hxxps://generalstorageltd[.]com/

Analysis

max time kernel
598s
max time network
557s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://generalstorageltd.com/
Sample260703-echfwsa18x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275240874766546"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{A6CCFCF1-A704-49D4-8490-2C8357612E87}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1612	2304	msedge.exe	87
PID 2304 wrote to memory of 5092	2304	msedge.exe	89
PID 2304 wrote to memory of 3728	2304	msedge.exe	90
PID 2304 wrote to memory of 5092	2304	msedge.exe	89
PID 2304 wrote to memory of 5092	2304	msedge.exe	89
PID 2304 wrote to memory of 3480	2304	msedge.exe	91
PID 2304 wrote to memory of 3480	2304	msedge.exe	91
PID 2304 wrote to memory of 3616	2304	msedge.exe	92
PID 2304 wrote to memory of 3616	2304	msedge.exe	92
PID 2304 wrote to memory of 3616	2304	msedge.exe	92
PID 2304 wrote to memory of 2364	2304	msedge.exe	93
PID 2304 wrote to memory of 2364	2304	msedge.exe	93
PID 2304 wrote to memory of 2364	2304	msedge.exe	93
PID 2304 wrote to memory of 5088	2304	msedge.exe	94
PID 2304 wrote to memory of 4508	2304	msedge.exe	95
PID 2304 wrote to memory of 5088	2304	msedge.exe	94
PID 2304 wrote to memory of 5088	2304	msedge.exe	94
PID 2304 wrote to memory of 4508	2304	msedge.exe	95
PID 2304 wrote to memory of 4508	2304	msedge.exe	95
PID 2304 wrote to memory of 2708	2304	msedge.exe	98
PID 2304 wrote to memory of 1052	2304	msedge.exe	99
PID 2304 wrote to memory of 2708	2304	msedge.exe	98
PID 2304 wrote to memory of 1052	2304	msedge.exe	99
PID 2304 wrote to memory of 3244	2304	msedge.exe	101
PID 2304 wrote to memory of 4648	2304	msedge.exe	109
PID 2304 wrote to memory of 4648	2304	msedge.exe	109
PID 2304 wrote to memory of 4648	2304	msedge.exe	109
PID 2304 wrote to memory of 4392	2304	msedge.exe	110
PID 2304 wrote to memory of 4392	2304	msedge.exe	110
PID 2304 wrote to memory of 4392	2304	msedge.exe	110
PID 2304 wrote to memory of 972	2304	msedge.exe	112
PID 2304 wrote to memory of 4284	2304	msedge.exe	113
PID 2304 wrote to memory of 4928	2304	msedge.exe	114
PID 2304 wrote to memory of 4864	2304	msedge.exe	115
PID 2304 wrote to memory of 4864	2304	msedge.exe	115
PID 2304 wrote to memory of 4864	2304	msedge.exe	115
PID 2304 wrote to memory of 1884	2304	msedge.exe	117
PID 2304 wrote to memory of 1884	2304	msedge.exe	117
PID 2304 wrote to memory of 5068	2304	msedge.exe	118
PID 2304 wrote to memory of 5068	2304	msedge.exe	118
PID 2304 wrote to memory of 5068	2304	msedge.exe	118
PID 2304 wrote to memory of 3404	2304	msedge.exe	119
PID 2304 wrote to memory of 2652	2304	msedge.exe	120
PID 2304 wrote to memory of 2652	2304	msedge.exe	120
PID 2304 wrote to memory of 2652	2304	msedge.exe	120
PID 2304 wrote to memory of 4520	2304	msedge.exe	121
PID 2304 wrote to memory of 4520	2304	msedge.exe	121
PID 2304 wrote to memory of 4288	2304	msedge.exe	122
PID 2304 wrote to memory of 4288	2304	msedge.exe	122
PID 2304 wrote to memory of 4084	2304	msedge.exe	123
PID 2304 wrote to memory of 4084	2304	msedge.exe	123
PID 2304 wrote to memory of 1088	2304	msedge.exe	124
PID 2304 wrote to memory of 1088	2304	msedge.exe	124
PID 2304 wrote to memory of 2564	2304	msedge.exe	127
PID 2304 wrote to memory of 2564	2304	msedge.exe	127
PID 2304 wrote to memory of 2564	2304	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://generalstorageltd.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff807ddc188,0x7ff807ddc194,0x7ff807ddc1a0
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,7020101572218353222,15936666340592152746,262144 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,485619828805493966,8373420937986813928,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,11707896850139613413,13915041296627446546,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11735957821642052029,15364486075472283525,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6442308555426972575,10988662499013298841,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,3707731232233411635,1130051664123536214,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,16641404341531981761,17899183405028745302,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,13475197204087656537,239994466109190879,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,831344654577103729,8275430853908639008,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9517202023571505759,9125739065059375173,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9517202023571505759,9125739065059375173,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,3176694318561078889,12771277211975028561,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3568,i,5453772780162783411,3006188230015944646,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,5349602679845773885,17171504975736304,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,15321122145886888468,1500987687794205063,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,18568900138024494,16432366623807029145,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=744,i,10555075820307671015,16111249906201757879,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,7239399394020183813,17059657435488829749,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6028,i,8496417893534804290,9578770254122284693,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2940,i,12097689760693119577,9028422407111276364,262144 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6128,i,7966603304933184504,7634220878024542803,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,9527440437899382572,5207093811946351005,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12272808767278972990,3788602118057426929,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,17841476243043168992,16450322434028932261,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7968026834952059032,13000558667983678354,524288 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6192,i,15090677353135462174,802603203194347583,2097152 --field-trial-handle=2356,i,14164436141721383085,3062603611362544342,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8c34bf9c7295484a8d751b61cdf4c3698d87cb032b94084cbb027fb316a04b7b
MD5 ebc19f683bf81b7b9b5b480e47208d05
SHA1 3ca4b1ffd21c38a4a2d75f37bbcdeeb73666afd1
SHA512 17acd44ee0dae82a2371b5f51139b753248a53a6ba5e7ba019e341deabca9844b30a666a86e4babd921ea271cb35950f745d02d0abc1fa394b037244ac431651
TLSH
T108E0268567D9C63E9210E56751A4A30CC3C17A1F97C8691A5B10CCA83401068B7A2AF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 386ed8a269753b45de48ba28ac1c3274ea04aaf4309ae0ff9097b12dabbc3d4c
MD5 3b57fc8ea538ab435bd900c5ea511a40
SHA1 87cd466378e4d9d4fa93ed3cd3c9bdc0a23b7311
SHA512 645d2f28b6956929087f0845675a8e944db108943ac81751b32c1bbc9cbd07279454d72881f7d66d01607dddd208e44a2d1360d938f8d963ba12f50b3be7a791
TLSH
T1E8E020DA2BC4C35F9101F44B415D470C81C13A2E93C47A199B14CC9C350215067F3DE4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d32d69f4635aa7ad4810484a26eaa88be3b4874c185fb5db225daeaaa2ed6715
MD5 4814a5a97ddb1bc69e7bb69d8bd665d7
SHA1 1141e7033a29c24522f44d0224b24aa42e51fe6a
SHA512 bb568c1ee3bdf67bee2f11f8767c707bafe92339b9918a5e652a2e6e8be768614b2f6d1362f92751db4d1090ffb167917ac7e1d6f5adddbc0c59ce0ae64d29c2
TLSH
T178717009829308B2F3829A3DDDF2151B7878C74A0A5B1F72CD10BF3DFD05B12AA2AC05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 07eb0bedd935c7224d749921b497308c82684a022da488036bd6f32fe6958e40
MD5 50b03de26cfd6e86f716c40f96a83bae
SHA1 6f9ce730ad9761fed85de2dd42595ada19be52ee
SHA512 45de367271561f5b46fc77bb57ed1210b979bf06bf40b0bd6f8d60af2071eead6504b294f0c49ee4ef0d1b03f2f039e109fe9bad96d8c14041f9a8aa6633e20e
TLSH
T137716109829304B2F381993DCDF2151B7878C74A095B1F72CC107F3DFD05B11AA1AC05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1c02dbdf34942234a0e63694ba2d936eb7d3f55df160fcd1c806d6262e99b0b8
MD5 9594e4db8762f66979a7b80a91ac8ce0
SHA1 c6ee4e1b06f71cc0c4b4e7c610a1c7a15a36457c
SHA512 1b13b1376c98290b802f57a14cdfe31e6a8b089e5ae3856a548ddae68ecff356d44c2c03aabdaa835101ae74c20ea77a14732ccda69dd7ec5eaeedc96cf36bcc
TLSH
T1C521A0F383E185AEDA1156F09A18BE2BCE2D0502431C7D6A95E0EF27D3E3075E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 08fcc4bcccf48c2b22ab9069fef6ee6d789081d56765e837380abe39de15a46b
MD5 28480283e38bfdb5e810a3393e1f539b
SHA1 18c9e49a33c3fdbc301079ce78194b7b5b88f993
SHA512 f588a1e13d8a54b40434b7f76d9342f0caf76a29c7cd51c63b12a391d0c6a1ea30465e85e5bb428e87ca8e0816708da61ab7ddf2fdd087934c2304be43596f5c
TLSH
T17921A0F3C3D585AECA1156F06A18BE2BCE1D0515831C3C5695E4EF17A3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f174f7cbb15f026ee6fddbe9844d727a46c5a707ee43dcbf267c85bfee21e43f
MD5 b30d2ddecee3f5843294917b94a489a0
SHA1 0de914714fceac4cb1cbf6d72e336c3556e2ed6b
SHA512 7ecd4e3670b027d7f0bd80ccacde74827d5307e472ece252a11c4a065915ed0735f67f883d933b38cdf6368a88519fd43ea5d305aeda36d900a86a154fa8ee22
TLSH
T189117DB3C3D585AE890156F06A28EE2BCE2D0516831C7C55D5D4EF2793E3075D10259B
MD5 SHA1 SHA512 TLSH

Submit Download

d0c0d241-7697-41d1-8cb6-d17c784edd9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0c0d241-7697-41d1-8cb6-d17c784edd9b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6cf8ca0b158e7a099a355b064925a1ee50c693b7749c850f6a14bb5f90d413b9
MD5 9b7e4c78a588e15850645edd48670551
SHA1 390042c9080b8b61f83f0a743cc4d110103a9090
SHA512 66747a6863de776ff3cb655af3cf33885a784e5a6b3e14afcd74edaed64acecd1bd7ca4a16a8790b099c5dc4c7da98c5bbe49715144385c48fa7a6c93e4b7e88
SSDEEP 192:sxZUR5yM/jK1Ml8MkW/fLsL5JRIIdpJHW6+WNGYHlqSHjIgrJ:sxZUJMW/fLsL5n5JHbGw9
TLSH
T1EC42D8166B38597BCCDBD209FA55BF53D6F50472A2900E44A9FCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e0753d5131200a97491d05e6958bd629c453555a0c16168268a40d4fcf906944
MD5 fcec0f736df3fcfd43166a620286fe78
SHA1 7b7405ef44f842c22022b49e58d106502b7bacd9
SHA512 fcfc0f9e725509c94b58bb7fbaf5609d37cc2607a902903cf27c771b985c813582c68a937118290906bfa477cf5ad272b7a6795bdf55ec721a57db6f63c2e3b5
SSDEEP 192:sxZUR5yM/jK1Ml8UQNkW/fLsR5JVhVIdpJaHW6+WNGYHfNuHjIg5OJ:sxZUJqmW/fLsR5ThmgHbGdg
TLSH
T1D352D7166A38597BCCDBD209FA457F53D6F40472A2A00E44A9FCCB0C05E7AED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d6d37cbb8279c5ae449f5ee084a11481ed309bd553a2ca60da2606f519c2cbee
MD5 0718b7d30d2cffc2c3c601e74fce1849
SHA1 ac3a3398b8f45b8d391095e6a008af062b27fc6b
SHA512 a5ad042b8a7c977ca3e8613c0500472a793c159af0b6e65cc7647dbf902ebbd1179eafa665264ae96b3ab449447554f0eab6565401196f9210fb266b6748be2c
SSDEEP 192:sxZUR5yMqZjK1Ml8UQNkW/fLsR5JVhVIdpJaHW6+WNGYHfNuHUIg5OJ:sxZUmqmW/fLsR5ThmgHbGOg
TLSH
T11B52D7166A385977CCDBD219BA457F53D6F40472A2A00E44AAFC8B0C05EBBED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d742517a19ec917ab660dd79e82e36c9450a1c07af8a702c577216b7cf06b1e6
MD5 dfea25dd4acd8b884a209d2e4098e87d
SHA1 65ce0b4018288bede064df454d9733bad7d58af3
SHA512 7919a82a16295b6d45a323b69fccc1760678a92776b253ffd8e5a1144f9bbf9668788df2d9731da77d9628bf7a527af627e43e2286f1c9b61d924b68cb64ca66
SSDEEP 768:kLUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RvroVG0f:kLUZYTMWvg0Pou1ja7eLZmR8/f
TLSH
T16DD20A2F280CCB7E4F844E9DEC266F963DD801CB5A984D5447EA894C03CB7EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d0322cbe8c78ed6ffdbc36ffb0559ce34d53ffd2690bba850210fdd30ab6e53a
MD5 d989f327d7e447532758865c39bf08e1
SHA1 5a5ac3b5bb196f69cb784f5bedad918f68b65681
SHA512 c189fcbb7bf1785891c2db1d2047e2ac68f803210acafc3f1b0fead7eedfa075c3d34f0d9ab99956b2b905080f3d5937555ced10762cacae336a463bc58356d1
SSDEEP 96:KA1eK2AgHWKIAWSi0KDi0+0KjKWG36K0IcofoIotopoI:E0lPUzNPofoIotopoI
TLSH
T108D1076272BA02117C7E3A4893E4976FCE42B1633018E52B7BAC01B58D26D279CFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7334cf90-93e0-41a4-b683-c11d7fa9be10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7334cf90-93e0-41a4-b683-c11d7fa9be10.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ac36647cb2f170a2dda00937a749ea23814454cc3013d40073b30dc328fd9ebd
MD5 e1226ff9ab227128263fda3f974e8ef2
SHA1 d82c679af48d702d6a2100c1f67a434540a05c17
SHA512 fed9a393fb189f65ed75d65b97b44453a2be9bc4074ab077504545175e93eacd8c1bef9c9da510b11d557f1d6473d85af378138c93ef3f0122512c2535c2c0ed
SSDEEP 384:GtNn/s3n9SfsNGwPoxRzX5od+d8yiXXr0OObjI9G6w7OV:Gj+9Up5O1r029M0
TLSH
T1F4928D32A8286D6B4DE3A594F54B36179FF8916F87842F84D1EC6F0C01DF6AC4316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 14787dc5616f552b4138772de4b8598e1d87cdb6f7063ffb08f18dfced56b4f4
MD5 238fc59afd31c6bc71f5e72686ed8e42
SHA1 c9ca30ca07f11ee109efdf99b0a620bad0cc5156
SHA512 96fa48bcd9601a299eebcf685cc49762b04637db43c4066bf140d9a9e5bf7db87fb09eea4b7326ba206371e96f0f15e7f9d9968b1bc65d041ecc530e3b464b61
SSDEEP 384:xOiF1tNn/s3n9S6zsNG8TUNTUlIlJPoxRzX5od+d8yiXXp0OObjI9G6w7OV:xlF1j+9ZHwgK5O1p029M0
TLSH
T13DA26C3398589E7B9DE29A94F94B32178FF451ABC7856F84E2EC5F0C019B5EC0306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5725be359e6cadadfbd8b193f7e6c123bf72494d2a3b48cd54dd32a72bd90b3
MD5 bf03830655ba8d8b7c84645a6f0026c6
SHA1 a58e0a4fa2efb40e70f30a7e6c37ac61c977ff22
SHA512 d4026b93a241a84d75ee1b8f0b3d40887751e420fa233137dae71f2fe9707edd68f249692906730bf924363b4062ce0da1b213faf7913a6396e2ca183c8e556a
SSDEEP 192:yON761VWQmiUyyTgGX5Obd+j1jzoryiyR//ai3EQU6:yON76WbgGX5od+d8yip1QU6
TLSH
T15E02C836A8686CBB8EE2BD49B44737135FD4106BEA956F84D6EC1F1C00D765C2346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ea44a7becae0810d1c290dff9c799d62596c8132c87c135ff0dfafc4d3ddf361
MD5 5830310167174ed2b73a6ec1b986ff9f
SHA1 2e7a9eb8f7fc6784fe2c2ea0485c2d529ebb8976
SHA512 9504dfd7028c6d3bb0ce765ddc629af9ecb58a410078da45b95b2f7fcb9ada5e0633e08c6104e74267985befac265dbd97be0c21609f6f788458d3f914c5797b
SSDEEP 384:JAtNn/s3n9SfsNGJPoxRzX5od+d8yiXXr0OObjI9G6w7OV:JAj+9US5O1r029M0
TLSH
T16C928C32A8285D6B4DE3A594F54B36179FF8916B87882F84D1EC6F0C01DF6AC4316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc1061ce96612a22e36e2bc4d44b1d872e356a0ce691dce11fbce76957ad695d
MD5 37094b6b7805035cf675a85f34843cd9
SHA1 a647bef68e75fb24e86786df575ce010d8c16adb
SHA512 532ff9f1b80c72b98b4e0ce8a153ef7dbd82e6bd1b22e8f2a80a00479b421b49bf849eef56716819166c0b5bcefdd4440a2f519460f4a3675a88a5e7ae08576d
SSDEEP 192:MON/61NWQmiUyTTjGX5Obd+j1jzoryiyR+XjTujJqq7YU6:MON/6iQjGX5od+d8yiXXS0U6
TLSH
T19B12F933A468AC6B5DE2B595B44B32139EE5512BDB897F80D6EC1F1C00EF69C170AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eedc390a-3e9e-4917-848c-6789b4794d99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eedc390a-3e9e-4917-848c-6789b4794d99.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da09d1a319eb96c4bd9fdb43527a0b153f99f743b97d820ce4540e7d61d27116
MD5 f2d54522b1ff8a9c2a15fbfa05141a60
SHA1 ff138b3df002db9d7bd941486b16cdf7bb7e8b15
SHA512 c1cea37920ea0992aee2324cb2a0e900fc0a4b0b0c80a6cf91c637c8e05496d80c5729494dca9733d9c05289cf66ad45ee7d689864e37a17e9e9224a399a29d5
TLSH
T15A41F758B6EA1144B3B77F5AEBF6A86E44BEB9372A07945D10110E4F0A37B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download