hxxps://docs[.]google[.]com/forms/d/e/1FAIpQLSfGloXeT56Hifsw95khijJ25eAPLkWfgu1-yvOhFonCeSv_eA/viewform?usp=publish-editor

Analysis

user interaction
yes
max time kernel
269s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/forms/d/e/1FAIpQLSfGloXeT56Hifsw95khijJ25eAPLkWfgu1-yvOhFonCeSv_eA/viewform?usp=publish-editor
Sample260702-mhtecaf121

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3760	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274617309757286"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{24ECC781-1224-441F-BBE7-F25D908D7101}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3288	468	msedge.exe	84
PID 468 wrote to memory of 3760	468	msedge.exe	85
PID 468 wrote to memory of 4304	468	msedge.exe	86
PID 468 wrote to memory of 4304	468	msedge.exe	86
PID 468 wrote to memory of 4304	468	msedge.exe	86
PID 468 wrote to memory of 2304	468	msedge.exe	87
PID 468 wrote to memory of 2304	468	msedge.exe	87
PID 468 wrote to memory of 3376	468	msedge.exe	89
PID 468 wrote to memory of 3376	468	msedge.exe	89
PID 468 wrote to memory of 3376	468	msedge.exe	89
PID 468 wrote to memory of 2224	468	msedge.exe	90
PID 468 wrote to memory of 2224	468	msedge.exe	90
PID 468 wrote to memory of 2224	468	msedge.exe	90
PID 468 wrote to memory of 2860	468	msedge.exe	91
PID 468 wrote to memory of 2860	468	msedge.exe	91
PID 468 wrote to memory of 2860	468	msedge.exe	91
PID 468 wrote to memory of 2836	468	msedge.exe	92
PID 468 wrote to memory of 2836	468	msedge.exe	92
PID 468 wrote to memory of 2836	468	msedge.exe	92
PID 468 wrote to memory of 4268	468	msedge.exe	96
PID 468 wrote to memory of 472	468	msedge.exe	97
PID 468 wrote to memory of 4268	468	msedge.exe	96
PID 468 wrote to memory of 472	468	msedge.exe	97
PID 468 wrote to memory of 976	468	msedge.exe	99
PID 468 wrote to memory of 1592	468	msedge.exe	108
PID 468 wrote to memory of 3792	468	msedge.exe	109
PID 468 wrote to memory of 2060	468	msedge.exe	110
PID 468 wrote to memory of 1320	468	msedge.exe	112
PID 468 wrote to memory of 1320	468	msedge.exe	112
PID 468 wrote to memory of 1320	468	msedge.exe	112
PID 468 wrote to memory of 4688	468	msedge.exe	113
PID 468 wrote to memory of 4688	468	msedge.exe	113
PID 468 wrote to memory of 4688	468	msedge.exe	113
PID 468 wrote to memory of 1596	468	msedge.exe	114
PID 468 wrote to memory of 1596	468	msedge.exe	114
PID 468 wrote to memory of 1596	468	msedge.exe	114
PID 468 wrote to memory of 4544	468	msedge.exe	115
PID 468 wrote to memory of 4544	468	msedge.exe	115
PID 468 wrote to memory of 2372	468	msedge.exe	116
PID 468 wrote to memory of 2372	468	msedge.exe	116
PID 468 wrote to memory of 2372	468	msedge.exe	116
PID 468 wrote to memory of 4384	468	msedge.exe	117
PID 468 wrote to memory of 4384	468	msedge.exe	117
PID 468 wrote to memory of 4384	468	msedge.exe	117
PID 468 wrote to memory of 3380	468	msedge.exe	118
PID 468 wrote to memory of 3380	468	msedge.exe	118
PID 468 wrote to memory of 3380	468	msedge.exe	118
PID 468 wrote to memory of 2356	468	msedge.exe	119
PID 468 wrote to memory of 1028	468	msedge.exe	120
PID 468 wrote to memory of 1028	468	msedge.exe	120
PID 468 wrote to memory of 1028	468	msedge.exe	120
PID 468 wrote to memory of 4944	468	msedge.exe	121
PID 468 wrote to memory of 4944	468	msedge.exe	121
PID 468 wrote to memory of 1596	468	msedge.exe	122
PID 468 wrote to memory of 1596	468	msedge.exe	122
PID 468 wrote to memory of 4452	468	msedge.exe	123
PID 468 wrote to memory of 4452	468	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/forms/d/e/1FAIpQLSfGloXeT56Hifsw95khijJ25eAPLkWfgu1-yvOhFonCeSv_eA/viewform?usp=publish-editor
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa248bc188,0x7ffa248bc194,0x7ffa248bc1a0
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,2896476625231107824,6091936086807338841,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,18355534872957041153,10318919422662855677,262144 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16795448705321914196,1044925111240216664,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7690669341018593128,13724588735677512688,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6839655790531183008,4670815058035217764,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,6065108563655346219,7913456941724465544,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6374211713239360241,10460387284599710987,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,1369315413528378176,12848083847741172086,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,16264400331028829098,17336916687517549742,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,4563479449029255931,3928632313102486396,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,4563479449029255931,3928632313102486396,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2264679456987076464,3492280317436422164,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,15631833757330871564,4814379512811085140,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,873017444514252631,16255414160133902159,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5376,i,7381130976656423648,7833835323362776032,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=2104,i,844813141992521602,2271085980981385279,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5688,i,200841107156598244,15114089782760682568,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,6031128319768325435,11704596068085808452,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6524,i,4786440268671257592,6383672405763063453,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3804,i,4589972921509527860,16139189925453103249,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6240,i,14527899236172858361,11707396736052027561,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,1235258297927963053,10133639702287089434,262144 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6372,i,2631087677524719603,13500631750523287821,2097152 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,17952099842990872887,8133931835741475552,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,2108198203029570975,2446098945653569124,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,13590875083671873269,8182019762317359829,524288 --field-trial-handle=2304,i,2850001443051083803,10453946096858860169,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 17106c9c5772be551913de334108bc8e2e995f6ab8942596501c44b1554e6c34
MD5 c4d3bcfad12a475ec8ef543759287740
SHA1 e9d4bddd45a6a83d24b02987db8cd1563f488483
SHA512 994ba29d0fb7609db3b9a04819bf47ad4482fac6c5ad9d60b4839b28d06036dbbe6a0df3d05a1a84633238217009e4e6dcd912815e0315c4bc2d47ffc0ca0337
TLSH
T171E026C91AC8C22FB200B697417C632CC2E13A6A92C8799A1B0CC8C4F201080ABA76F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eee05ab1ecfbd6e5327a9e9129c7cd6cbeca556b3725f1ec2ae2d620feff68e7
MD5 68be013d8f4d50e41fae3b5b3449dd68
SHA1 105289f7f05f517753ecdf730178a307af271f66
SHA512 9f5eb92ab618e31a9dbd7eb975fdf8b35f734bc0d617f66a2f7149a5daee66d2c62b9b3528e98b2a5efde5ba4841b1cb3e70dca8e6cb4435c0d14c4979261297
TLSH
T1EF61F73D3257418BE76F85F0F8F95E4C327941AB9B6F9E7C0668487D7A08B6A8023418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 48adceed3b7544731c94f2cc8d93f223ce2d4382e71c1523d397d295ddac6109
MD5 834a32af45563a7606e63f99310fa982
SHA1 05fc89b4d00a53a1c5a3d7e08fe97827b955ca58
SHA512 0406884eb9c687153afa8c99c9f77fbca15b9608fdcf6a7fc1bc2c2ced46c8cea60f31b2f6aa7847c11ce305dd13688f6829aa22066950c1d5c86b643b07b680
TLSH
T18C8159F7C3D9862DC81156F4AB15AE1ECE1E062443283C6AC8D4BF5BD3E2471E115B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ca1b437539691bfd7366fb1f272ac9b95fc4529c79bf55535e49b9be47108326
MD5 241f07c10c08279f71779ed459a67f73
SHA1 061dcacc519edc78590a18d53052c4325e8f19e4
SHA512 d2ede4f2184556ffe5efd4b2f9ebc52e7a39b519ab396471afb96d66e735161558e93d341fa3d0e842b8979f879c1746a023d4490852d0f434824c2d87112830
SSDEEP 192:sxZaRpyM/jK1Ml8MkL/fWsnSInIdp7SHW6+WNfTB/YLOWiZ8IgrJ:sxZavML/fWsn5oOHb1/k9
TLSH
T14652E912AA345977CCDBD209B955BB53D6F90463A3901E44AAFCCA0C05E7BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 057505a493ac622335559d4daf28a667a4dab9dfe24595da3551888d4e4e9b29
MD5 a34a01dbe090f6eccb053a17a57f50bb
SHA1 5f8ff0f2d4e1af4d36691101152e8e7d782f2f21
SHA512 e8af0bbaf617c2b5b3b6bc6c295569a09237e03d03aafc86cce90743504ca8dd38c4a58fd6f0a26f72493cc20079915bc14f891a2f5eaf7156af3bb6d234ecf2
SSDEEP 192:sxZaRpyM/jK1Ml8UQfkL/fWs7SFnIdpousdHW6+WNf/9XYL9dbZ8Ig5SBJ:sxZavqML/fWs7ooMHbtXFML
TLSH
T18F52D712AA345977CCDBD209B985BB53E6F5146392901E44AAFCCA0C01E7BED6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 238ee05fac4735914d7fa9215e22b01b1d8e6a7938926fbbeff5dd2df29f5c1d
MD5 e5c3c68cb31118424c249daa507ed1c6
SHA1 6fe5e9f66bb7da6b85c851a6c3ce559a8155e40d
SHA512 b441cd74cd8096fbe28cbe68f6894adc830512b849d83ab1deed6075c7e54df67da2bbc8392186bf2044526fd8a2ab49780b349b3c9bc61a1b2e147cc4429947
SSDEEP 768:dhs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNSroKqI:dhs6pD1WvxzWju1jahILIsNJ3I
TLSH
T17BD2FA3B680CCB7E4F841E5CAC2AAE967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8023eb0fe4e326f31f604744c661f7b7b5ab06737739cff1c4ace2dee13528cf
MD5 0457586c6bc571c3d57c6b74da77cbb9
SHA1 1434e471d9d7e3cd3896436d2ea2ed0ef940abbd
SHA512 b0fd6bf129bc973f19970db361bdf6ebfba84b9d9c5c09a66f10bfb2cd1c89cbb1a3eb1a5b97d7c0e2bfccf4df7decb0aa729cb693ab06db1da433ad26e833f0
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFOuI3KvasrylxIhKq00/9KD3tg:KUAAKteP2OuwKvaCOxuKq0i9KD3tg
TLSH
T16EA1341332BB03437C3E285CA7958B664B4672A33018B42B37A914765EAAE344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597b60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597b60.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 07f7d6e902a86c4f06574b2658d14e3ea81bb2b7ee336f3188ac15987043ed59
MD5 89024f398e079a686b7d36f503772a09
SHA1 399afca643c1dde7c8e2b08090369ec376f955c7
SHA512 7b2f0739e73799b1457b795baddec58c57662d001cf0fc930d91af71d75b1eaae0d282814705c08c0e41c8f2d58404564bd80dd4a71a0c258d9572626b9db782
SSDEEP 384:HtNn/s3n9SfsN+z0NpjVa9DOMMe/7zJrgmrKl8BhBTPLBliZ:Hj+9Uu4JO+/fhgmrKl8BvTPaZ
TLSH
T1C9928D71AC284D675DB29689F68B3A178FB44177A6852E90D1DC3F0C01DF2AC634BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8fea84adf8bb48082afc05177e53935a0a970a42d633d8a991a0888179570ed2
MD5 492df5a7aaf3de3ec26e3cc9bcc32fd9
SHA1 786d903dc8fcaf738cec9e483e2fe7b337bfeb78
SHA512 6f5db78283142816dacef1fdd181aee7666228a30ceeca945001e6b774b8672dad395a2e80d44c2bd9450f60f21e1f75473249843ebc9b6f4264a3c2460df45a
SSDEEP 384:GiF1tNn/s3n9Sx6zsNO8TUNTUlIlA0Np++2a9DOMMe/7zJrVmrKl8BhBTPLBliZ:tF1j+9HPwgI+3JO+/fhVmrKl8BvTPaZ
TLSH
T196C218F248D74936D9AE8B47A77E2E178EBCC163B5452950B3881A0CCC8B1BFD306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 da42ebb99fcc7df09aff4f2e4b3e592c38c68c0b6b3f2c08e0f08aedd21c3d1a
MD5 bc6fe4840765fa7a1035ff4180278e72
SHA1 36fcde608ac7a28d7226448a8117d630b16e373e
SHA512 0f10dd4598e914349728561391a8d436f3af58659f643866c75a90a2137d5919b44b5d78b1a2ec35207c23749fafbc2fc8cd2a60bc4847608f71b70ddc988844
SSDEEP 384:ptNn/s3n9SfsN+A0Np6+2a9DOMMe/7zJrgmrKl8BhBTPLBliZ:pj+9UQ+3JO+/fhgmrKl8BvTPaZ
TLSH
T17C928E71AC284D671DB29688F6873A178FB44177A6852E90D2EC6F0C01DF2AC734BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cdc1da798b6c26fba99ccd9bcfd3bec18a6c7c1d47e70a04ec3209939dbd019a
MD5 78ef48d5637811be6c6acb41585bd0b4
SHA1 274c3f86326f7df65b542a77b2e31a62bb5d7bfa
SHA512 87f6d306405843abf638492c77db2203c3232d60c9533d3a3adc7e2cd5772b5289b41471dfa30fa8dda0648d3217a290c130f925c94027c3d7f8a3d0df0edff3
SSDEEP 192:qON8S6O7+3hQmiUyz1Gttb02O2bbh2eQgGsoiU6:qON1612Gt9DOMMe2eU6
TLSH
T14E02E834AD686CB74AF2AE46FA8737275FA5113BE9952F40D6E81F0C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f6b8196f8205fde4f2fe9b9e0d05cdf3c08d1340c6e0de6be2ab9148633de7d
MD5 72cb425bcab7532ed54e31bfb8c63bbd
SHA1 2fb27ba316dd713bf770f6d99fbe2dfe4fbc294a
SHA512 3200fb4e57a0daf79b0027b1736ec1584795d53129f4a9f32c5a70754bf6c5d70a5d0dce3ee18777d1bf690fd0834b240bf32161329a799451ecd2eba5dc836d
SSDEEP 192:HONv6O7+3rQmiUy71nttb02O2bbh2e/FF0SJrbcNKq5YrU6:HONv63Mnt9DOMMe/7zJrAmrU6
TLSH
T192120A31A8289C775DF2E545F9C736139EB54127EE8A6F80D1DC2E0C01EF6AC238AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bf988ff00677df569cb82be83115581428bd0995c7423ba42a6cb0b5df7594cc
MD5 2f07e928cbfd15da1290d6d75c97c03f
SHA1 5466173aa7d721c97b2f54bd952121f7489ad91a
SHA512 182681087f4ed83cda6141ca93b7a697a1c57ee71e2b7c95a2bbceaf5b40e9fd908b165a97a0c62fd40b510afcb8b8f026f4f5839023cf3e61a699ffa0e727f3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a0e49.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0e49.TMP
Size 392B
SHA256 b4fdf3a236f1162ef5b07096f0842816bf577f1114b2ce4577ffa69f74eb9afb
MD5 9d706d00634e0225b6253896dd80d4cf
SHA1 cd94b246052ce7174e6be28d899b9f607cdbdfa9
SHA512 3e46632d2c9a2e51515b58266e79c62abd90b94e4d360dea74b973e22e7742610840d8ad48e837d87a7e49327302290a963dc99b98bb28f2da91760a386d1cb9
MD5 SHA1 SHA512

Submit Download

c132e3ec-a9b5-47e4-9544-4c71cc02768e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c132e3ec-a9b5-47e4-9544-4c71cc02768e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a878b7a921a8978f9c846e074037d18c24d661b9b0319a63f03e775b8266bbd
MD5 6f85b54953e05164fb34ac291438f06d
SHA1 a958c6c30df69c1f3f6c72fa84737937a28555fb
SHA512 4ea0653e4bd8f41e17f1a873ef950cb2f5b5cf1df13b867a5960358309ea0f8876933d094ec204b6f96739359dfde7b58874a3d50f5534d3de8f86d19c9980ff
TLSH
T1B741F658B6FA1148B3B77E5AAFF6A86D447FBC672E06D46D00110E4E0A22A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download