hxxps://acs-ussc-dev-mtcfe-01[.]action[.]azurecomm[.]net/api/a/v?d=AIAACGR7VF7Y7Z6UNI43IH65IRNV7PNWQZHDWIKMS4ZLYYZ56IDL5LHV5C3524VKTUF4L2UIS3AG663YZPE7UCGLRGVICNKGKWAA5N5WHLOD4DS4DHWD7ID3YLG4XQ2LK23QEJNPU4ZDBSSWHHQNWKRW7OWJCOIZBDJYN7SRP5IJ25X6A4SIRBAHZPAEHDARHM3ASEB7DUPMGWWRDSIFMDDNFQJ5DVUCA3EATNTDJOX2AXA46S7BCZHIWG2ZTF24OVGQSY7NCY75CRROK7UPCR64IQSUQCI&i=AIAADDZLMGEGRCXMA6KOYKIZFM4U5A7H6R7MXFOSGRGW7G2K5TJNVGJFBVV6BYPHFY7QZOLONRQT5OSESW4ERMBQYL4ERLFGY7GDDPRBDRZLR26MUMCWZG3LUTKBQ2IROODJMOFSARVLGB2L7SOFLSPRGNPFIZ7G5L5V4TEJSTNUWQAYLWUYLKVVJNSIGL6JTJLSNIL6PF3OIETKRTQNBCPTM3UKRRADPCH6E7Z56D4W4PJ73ECGM4V3CRMMYEH2ELB6YVUGNL2CROC5I7Y4OYR4XMLU35NAIVTRGMGFM3EQH4PKKZSQ3EFA4MGVHZX4WSOXCEZ4CPKXQJTXXM

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://acs-ussc-dev-mtcfe-01.action.azurecomm.net/api/a/v?d=AIAACGR7VF7Y7Z6UNI43IH65IRNV7PNWQZHDWIKMS4ZLYYZ56IDL5LHV5C3524VKTUF4L2UIS3AG663YZPE7UCGLRGVICNKGKWAA5N5WHLOD4DS4DHWD7ID3YLG4XQ2LK23QEJNPU4ZDBSSWHHQNWKRW7OWJCOIZBDJYN7SRP5IJ25X6A4SIRBAHZPAEHDARHM3ASEB7DUPMGWWRDSIFMDDNFQJ5DVUCA3EATNTDJOX2AXA46S7BCZHIWG2ZTF24OVGQSY7NCY75CRROK7UPCR64IQSUQCI&i=AIAADDZLMGEGRCXMA6KOYKIZFM4U5A7H6R7MXFOSGRGW7G2K5TJNVGJFBVV6BYPHFY7QZOLONRQT5OSESW4ERMBQYL4ERLFGY7GDDPRBDRZLR26MUMCWZG3LUTKBQ2IROODJMOFSARVLGB2L7SOFLSPRGNPFIZ7G5L5V4TEJSTNUWQAYLWUYLKVVJNSIGL6JTJLSNIL6PF3OIETKRTQNBCPTM3UKRRADPCH6E7Z56D4W4PJ73ECGM4V3CRMMYEH2ELB6YVUGNL2CROC5I7Y4OYR4XMLU35NAIVTRGMGFM3EQH4PKKZSQ3EFA4MGVHZX4WSOXCEZ4CPKXQJTXXM
Sample260705-pgssjacv2x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277275181895427"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{4E725DCC-EA92-4A1F-A140-EBA5DCBA572E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4344	4476	msedge.exe	85
PID 4476 wrote to memory of 2532	4476	msedge.exe	86
PID 4476 wrote to memory of 4804	4476	msedge.exe	87
PID 4476 wrote to memory of 2532	4476	msedge.exe	86
PID 4476 wrote to memory of 2532	4476	msedge.exe	86
PID 4476 wrote to memory of 3472	4476	msedge.exe	88
PID 4476 wrote to memory of 3472	4476	msedge.exe	88
PID 4476 wrote to memory of 3396	4476	msedge.exe	89
PID 4476 wrote to memory of 3396	4476	msedge.exe	89
PID 4476 wrote to memory of 3396	4476	msedge.exe	89
PID 4476 wrote to memory of 1764	4476	msedge.exe	90
PID 4476 wrote to memory of 1764	4476	msedge.exe	90
PID 4476 wrote to memory of 1764	4476	msedge.exe	90
PID 4476 wrote to memory of 1528	4476	msedge.exe	92
PID 4476 wrote to memory of 1528	4476	msedge.exe	92
PID 4476 wrote to memory of 1528	4476	msedge.exe	92
PID 4476 wrote to memory of 2928	4476	msedge.exe	93
PID 4476 wrote to memory of 2928	4476	msedge.exe	93
PID 4476 wrote to memory of 2928	4476	msedge.exe	93
PID 4476 wrote to memory of 4008	4476	msedge.exe	97
PID 4476 wrote to memory of 3384	4476	msedge.exe	98
PID 4476 wrote to memory of 4008	4476	msedge.exe	97
PID 4476 wrote to memory of 3384	4476	msedge.exe	98
PID 4476 wrote to memory of 1192	4476	msedge.exe	102
PID 4476 wrote to memory of 1756	4476	msedge.exe	109
PID 4476 wrote to memory of 1756	4476	msedge.exe	109
PID 4476 wrote to memory of 1756	4476	msedge.exe	109
PID 4476 wrote to memory of 2524	4476	msedge.exe	110
PID 4476 wrote to memory of 2524	4476	msedge.exe	110
PID 4476 wrote to memory of 1180	4476	msedge.exe	112
PID 4476 wrote to memory of 4316	4476	msedge.exe	113
PID 4476 wrote to memory of 8	4476	msedge.exe	114
PID 4476 wrote to memory of 4544	4476	msedge.exe	116
PID 4476 wrote to memory of 4544	4476	msedge.exe	116
PID 4476 wrote to memory of 5040	4476	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://acs-ussc-dev-mtcfe-01.action.azurecomm.net/api/a/v?d=AIAACGR7VF7Y7Z6UNI43IH65IRNV7PNWQZHDWIKMS4ZLYYZ56IDL5LHV5C3524VKTUF4L2UIS3AG663YZPE7UCGLRGVICNKGKWAA5N5WHLOD4DS4DHWD7ID3YLG4XQ2LK23QEJNPU4ZDBSSWHHQNWKRW7OWJCOIZBDJYN7SRP5IJ25X6A4SIRBAHZPAEHDARHM3ASEB7DUPMGWWRDSIFMDDNFQJ5DVUCA3EATNTDJOX2AXA46S7BCZHIWG2ZTF24OVGQSY7NCY75CRROK7UPCR64IQSUQCI&i=AIAADDZLMGEGRCXMA6KOYKIZFM4U5A7H6R7MXFOSGRGW7G2K5TJNVGJFBVV6BYPHFY7QZOLONRQT5OSESW4ERMBQYL4ERLFGY7GDDPRBDRZLR26MUMCWZG3LUTKBQ2IROODJMOFSARVLGB2L7SOFLSPRGNPFIZ7G5L5V4TEJSTNUWQAYLWUYLKVVJNSIGL6JTJLSNIL6PF3OIETKRTQNBCPTM3UKRRADPCH6E7Z56D4W4PJ73ECGM4V3CRMMYEH2ELB6YVUGNL2CROC5I7Y4OYR4XMLU35NAIVTRGMGFM3EQH4PKKZSQ3EFA4MGVHZX4WSOXCEZ4CPKXQJTXXM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe590ec188,0x7ffe590ec194,0x7ffe590ec1a0
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6808736357224903177,3514796209077248705,262144 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,1148164805958138285,2153945149825335012,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,7660212800609648928,1112257658529181441,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12098797858161033054,17892091451371635777,2097152 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16922078164913479698,17563955528819358802,2097152 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,2750712559282095923,15897656587677681138,2097152 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,14317463405279225705,12941520985075543685,2097152 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4185653218567742345,7916708619577948712,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,454189310426111231,11224738398362096117,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1033194835752303201,13465213468568791557,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1033194835752303201,13465213468568791557,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4296,i,13774733582629855880,11753909605659347992,2097152 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,16435801431921535806,14308909793995566233,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15809978550984041274,4076688414495481550,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10586010052111689363,8441301325017724185,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,15537498324089679166,16678345885946548590,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,15720768533312256583,15387703310469323029,524288 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,14951934968228126219,3360367917818093095,262144 --field-trial-handle=2236,i,6238836450096816522,17561198413358456850,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a77a61b888441ffda62da8932ac81d9ac99d9d6ade16dfbca8f7fb45020d8b50
MD5 b9d415fbb272c98db83e101483eff743
SHA1 caf07fc8004e959ea4db97269b37b1db136a9a26
SHA512 f83fce51ef08c431d01bd24c42deddfff99621fa1e080b5b9703943a1454c379a3c54ac4fb94eca93b6c048a9a1fba634bb70d94074380041b3b652f2c0a3d7a
SSDEEP 96:xV7jIrmKt3TBz/LNTrB/811H9VcV4rVEA0ok4NjkaV:T3EJTBrBBKH9VzD3SaV
TLSH
T1F9D1E768219D210DEFE0BA76D3E12E85B6744C497D2B1F1A1350DB7C7C4378EC626627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590517.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590517.TMP
Size 3KB
SHA256 5da10c8e82e47bd900ba67ef28ced88c42c982ee8cc5ff197b3804bb93acc993
MD5 6726927ee74c132b04eeee057dd45ff1
SHA1 a03be908a986269c12e67ed1f8e44b9f70b5f5fd
SHA512 66037ac96758c167682cc38b42f2b85713c746e8d6de43319cc69bba7446d4aadaa86f6940363bb242da51ab734ae203f60f661f80b18321222e2f5b068033d6
TLSH
T1B4713C283299158EE3E1F0B2E7D20F4937B44C895E4B5F561364CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cdf448467c36b38079311c07f2c2957ab14b603c9b8ea71731fac869495985fe
MD5 3cce209087a0f1000bc424fe02d3877d
SHA1 d1233e93ac30327901ed1a4f3cfab929710d909e
SHA512 f2d6a962f829cb7c6e026c3afa3e16822ae0ad1e621fd098ab4765b970e96fb397500167e032958d619058ddfc3034350fe64888edfe7a91bf687a5fba693f3a
TLSH
T1D971B9F3C3E6866DC91195F0AE186F1BCE1D0446436C3D5A89E4AF4BA7F2461E112B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 082fcaad9a2fb9869f4c290035330eceb12445f62d08ae6c3e62c1d0b4778350
MD5 ac3293bcb17aea6b77210c65d86f4cdf
SHA1 9acf5c20626192b1668dabc0a2faa83edae30b30
SHA512 d4d2ebd53a21a239f253d89c62f1e612457fe3cd83d77fcd6fea0fa76be55a85715926b0290448d4c88c4b58ae11af5f2c6e0a991fd747d1aed4e0eb08b12b06
SSDEEP 192:sxZNRJyM/jK1Ml8Mkbn/fSs+MQ5qIdp5cHW6+WNlEdb/Y4p0+EIgrJ:sxZNLMbn/fSs+L5jeHb0/S9
TLSH
T1D842C8126A385A7BCCDBD309FA55BB53D6F9046293900E44A9FCCA0C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e9f17d5ca4a217ae1db2ac948f1029bb849039abbd894dc64889b2ae280623d0
MD5 c321289b658d4b018e6f057015f4725a
SHA1 51df467778ffdfab5f566fee9f51fb42170a745f
SHA512 caee1ad27f467bedcb3c5297f05be02587df63517881856e89a20a22fd2eea84e590270b14db02d08acf4b752de285a7902f749bbf47669288b1d48a89e19689
SSDEEP 192:sxZNRJyM/jK1Ml8MWObn/fSsfMQ5S8bH3fdpmN9cHW6+WNlEdbqt51/Y44U0+EI6:sxZNLuObn/fSsfL5S6rPHb0A/WBr
TLSH
T18962D8526A385A7BCCD7D219FA51BB57D6F80462D6600E44A9FCCA0C04E7BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4d08b9c0a8ad2ac30a840e06ca8636d8d34a2aa7091c2c343d8994c0260ab3fb
MD5 81b6cbce6d33b7cef3eb9cb250dce2a0
SHA1 b73bc536f5824c497489f5df1acd25cd31461f1e
SHA512 9e89c87217bdd2cfa9684bd2d2ca71f8e5c5db998f78621b5a064579d4f6ff59a1e043b8a628f52b2615157cf041c9d582bc2582dcb0d972a44f2352764ce173
SSDEEP 192:sxZiQUnoRJyM/jK1Ml8UQbkbn/fSsfMx5SxrbH3fdp4N9cHW6+WNlEdbqt51/Y47:sxZEnoLqwbn/fSsf+5SZLhHb0A/gf0f
TLSH
T17782D85266285977CCD7D619FA217F53DAF80462DA540F4CA9FCCA0C04EB7EE221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a4c899e07a901281bd9d1643196a5c8a9b2b14b0a5fd2fe7c69a70f130cbfb61
MD5 e8cf3df900d2eac06c1ed33304478883
SHA1 e920e7f582297e990096dc42fa9b59616e076bc9
SHA512 c73d3e075a6ac0afd89cc1565698da80197ce79626cae7d072fb443fbe4f1f4dfaac66fdb3d7cbba4b112dc5ee861a23aeb463051eacc65c19b1e02c0c5fbb28
SSDEEP 192:sxZiQUnoRJyM/jK1Ml8Mkbn/fSsfMx5SxrbH3fdpmN9cHW6+WNlEdbqt51/Y4Wiw:sxZEnoLMbn/fSsf+5SZLPHb0A/N50f
TLSH
T1AC72D85266285977CCD7D619FA217F53DAF80462DA500F4CA9FCCA0C04EB7EE221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 77da86f2c5dd18a4d2ea1abd08668e71742aeb2d5b51fb99bdb26e99f16a1239
MD5 2f3dc8502217aa338bf7165b81de6a41
SHA1 8245a615e48d0b5da3ce1fe5f651f5f7b59d72d1
SHA512 f83bf8a8bf1a7ca13642a8e40fb2e06b71e8614cd5a1d191a3f0be467d7bbc8bbf9d8ef3795aee27d8b0388486c2dc2e0b884d87584c8f632ec2ae970556caa9
SSDEEP 768:b/8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd0rovkEUne8:b/8iJPNWvx76ru1jahALocdffUe8
TLSH
T1A4D20A3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 b937ee3fe41ec2a9acace376f94b3cd0b245c3ba83572d845106ed150a8b3e92
MD5 9a175f1970623dcdab37c5faeb1e44ef
SHA1 989ef70a90cb0c941b700ff5165614a191ef267a
SHA512 84601099ba78074c3e00df7d671d130217b94b525b929eaaf624abd82d822768b68f3a12c450b084745e18b6372079050330c8ccdc42597c2575b106374f2731
TLSH
T176A00250DF904405C01253F1255303451751C9B7210033074DD30088CD904C58D4200C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 cd08c26abcffd9f37634706fcebe08f063fa209069e5d016ebb856aeb30f6b14
MD5 b3ef9e1e953a91f8d3dac23a3e5200cb
SHA1 61172480a7c866c64709174083d6b1ed20f47c9a
SHA512 0c730d0cb7709bbda1fc43a9281ee82ebc0d07c8958dd9cc80ea30715b642dac0b4ff291e1772949f7fe6c276f1da0473e52691ccbd17241c18f3d4945c20027
TLSH
T1D5A002A852D44007D40252B939D6117A2211C951F309530645B903A4D8D05E946A301F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 3f53b0437fd8f1006b48fc4154ee1c9e484019d57cf932bbfd213c36c29b11cd
MD5 08c2ce191ff2a98fb544d458468a41d5
SHA1 7de19ddf3f97e13e74942030f25e35ec8fd0ceb1
SHA512 fdbf82af1f7315568d6240f3bfcec7861b186cc871011cecb175355fd92be9d565ae36d91bed4825f063bb1f5f4721bea413c2184d56303e221297c0813667b7
TLSH
T10751D84E8E49285ECC6C1172A8FE14D6337E7CDD5F488E0B26AD65347CC733C190415A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 76d673609652f8dab32d6c16adc9420e28a86491a3e6886e42ac58f1272cc51d
MD5 9dbe2dc911b2fd71cade326908d352ba
SHA1 15c3bf0bcc9fad4ca1b48eb486cf7cbd92cb5940
SHA512 82e7f0d931e8cdda680a373875ad727fd276c5f2488d87e4b120bb2cf5aa2172df0f4b79a060f245658e9eebdd94336caf5e9d7d46f5b0247354402ae44aa40a
TLSH
T1AE2112895DE18E9FFDA045B2127669A4737084DC1715B7135C3C31313E2675A360B9EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a256.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe58a256.TMP
Size 1KB
SHA256 219b99998587485d0cbc5ad9f456c767be49a0009a38c1cf9c0c54e98bda02dd
MD5 b20099cf862a5e8d6d0fc89c6e886e03
SHA1 7fa95627cff5f6b779a686a02f5480a7a34a4afd
SHA512 f516c91dc804acc7baabfaa3b64801e428b860a4c184ead6d762147561f6e5141d90c9aba835baa4b667bce5cc332a0a262bcbf0d733542afbee0219a6f0e23b
TLSH
T17821148A4AD18E0BF8D450BB1E63B4F8733589009721B3D3A97C62795D25B8D2B4F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ddc437cdb20ca10739dbdc6d60e1d45f6253dbb7b428f95cee0a840ea672be9e
MD5 55e4ee107aba60e21dfe7360f57de810
SHA1 7fb69928acb4ecda79ac4df349ff3e592f436420
SHA512 8f2131db35ce75a0436740b16f8062f991db9a52e1fdd1660161d5c904216bff7bfa385292cc712cab84115c0a38278432a016d51379cde74426314a001318bd
TLSH
T17EE0C0F72EFB2844FEBF67E10570A8A00285B459D544BC8F141AEB832461352340AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dace5248bf840f7e79ec3f7798d7dbd6c613fe7a456dd6dd97ab8ce9ce749cb6
MD5 c7dd32d90fda5d5045ba3b29dfc20383
SHA1 c951c0c7385e397a8b1b1a0e96e0701f4fb23c76
SHA512 016d34ae230803b97e4a677863fc39193d58225d7b9769603a18c6a170a771c5357182cfa186920adb101301a0a0590fc2c1cd1d6e1ea8119b2207fb13e75d04
TLSH
T16CA002B6D15E4841E4000370F0C1419C6220CE308615332352E50194BC6A140456A606
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f95f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f95f.TMP
Size 48B
SHA256 230a8a7b1d5c0586ecdaae35d484d1633e1d4771883ac845eac38cc251f4ddb5
MD5 c3d642c1089586132d5616a73be8529e
SHA1 0b6f92f7a018200dfc74b2119a75fce60bfdd3fd
SHA512 8c96212ac14157be5b2cf9bf29ec9a94cf2dbf57ef2aea66fa1f08593cdad9f47a120dfa62af9b324f0592178ff67312d0a5c52050d98401fa272ed35912cece
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d596fb1b3445fcd28735e41211c74b5a580b849228d0afa7f97656cbaa14b903
MD5 17bdfb9e9b90759cc2b323c95dfce2f9
SHA1 42b1699f6d97f805659ed578232b6a435589d0f2
SHA512 72f381d22bfb371430519c10f8ec2032ff2abf92bfa4f19382e8956b5a088ca7683c0aabb6d4d651aaf0ff7400512f127591f3c1b3fec30906c8c56a1ed4f944
SSDEEP 96:KUacKL6SqIKKwgc9oMmqesWa33gUsK45gesc8M32cxHEFw0Oy2UWS/fg8UK4X:q3Mgc9oMmqeza3wUQ5geT8M32cxHEFw1
TLSH
T18E914516717A02813C7E390991A4D516DB86B2D33114F42B3BA802A30FA7E316EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59480b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59480b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d0404885ef29d2993955453652a82c705c7181dbd25563e8e8bc363deeebc644
MD5 f573a5b85834eba5bc4904dba683cadc
SHA1 a2f1298361b20305b2ccd08bd504cc54dde153b1
SHA512 b3ae4d3334c7659697bdefd248928c8caef11c5b00dde803c33f1aea786f9e045dbd067be416618ec7d3024738b070571316e23121b283ccd48e68b374e45ac4
SSDEEP 384:BtNn/s3n9SfsNeaVjoO9kWOpA1OObjI9G6w74L:Bj+9UuB3129MO
TLSH
T181929D31687C6E7A4D939155F04B3A2B9FF845BBD7C92F84D4ECAB0C05CB2AC4306516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 41a78d412a36d9b4870d634fed018a18ef00bf4e413f94a22ed370f253d430af
MD5 d648ecc238d7d78f50a2c62ff855e7cf
SHA1 8e16d58061ed2874e7e7e18d0e40a7b2da8c0fdf
SHA512 86db079104fa62dd8292286c5a98eafa5928070b4abbc427bfba106ba15279ffff1e3c9d501c2666f769547bd4db665c946b74104c8263bb3e59e93b0b2edc1e
SSDEEP 384:UtNn/s3n9SfsNeyTmjEDm2kWOpA1OObjI9G6w74L:Uj+9U3kmS129MO
TLSH
T1E4929D3268686E3A4D93D165F1473A2B9FF8857BD7C92F84D4FCAB0C05CB2AC5306516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b5e914c9a69fee155b317832f52f5f5d94dc24c9fcc7cdc122f6f2847615b68a
MD5 a71378d3fd8afab997878620a767c190
SHA1 ead493fd6d205ebdb9e06018af18782c83339be4
SHA512 98f3e339a3d573bcb1537a692ebd81a799e16a1e9d3c13e8383f6d17462a6830c0d9d424400f8e0b46d50a9cf7fc6e751ae16dae5e74206b743c8100225e76d7
SSDEEP 384:MiF1tNn/s3n9SxzsNu8TUNTUlIlyTmjExm2kWOpl1OObjI9G6w74L:3F1j+9iTwgr+mz129MO
TLSH
T101C229F258DB4A3ADD9E8757B33E2D174EBCC167B6855A44B3D85A0CCD861BFC206801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 563696c044229af0071bd9adf230101ce897d675c104b03c726565d315c42ac5
MD5 96d6cb748fedc4573e8f20fa7784f62c
SHA1 f9cb87903e9a1cfd466f7fc643790091749dc504
SHA512 6267f7741d674661c21217367d537124567413727f223cbb78bca8ca0964cc413f6ea462c3de7936988c6dd06346fd800375cc327e0a7f86c84e11e6018a7543
SSDEEP 96:ZqONk7QsjpfmUTmDK5ih/cIPURHl8h4otop5v5DrBhPwivh50xy0SFYKDAxvYeb9:gONz6kDfQmiUyBVZ903/i+Qit6aU6
TLSH
T14F02E935687C6CBB8EA3AE45F48677275FA5113BEBD12F84D9E81A1C40D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d8592dd52f1a53150d25f3e544ef1deaea96c0f756cd2028dbeae42304b06d1
MD5 c5cbd9ed28b28e8addfadf91c31e455c
SHA1 0f572e5388e51d9ceff44b3d4c99e4923bd2493f
SHA512 21cae7e45a36969b99cf20d22b8fecf8bf4a3d7aadd7a30373b98bd8c0fb9dd45647dc2031523c089433c99e53c4d599a2dc590ea2af36149e08df621b32ec97
SSDEEP 96:0qONkTQsjpfmUTqK5ih/cIPURHl8h4otop5vHDrBXPwivh50xy0SFYKDAxvYebsD:/ONH6k3QmiUyrVf903/irbNQcRIqLU6
TLSH
T19E122972A8BC6C7B5DE3A591F08732279EA44127EBC96F80D5EC271C05DF69C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6439b46265462acb8ca352154f33b66956fd1da128b8e1ab226b56669cfc97a0
MD5 ecd549fa400289db3ee2e60fdbc8703f
SHA1 c0f46a736731349a3d2e1ab61f83389208910cbe
SHA512 5289208046a99ecd1a084041ae3334174cc6c2595ac1c3ff22a092b1212d0e1a3faa1bcbeee80486a6365089f4f475497b9060f5feb5d2aef71580fe3e498a2e
TLSH
T16BE004015300107DD034533400735F3017D1D01001711707551401545C133105F31FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e104.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e104.TMP
Size 392B
SHA256 a146c8a7d02665d129897d668b8364e4ecb0daf0e5cf50a9cc331dd136d5a9c1
MD5 2120a7181ae34076865c73fa7dc4d4d1
SHA1 632bdfd8c5ae86cc7f1df6d91530696db61c7bfe
SHA512 ade4c56ce22f57650c6f36f7a60a86195e05174e46b2489c59e0d23b8bf724d9ae1a597f50fbb343abc50afe55fe53e485e5f345d0f5fcf70b1d312843b887c6
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63aa7871b416789d113db0ce7a39a2b02f76fa16916971865a8bbf185014c8d0
MD5 bac1c02d1f39e44ef76c3ed3e3ad1542
SHA1 68ed739f9f2aed3cb49733e526e604a8294c1582
SHA512 118ec837a7efc88efc3c292daabd7306beecac1da77ba06c10a214c2bca9e0426d0a4c5215b207a372ac673cef8e838f3eb0b9176c7603b29296eb97f62e284e
TLSH
T144411848AAEA1108B3B72F5A9BF7A46E487BBD232E0AD56D10110E4E0662A01CC71733
MD5 SHA1 SHA512 TLSH

Submit Download