efca131af3dac4abf6ea17f6e64cac403cde9f5b48c78
SSDEEP 768:EjaeqD4MlshiLdMma3b4PfcOsfDUV5R4HTytYYqgHvPgOyjWtxjTo:EqcjhIdMh3wfwf2WTwJ3yj2y
TLSH
T15703CF76ECB85CB78CB2D684770277976EB842A7C3C12A64D9DC5A0D059BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8813ea4-732c-4200-b095-e27f45b40a7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a8813ea4-732c-4200-b095-e27f45b40a7d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download