hxxps://x[.]com/advaithj1/status/2073931556973162731?s=46

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://x.com/advaithj1/status/2073931556973162731?s=46
Sample260706-sr77rag16x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278249708675038"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{78AE0553-D258-45C4-B8BE-DA755CF4930E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{238F81DE-7AEF-4076-A2D9-397F1481954F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3848	556	msedge.exe	85
PID 556 wrote to memory of 4900	556	msedge.exe	86
PID 556 wrote to memory of 3896	556	msedge.exe	87
PID 556 wrote to memory of 3896	556	msedge.exe	87
PID 556 wrote to memory of 3896	556	msedge.exe	87
PID 556 wrote to memory of 4980	556	msedge.exe	88
PID 556 wrote to memory of 4980	556	msedge.exe	88
PID 556 wrote to memory of 4896	556	msedge.exe	89
PID 556 wrote to memory of 4896	556	msedge.exe	89
PID 556 wrote to memory of 4896	556	msedge.exe	89
PID 556 wrote to memory of 2088	556	msedge.exe	90
PID 556 wrote to memory of 2088	556	msedge.exe	90
PID 556 wrote to memory of 2088	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	92
PID 556 wrote to memory of 2912	556	msedge.exe	93
PID 556 wrote to memory of 1680	556	msedge.exe	92
PID 556 wrote to memory of 1680	556	msedge.exe	92
PID 556 wrote to memory of 2912	556	msedge.exe	93
PID 556 wrote to memory of 2912	556	msedge.exe	93
PID 556 wrote to memory of 1952	556	msedge.exe	97
PID 556 wrote to memory of 5048	556	msedge.exe	98
PID 556 wrote to memory of 1952	556	msedge.exe	97
PID 556 wrote to memory of 5048	556	msedge.exe	98
PID 556 wrote to memory of 1048	556	msedge.exe	100
PID 556 wrote to memory of 724	556	msedge.exe	109
PID 556 wrote to memory of 724	556	msedge.exe	109
PID 556 wrote to memory of 724	556	msedge.exe	109
PID 556 wrote to memory of 1888	556	msedge.exe	110
PID 556 wrote to memory of 1888	556	msedge.exe	110
PID 556 wrote to memory of 1888	556	msedge.exe	110
PID 556 wrote to memory of 2852	556	msedge.exe	111
PID 556 wrote to memory of 2852	556	msedge.exe	111
PID 556 wrote to memory of 2852	556	msedge.exe	111
PID 556 wrote to memory of 5688	556	msedge.exe	112
PID 556 wrote to memory of 5696	556	msedge.exe	113
PID 556 wrote to memory of 5696	556	msedge.exe	113
PID 556 wrote to memory of 5960	556	msedge.exe	115
PID 556 wrote to memory of 5968	556	msedge.exe	116
PID 556 wrote to memory of 5976	556	msedge.exe	117
PID 556 wrote to memory of 5032	556	msedge.exe	118
PID 556 wrote to memory of 5032	556	msedge.exe	118
PID 556 wrote to memory of 5032	556	msedge.exe	118
PID 556 wrote to memory of 5124	556	msedge.exe	119
PID 556 wrote to memory of 5124	556	msedge.exe	119
PID 556 wrote to memory of 5124	556	msedge.exe	119
PID 556 wrote to memory of 5576	556	msedge.exe	121
PID 556 wrote to memory of 5576	556	msedge.exe	121
PID 556 wrote to memory of 5888	556	msedge.exe	122
PID 556 wrote to memory of 5888	556	msedge.exe	122
PID 556 wrote to memory of 5888	556	msedge.exe	122
PID 556 wrote to memory of 4632	556	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://x.com/advaithj1/status/2073931556973162731?s=46
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x260,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,8282347035400280047,8805475470376832552,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,6104912022976094544,13061352459721279537,262144 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,13131163781597106113,14645510653904452231,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17528383506524463177,8985458904668577929,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,2651041537759165685,5624825491466699113,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4962027714436020100,2910417717891075940,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,16870400649186239053,7057204741806025931,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,747733457322043590,4262360936044801713,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,5308607404356514584,14337434955492038195,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,7283990280537420599,13744357709797619092,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,7283990280537420599,13744357709797619092,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4468,i,15447638703083627043,8906151829652460700,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3640,i,17360484388579217452,18371769419389770287,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3616,i,12249580488394233900,10386111653440094025,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,16054272442279637397,9292573927785604042,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,8015597966086685315,5144760907032103757,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17681779024012940990,8677869177113000327,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17117751878950915175,1975400839567040657,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,8477683415104449948,15892185659322777927,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6224,i,10541452610837273425,11587846044274212417,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5064,i,16351734049286543134,12235699966639198312,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,7393631370411987133,4401927902969688097,524288 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4400,i,14822335828902256522,10796486015370895086,2097152 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,6316976920032815819,3440664332612812555,262144 --field-trial-handle=2332,i,12535384494447694118,16303901731498507715,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27d61c282e4bf112aed3bd07eaaab8788d75224f5e199bab857064cbd5d982a1
MD5 46e65d035adc969e8d04500bca4c5db3
SHA1 fc81b055409d470ed84cfc8497034037eb5a1ee4
SHA512 26b4bf0615d85574c1a8017270ee3e215341811d6c55c46a00d6a9c6c2e6ebbca4202d7b57c225f8b253c27394d706b1e2825b17c78aa7a2e17599e82aceedfe
TLSH
T13FD0231076397AD3D23A147E54718B01B91581777377F3417151440D9D750C6F68B6D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 01b50359473cf205b20380f3d824d7e68744f30dc650506312936f8465c9d9fb
MD5 d0e4f76190a1851d3d504ba8b5df713f
SHA1 705ae7bd359be02ff58bee155e7c43526a1a6f02
SHA512 d6f31cb50b39e8fafce4d2f8ce7a3f9730d01db472ea1e1b2810232a3cba3525d23b3186c3e2615cfabadb8c49748c7ea194748e80ecd77cc7bbe19874ea3726
TLSH
T1B7710C303642C4ADE353C131B8D286F370336DEAF82B5E3000985E7529A5F128C1D6DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 88591152fb4d3f64d77958072f3fd3829b883388b95920e0a49ec14958784579
MD5 f47084cd40acb4d67809faf7d9101b5a
SHA1 63c525006a44707deb029b86af457e718280fba1
SHA512 e033eae75ef3c77cf4e9bbce20f9498db6c49d70a3953071ee1e191b622f331a4176c47bf986f096b5b7f207722c023ed72a314f394f4b7169e54369b8711d8b
SSDEEP 192:zWR9zWejl1jzcgV3kLDcpOVyMv/wZbw/g6SgOu9U:g9z3jllQgEMerSgTU
TLSH
T137322B33E3348BD9E3038D7128C166F27CB789D9F57B5F6122984D38886DB12981D399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 c83c35b79504786864e43835a90b72f0f05e538ceb26e214ebcf3c879cfd15ad
MD5 37e0cfc3a261bf1d7d25567dcbcb6682
SHA1 4cc00f7220d90bcf322dafaf1f223ffcfc252aa7
SHA512 4c707993806ee6749e7edd84922fb22cd30fd5f4d8fbc235f8602c619c663459a7ecf8fda5a7e28a2dd5365407b66d7b45a1a5f242b8a76e27199232f3f12410
SSDEEP 192:2WR9zWejl1jzcgV3kLDcpOVyMv/wZbw/gMSgOu9w:R9z3jllQgEMedSgTw
TLSH
T1A0423B33E3348BD9E3038C7128C1A6F27CB789D9F57B1F6122984D38986DB12980D399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6595bff59905a3eca5c62f1e79b5a076fd6627edc3ce388fd0c29dfaf80cf224
MD5 15ea791f81e8f217c4c4d330842c69ca
SHA1 90c193ac771fa69db9124f1a4787e7a2dd6b9c1e
SHA512 1b3d6e1c775c78d4b0461b80788649736b6a8982fe5c41a46c9cfa54d29b5c6d6481414e693021d06c1579d587214d7f76d659bc92fe684b8755289ade37baae
SSDEEP 192:DsC+rqRVAUzxf1kj6VQ5E/kFg536mEpRxT7vhvQx:DsHrqRVAUzxf1kGVQ5E/kFg536mEpXTC
TLSH
T19FD1EDF7C3E5822DCD1252F49B156E2BCE2E0615432C3CAA85D4FE5B93E2431F191A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3109ffd15a08a4b592494c3dd4fc9d7956afe29fff72fcbcf3a72eb171e9624d
MD5 3c4122f8edbe9f576d6843abcb6475fa
SHA1 d658dfeda090e764dabf2688a238231f7c9380f0
SHA512 d8930f12d2408dee8c32b02fb6cc629e49a407939a0d7e8b8d904f8ff372ccf71a4e0c0a88d40d3bf9bf21d4a73b0710becfefc0654c82c4b89501508deffa56
SSDEEP 192:DsC+rqRVAUzp1kj6gGQ3RxlTaEKXvukFg535hmM:DsHrqRVAUzp1kGgGQ3XlTaEKXvukFg5V
TLSH
T1C6D1FDF7C3E5822DCD1252F49B156E1BCE2E0619432C3CAA85D4FE5B93E2431F191A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 659ec5a32bc7f4f965e76756a6cbffed344b21b779ae1072b9c3067577d9d525
MD5 b202812e0ec7d574a0f15f28895f98ae
SHA1 e60dacc7ac9864f3a2d213daa8fb7d697dd2d00c
SHA512 692a1ff997477c953d9301e63d9cb40a3dc0007620cb3478e330fef4bf66f67b1be9427466c68fd23d822b5df447a4dda8ac338bfd7670cf9fa0f9af37bc3873
SSDEEP 192:sxZ1R+yM/jK1Ml8MkV/fqsJvG+wIdpJHW6+WNGYIwAjHDIgrJ:sxZ1oMV/fqsJZRJHbGr79
TLSH
T16F42F9126B349977CCDBD209FA55BF53D6F51472A2900E48A9FCCA0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 93d3b5c5059cc06bb9f11e2f7e1f1f5e9d27e44a028cf41ae49748108f55de16
MD5 1a9ab434ced2ee016532b7511cd0c3ec
SHA1 f4a9393576be751503d17a5313acda52f5026834
SHA512 4db02b0324f5f9be48c75a6dc00cb35e4e50a608355bc8c53323e7e0479a18cabd0505a1c8a9d5381e5deb89e303d1bb7a4569ee2979600fcf6ed70e8e940eaf
SSDEEP 192:sxZ0R+yM/jK1Ml8UQcsFV/fqsdvh+VmIdplqUp0e5SYHW6+WNkN3DY/0XYIQESHv:sxZ0oqTFV/fqsdoVHl1PHbCbXq7b
TLSH
T1BF72F853AA349977CCDBC209F945BB53D6F5146293910E48AAFCCA1C01E7BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b454d04bd9e7e583e83158a1edd038985793338c54420432c63e716dd9ed89a
MD5 688973bb7fc947b79e4d235df1973031
SHA1 b5319f0d0522e0cb395b5fd1c86ff58f696a5bfd
SHA512 44c0bee49c10182eb38a2d62f5a37dcf880255f0597b936dcc7d03dbadcfa89279b3f2ce2f9ca199e0e227491cfc5f011b53c3f094fd6d4ef75ee7d257e7f553
SSDEEP 192:sxZ0R+yM/jK1Ml8MkV/fqsdvh+fIdp4rSYHW6+WNjzB/YIlAjHDIg5fJ:sxZ0oMV/fqsdoQiHbB/A7z
TLSH
T14B52D812AA349977CCDBD209FA45BB53D6F5047293910E44AAFCCA0C05E7BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c88543a78e7fbb88494ff60a6efca18fae2b6f4b4d54bdaf1d53a42087e27cda
MD5 026c93efbeb6196829e33dde4ba912a1
SHA1 5beedd044c90559dbff32c199ea2c5e701554a64
SHA512 8a23ee8b7a44fe506f2bad7180834cf9589c9e9113a41678381a0e78c5b4a7bb655453cb9a40adf5141ab8bbb567aaaae2386d9363b9097666add24a07502a1e
SSDEEP 192:sxZ0R+yM/jK1Ml8MzV/fqsdvh+QIdpzqUp0e5SYHW6+WNjzB/YIlbjHDIg5PJ:sxZ0orV/fqsdoxz1PHbB/L7b
TLSH
T184620913AA349977CCCBD209F645BB53D6F5146293910E48AAFCCA1C05E7BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bf005719627878bf1306d0b0169afdb39bfced31328e81a7132b82554f5802de
MD5 388c6c087a3326bd1bf172c31e2faa64
SHA1 1aff314bcde4858a8446132b04fe3946961a86ba
SHA512 7d7424bdebed7a4d4f241ba43218af034e4cb317de6888c1722316d300a31f8ab7d7de676110829198a1a20c3e329fe8f61fd35afb9d35f9206288d6d941b38a
SSDEEP 192:sxZ0R+yM/jK1Ml8MsFV/fqsdvh+VmIdplqUp0e5SYHW6+WNkN3DY/0XYIQESHDIA:sxZ0o0FV/fqsdoVHl1PHbCbXq7b
TLSH
T1D462F753AA345977CCDBC209F905BB53D6F5146293910E48AAFCCA1C05EBBED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5fcda43e05b80b75f192f39a56502cb14fc8bc75b3ffd0497c6a5f2fef7e95b9
MD5 95004d7b864c554e49a5e65f10f755ad
SHA1 3993b13b3781c69ae58c0166ad3f6a348e3695b7
SHA512 3bffa0283a851f5f0896c4ca1d1c7382b23b04ff943ef8b4d38321e0e3831b8405a58267307523cf78a948c8f84db5d33f83c8e65f53c4c8c48c6970ad4dce11
SSDEEP 768:TDsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9YroEq0OX:TDsqxXlWvJD6Tu1ja54LAs9j9v
TLSH
T191D20B3B694CC77E4F840E9DEC266FD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 fa66af2c7fbe8342eeb34c69044bd3c8253f4985f9a971dc29e179fa38463c80
MD5 f5e49bc81c3a768495a7241e4ecd2d46
SHA1 9fdf550b52869dd5267fbfb0a16bb0688b212f8e
SHA512 96f9ab7626dd30ed88724bf9a6f5c7b435dcb82d2b0c4f2885b8f277c25de27916e995ddbf29fa3047b14be394bb870a1a9b55f9c055e7bbb742beb67b63f1a9
SSDEEP 96:KYbaKYIKRktgESKK+Ea7lCk+KqLCe+mckDO0f6KQK/6u6ucKnqlyX+Skd:ExV9/7PMyX+Skd
TLSH
T11FC1231A31760A1339BD3898B26A86361F4136733018B46F7FB840A14E6BE135DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff6de47a-53a0-42b3-9b60-d7b707887786.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff6de47a-53a0-42b3-9b60-d7b707887786.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ea94abc6190c839b8f99f10f0d530879a4af3652f15b2e2b3b93da706290528c
MD5 648cfd443ac50731996159c48184ba53
SHA1 1eef1a753b0a58cb7201a84dfb39ea077f5bf68d
SHA512 281c8e902c07ecfd7e05c2c813c32afd320eb87a9b6fc28ccbbfe81813bbedeb65320a9563af8ae4d8001e8f32a9471d79b146edccb8da6f6bfded8beea574c7
SSDEEP 192:ELsNWZQ7VtPSaFkRbFUQmiU1hha4VRNW+Fd102o1U2tSJrioSRtqBOU8:ysNWZqAbqpFVRN5dc5sJr09U8
TLSH
T11C322A329C349C775EE3A546F44735039EA45167AFCA3F94E1ED9F0C02DB6AC230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f917cbec3dbc79478283017c7217380759e73ef96a2e0f97a6d85b1e6d322aeb
MD5 d4e35af602b2e8f4556cc6afe8a9de62
SHA1 703f024779ac62dfd7f6907426f319d171041bc1
SHA512 0fac7d306a10bdf99e5fc9405df947c39cbd1ab7f99b1401c1e0e229561d24cf662ea768d7c180216f3aa85b572955dfa1ef3eb4b4fcce06c2e68611645c709b
SSDEEP 384:FiF1tNn/s3n9SwTsNW8TUNTUlIltqAbwwzVRN5dc5sJrk9OObjI9G6w7D7m:MF1j+9T7wgGIRH5Cmhk929MDq
TLSH
T144C22AF248D78936C9AE4B47B77E2D138EBCC167B6852A44B3989E0CCD961BFC305911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 46c5dc32ccd6addecc565f52534d19a86d5b62016a1f83b40d68be0eb884b31d
MD5 0e547d44a7f14d7fd08f270230116f5f
SHA1 a1b53203643d196613d6d1a8694792c65de3e519
SHA512 10f130b613c3d6a7fa6035a2ccad11db1f61fe1f15ea4f45f32d1d654c2806b6662db285ea6ce5a69b213b7d9d7ff343ce984ca66d9ca7754c46faebbbd81b07
SSDEEP 384:QtNn/s3n9SfsNW6qAbqpFVRN5dc5sJr09OObjI9G6w7D7m:Qj+9U1nrH5Cmh0929MDq
TLSH
T10F929E329C244D734DA35956F48B35179EF8817B9BCA2F84E1EDEF0C02DB5AC4312925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c6e00b254c5ac3e06890c97ca8b8d7c145593d8eee5af24ef13c44c64564b235
MD5 f853b68f9807228d4b4660fd9979aaa0
SHA1 b6f6b9383ceb1629774c6917dd8ac3cad4854f5c
SHA512 7163d0eb370235e0f47d2880a56335790fa3a6672034e38a2dcbc3bf805fd07f48c465acb1f92b76b9828caaa14c4a392a9f13e5adc8bcc8fd08e1d4abd61685
SSDEEP 384:QtNn/s3n9SXsNWtqAbhgzVRN5dc5sJr09OObjI9G6w7D7m:Qj+9caLRH5Cmh0929MDq
TLSH
T1CF929D329C249D338DA39556F48735179EF8917B9BCA2F84E1EDEF0C02DB5AC4306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a6a0df1defb0cf0ed82d104bb67ff757b52a900aa3ed0e66a7a6809697aabd5
MD5 7617f2fb620c4e4009d6217605631fb0
SHA1 64d660c1420ab5ffec1b48dfb4f33c539d25a22d
SHA512 a33342c31a2884eda11e7e88d054d8fef7144570183332aaa48f5b35120b741abe2eb9283a6b9e1361dd0cbc5bf8b44c85aa6a6389f76e3b2540f8fb598eaf97
SSDEEP 192:sONv6JkRFQmiUyRE3+RNW+Fd102o1U2tSJriMVctqBOU6:sONv6Uj33+RN5dc5sJry9U6
TLSH
T10C120B36AC245C7B5EE26546F48731139EA4516BEFCA3F90E1EC5F0C01EF9AC530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a39e6a7e11c1b27e28eeeef6b2265d4871415b80bbe27b778a63278e85688309
MD5 b40c50b869cc4c9da72d74afcd61d72d
SHA1 357998e0bb8f10c9a805f07f9e2d81f6468c09f1
SHA512 b846468900b5f10cadd00f58b4fe3a12218303dc24448be0e542b038a66d89485049884af684c9553786ffcfeb1d5df327f2439124736e5630c8e777b139952e
SSDEEP 192:tONnm6JkRtQmiUyYEW+RNW+Fd102owh3BRJ7U6:tONm6Ur4W+RN5dcQZ7U6
TLSH
T18F02E835AC386CBB8EF26D0AB48737175FA4217BB9962B80D6E81F0C01D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ebdab5ea3fab7006c9369f0565b5636f4c88e87f9c24532b99a19f40fb0b2f38
MD5 67243c790a8c108bde460cbc8baa537b
SHA1 cbbc6d23527f2aedebff14e927b56f703a45c55a
SHA512 384f7078c150eeae92d870eaa8d1dbbc9bc4fd9755b9fa756c18caa09e53336807df017a04ad8bc83e2913d3da6e104c26ced60473fe51e7d53b0dd60f3036be
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe591498.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591498.TMP
Size 392B
SHA256 976fbf2432cdd271115b42b92f22727e1edd8e86bc8daea1e34ad99dc43ba23f
MD5 948e41e52a2a51175955fa8bcd638936
SHA1 350b7015589dfdd889a5c5b98ffbc52baa40f3a4
SHA512 66b3f6ffbe0e39dfbe72d44f963393770d6e61949eb632bb6f9ef0e298004b16afdeb35ae033c9e5273a49a8c5040d3a90f1add084a56c5401a2b9af91c4f922
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f8ab8eb1cdaf7ade3bb55d18c22d46de2d99535959b78be79a8e2a60ad8dae0
MD5 acd1e30165f5e11479115678971e2cfc
SHA1 5aa4a4de6de2be9ee1621efaf5bab8649b4255d4
SHA512 c74d0843a5377178205df730139d27e0af9b90b5d6391b2137c0dd2afc57d27ce3895060f18b6e3e712d34766058209edaccd400823b98ae1366f4c4b431de88
TLSH
T1AA41F448AAE91058F3B77F9A9BF6A86D447AF8772E07905E00110E4E0B62A40D961B37
MD5 SHA1 SHA512 TLSH

Submit Download