hxxp://mkbjuristen[.]nl

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mkbjuristen.nl
Sample260708-ndvbhsfx9j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279830488547842"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F66190BA-F18A-4E3E-921C-DD650518C579}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3204	4328	msedge.exe	83
PID 4328 wrote to memory of 1108	4328	msedge.exe	84
PID 4328 wrote to memory of 2400	4328	msedge.exe	85
PID 4328 wrote to memory of 2400	4328	msedge.exe	85
PID 4328 wrote to memory of 2400	4328	msedge.exe	85
PID 4328 wrote to memory of 5040	4328	msedge.exe	86
PID 4328 wrote to memory of 5040	4328	msedge.exe	86
PID 4328 wrote to memory of 3884	4328	msedge.exe	87
PID 4328 wrote to memory of 3884	4328	msedge.exe	87
PID 4328 wrote to memory of 3884	4328	msedge.exe	87
PID 4328 wrote to memory of 1012	4328	msedge.exe	88
PID 4328 wrote to memory of 1012	4328	msedge.exe	88
PID 4328 wrote to memory of 1012	4328	msedge.exe	88
PID 4328 wrote to memory of 4312	4328	msedge.exe	90
PID 4328 wrote to memory of 4312	4328	msedge.exe	90
PID 4328 wrote to memory of 4312	4328	msedge.exe	90
PID 4328 wrote to memory of 1924	4328	msedge.exe	91
PID 4328 wrote to memory of 1924	4328	msedge.exe	91
PID 4328 wrote to memory of 1924	4328	msedge.exe	91
PID 4328 wrote to memory of 3732	4328	msedge.exe	95
PID 4328 wrote to memory of 560	4328	msedge.exe	96
PID 4328 wrote to memory of 3732	4328	msedge.exe	95
PID 4328 wrote to memory of 560	4328	msedge.exe	96
PID 4328 wrote to memory of 2036	4328	msedge.exe	98
PID 4328 wrote to memory of 3592	4328	msedge.exe	103
PID 4328 wrote to memory of 3592	4328	msedge.exe	103
PID 4328 wrote to memory of 3592	4328	msedge.exe	103
PID 4328 wrote to memory of 2972	4328	msedge.exe	104
PID 4328 wrote to memory of 2972	4328	msedge.exe	104
PID 4328 wrote to memory of 2972	4328	msedge.exe	104
PID 4328 wrote to memory of 2060	4328	msedge.exe	106
PID 4328 wrote to memory of 2060	4328	msedge.exe	106
PID 4328 wrote to memory of 2060	4328	msedge.exe	106
PID 4328 wrote to memory of 2484	4328	msedge.exe	108
PID 4328 wrote to memory of 2484	4328	msedge.exe	108
PID 4328 wrote to memory of 2484	4328	msedge.exe	108
PID 4328 wrote to memory of 540	4328	msedge.exe	113
PID 4328 wrote to memory of 540	4328	msedge.exe	113
PID 4328 wrote to memory of 540	4328	msedge.exe	113
PID 4328 wrote to memory of 4156	4328	msedge.exe	114
PID 4328 wrote to memory of 408	4328	msedge.exe	115
PID 4328 wrote to memory of 2860	4328	msedge.exe	116
PID 4328 wrote to memory of 4768	4328	msedge.exe	121
PID 4328 wrote to memory of 4768	4328	msedge.exe	121
PID 4328 wrote to memory of 4768	4328	msedge.exe	121
PID 4328 wrote to memory of 3368	4328	msedge.exe	122
PID 4328 wrote to memory of 3368	4328	msedge.exe	122
PID 4328 wrote to memory of 3368	4328	msedge.exe	122
PID 4328 wrote to memory of 1016	4328	msedge.exe	123
PID 4328 wrote to memory of 1016	4328	msedge.exe	123
PID 4328 wrote to memory of 1016	4328	msedge.exe	123
PID 4328 wrote to memory of 2964	4328	msedge.exe	125
PID 4328 wrote to memory of 2964	4328	msedge.exe	125
PID 4328 wrote to memory of 2964	4328	msedge.exe	125
PID 4328 wrote to memory of 2412	4328	msedge.exe	126
PID 4328 wrote to memory of 2412	4328	msedge.exe	126
PID 4328 wrote to memory of 2412	4328	msedge.exe	126
PID 4328 wrote to memory of 3284	4328	msedge.exe	127
PID 4328 wrote to memory of 3284	4328	msedge.exe	127
PID 4328 wrote to memory of 3284	4328	msedge.exe	127
PID 4328 wrote to memory of 4212	4328	msedge.exe	128
PID 4328 wrote to memory of 4212	4328	msedge.exe	128
PID 4328 wrote to memory of 4840	4328	msedge.exe	130
PID 4328 wrote to memory of 4840	4328	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mkbjuristen.nl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10599959053282808847,18189213931517081633,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2016352829061451768,9651648860413893336,262144 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,11070396816151590877,18385806584133509246,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3344,i,3450068274941602252,13930048933940347859,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,18394844747723651484,9855733305440257389,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,5463844589716726227,13691944369986459586,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,14174359737475278214,3100859029018102371,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13292707887298053823,638106406870771215,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,12576849275168757767,16135571645624915718,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11895790292533049060,5484309495072752212,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11895790292533049060,5484309495072752212,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6180,i,13990067694008980644,16551543721900268222,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4996,i,1689707604884611334,1925236864049809205,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6216,i,928591575969867044,8729260722348734410,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3708,i,3001456903406905233,10119857933860634668,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3692,i,18191758459423357333,8272103963173907948,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,14767424373615323458,6097604797388023410,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,9638804096491762154,3952858073786658426,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,1669740369482360390,14074003903956406690,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5116,i,17615046049813784984,16534749866340669128,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3964,i,14307095436739729616,2100728593142740372,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3728,i,13830749386006723970,6176366192482866690,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2080,i,10055884929077774889,12573125618472405779,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6468,i,14730785984825277657,9880046774990055820,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6584,i,10504599239446366502,10788907176378155016,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,6791763048411501240,15641080424113285410,524288 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6456,i,12030653098361575749,7006078715651803833,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5140,i,7704674349705460680,4440475716037660202,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7360,i,11195505648543131547,16196775522458531769,262144 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3504,i,9366856019228414278,710590474952085677,2097152 --field-trial-handle=2144,i,13317165863957475652,17252834869757998514,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f90ca480307bd436c47c99b0ecd40d21736a2e98afae25b5837c9b63752ce25d
MD5 805f026799a7bfb44db47ac11ad070c1
SHA1 4d13777ab3cea2d1ddb64cb198deb8b0d3a76273
SHA512 d5f082b9604f67674dc1bd78957fb38ac77617f4663a54f7b4139f5fd836250bbaa8624ce5133a6e91d8606148876c1297900d065d721830f28b10c06d34c762
TLSH
T15B61E7380A12B89DF3311373F6D03BFD33F251A94D5B4EC951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 581c8e8d4b5b07489437c7fb5ada47bd9fb530b5b248d42925e3287666a33696
MD5 52ddb9968795442c4875b73aa2d203b0
SHA1 b73af8065f327684b54217216da0d2659ecfd7e1
SHA512 e3433eaec88e6a86da3ff72b0d0f85479557cc4507778b0d6dc7feff192c43ed18ca5d618520136fa39b29f8a6782dd91a7acdf37472813debe259a6110f9997
SSDEEP 96:/XofB0t5y+h/Nyv4YYPMAXOFntvwPW6I8YmHiOUh6fOsmjah0CD/qskHMnulQO/P:kgyAPGXOt/wKYHxpdhR
TLSH
T1F4A116285A8DA4DDFB311273F1DA6BFC32B141A9CD5F0E8A30E03ABC1587FB28251418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a94b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a94b.TMP
Size 3KB
SHA256 6334e7f388866d56f087fa46ae1f48195d641389e9a50a60435322b50d84677f
MD5 37296bf1cace6c27b8584c0f1a654ae5
SHA1 5f3e348f3623778bf3fde56d84c715a74b7836fc
SHA512 bb9a90a2fadd011f5321f3cfd60467227c41ffaa45c8dba3b5b79ed29d53c870102ed94ca702109542be52c5e52098b3af3fd10e70d657c99fd19ea8656e4e10
TLSH
T11A61D9380A12B89DF3311373F5E03BFD37F251A94D5B5ED951A018BE158BF324656418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a468edb7f3735570dc4b1dcd11bbd571da4c0255257c308017789ea37a4a5d46
MD5 3b524181db716d78057f516124fb7f03
SHA1 d919944b234a9d069e374a334f355f91b198eff3
SHA512 69244095eef1a2a74355160ce771c190a0f70dddb557ab352159ac9adbf97b7eb5bb47c9fed0b7c14c7d5ffe8d62930fb27ef0265ffd0b48b9ee14780506e1c4
TLSH
T1A441BEF7C7D9826EC81116F0AA287E1BCE1D0956831C3C1AC5D4EF5BA7F2071E142A6E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4d42e31e03be78256717bb6571a5993da18b8e1ab6406e6bb12d860c8d18e47a
MD5 ad96eb9ead33ba260ef0a1cfb1de6d0b
SHA1 314ad4417144b7ac9ebaca7c7393781f5e2ed45b
SHA512 ab2a8958adb0c168a3ba5ae60872a93ed6169f3a280c182662a52fa8ec9f3fbe25725cffd3bb33f03b42875ddeca6111fd7db5ce2a9f2959d8fd57c52f298ea9
TLSH
T1F3D0222B125430B6E96C3EA9707AECCFCF2720240803DED428D09ED939318BC851F14A
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe590a66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe590a66.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16d40dd644bab4fb6ca2f5476ab63cf88dd66ed2ccf3f8b95489fcd48e88ec4b
MD5 39c786f574e7a4a69d85d2b614c6f162
SHA1 2c97d6424b9f7763be25658cacff198c32bea2d4
SHA512 342414ef5603f9e8f64484cd0f58f9d94fe9911282a4bdea6d9f5052bc527208b1cad30d90789e9b5ecfd2627feeece21556db135509d8fbaabbefb7c63b684a
SSDEEP 192:sxZ0R3yM/jK1Ml8Mkq/flsrGn2IdpUdHmJ6+WNGYLzcA7VIgrJ:sxZ0XMq/flsrG3QHnGw9
TLSH
T1D842E8166A349977CCCBD209FA55BF53D6F90472A2901D44AAFCCA0C05E7AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 464c1b5f12d3f08b530dae558bdb07d6fce40100c40027ce957d4314b8e76aec
MD5 aff1b1bf4cdb07ca6707aa13696acbfe
SHA1 50a0ba2163af50cdb9473595db592ccbbe896503
SHA512 22f1be4b771c0a14ff9f9b4db81b54200b085aec5da18b1bc527cfa21fc230a14d77130a0140856073a2e3a5c8b50c17f8cd1984af6e1671dec67bc3077a9943
SSDEEP 192:sxZ0R3yM/jK1Ml8M0cB1q/flsGG5MdpTIEsHml6+WNifn/YLOcw7VIg5utwSgwzn:sxZ0Bsm1q/flsG084Hr+/VeJhn
TLSH
T15172C7529A24C977CCCAD609BA347F52D7F904629E510D8C5AFCCA0C01EA6FD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4d661d5138f728ab88ef0850971b168587987fd569ab783617aa47e00cca72c7
MD5 40ca1be0d0094282bbcfa00bc1a36a93
SHA1 091a2e14e2cad0b33d25438e785f7b6606e02718
SHA512 634c41455cf4dcf92079009097704c69cb672aa2ee9db7514a748b8b819320a1ee44bcf0ea9d4bf5c9e5093e9f80838b1898bc6fc92ff3880547e33b326bf732
SSDEEP 192:sxZ0R3yM/jK1Ml8UQh0cB1q/flsGG53idp9AEpHml6+WNivDZYLsczoVIg5utwSx:sxZ0BqCm1q/flsG0yDHreZ1eJhn
TLSH
T16872C6529A24C977CCCAD609BA34BF52D7F904629E510D8C5AFCCA0C01EA6FD2617C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7046b9c2f0ad1552a54f2e289329de5f80aa072bb3071df8d212a454af3b82e1
MD5 b77dad108f5090beb39f484740110b59
SHA1 1c1b0d7c471f46405188e1ab4126dae26257f874
SHA512 fe25a64d04140f5417b2d985ec6774ee5ef32df3be2aa4c755029b7320e8a811c58677f78a2c6ea8a65254e2a7126b520fe4898bb92083c8dde5c8dece23c82d
SSDEEP 768:lxs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNCro22:lxs6pD1WvxzWju1jahILIsNZ22
TLSH
T16ED2FA3B680CCB7E4F841E5CEC2A6F967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8e1dd6fd72e64cb1b585568f37dbb5b42e2654a59384fb3328c7955ca31f47cc
MD5 2c54d7f65a107c0b39577ebbf46836ef
SHA1 a64eb306b47bf57bf00d508e6ece8a73dcb997cb
SHA512 d4813bf88cc9efb0f9fa7c584010f0fd879d0a6c61fc3e5d637b136bce79c81a4ae2274a12215916a1ebb96d2dcf07686e6e71a08c3ae4b7e6e776991fcfad17
SSDEEP 96:KUAAKtePJHohV/lR7whKKm97KeCmb7KHPCpxIJLsd5kNSKOsC9GXqW4UIg0MpzuL:iiJHohV/lR8hK19XCmbuHPCpxIJLsd59
TLSH
T16DC1C01235BB47123C3E290CA35497265B82F7A73014E92B3BA810B54E67E794DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b381a37d-d31c-4fbd-adea-e02243fb7450.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b381a37d-d31c-4fbd-adea-e02243fb7450.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 97a1bf705699daccb42512bcaac8e2eb23bbd18059be914ff190dfb906371207
MD5 448b3a4cf22646dc2fc19d4f775a5523
SHA1 45c56c6a95f556128b889c7373fa63d0390e8c32
SHA512 291be105a3843007fd72e905d9f8a4bab635635367929ecf7c8a4ecf91ac93eb9c4beec3e97221edef0f0f230b33d90071930d5086649ff48fc91d5d39ee481d
SSDEEP 384:FciF1tNn/s3n9SBzsN78TUNTUlIlHm2yzUKFa9nODawRIScjmwfc:FHF1j+9KmwgIgKIdO2wRI1j7c
TLSH
T195A26D335D588D7BAEA28A89F94A3317CFB410B7C9866E90D6DC6E0C01DB2EC1347D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e1f02bdce353b59045f0c08fbc6f2c1e0fb0c9b08e3d5f73caa148c895abe33e
MD5 a37dd56a9912d9bfc7d5156c15f2b255
SHA1 92f8cd0889b635aaff54b4ebc253872c464b0df0
SHA512 28380737d48e98ff9aff2101e0259859ad98ea1f891be22ca8367ade91a2623685fad1c9461c6fda53d8152d3d4e6afb6d89852c29a60087a77167321692258b
SSDEEP 384:NFtNn/s3n9SfsNZHm2yzUQBa9nODawsIScjmwfc:NFj+9ULgQUdO2wsI1j7c
TLSH
T199927C366C285C665AE29189F9463657CFB850B38AC62F80C9DC6F4C01DB6AC2357E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43e39f4ee91b3a547fd380709983f48df355e33f00cf4cee8baa5b3cc26946d7
MD5 cc3b321d30f9e2f524e491b87439a5bb
SHA1 5f135c27bef4acb54f14e93b0dfb9d70d5d50de8
SHA512 df7e14847aefbeefa5bbc17c618852ac1a68277eaae959b81f8b95e11126f733b2242ff58ade14720e448a5ef173684103126bdcf2554c2af0b05ebba2e4aebb
SSDEEP 192:qONp6O7+3hQmiUyBTGttb0mO2opgGbEfU6:qONp61eGt9nOD5OU6
TLSH
T1FE02E8356C7C6CB79EB2AE45FA8727179FA5103BE9962F80D6E81E0C01D765C2343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b73b8d74afd85bc6e80959ae3cc5813de5b44998d5845121abc4074b0bbcf1f
MD5 d24355e509e91d45e75b5117ed3b7536
SHA1 555df51719f4a321bf78c2534603f3d54c3e9693
SHA512 984b8f130116df197f59e0ccd29329b780be8dce1439be38a76c34c2e43aacdf8664ad7113be94456af369eed742964ed29b3c0f29fb6842345dfc380e25fe9e
SSDEEP 192:RzONE6O7+3KsQmiUy4WTzttb0mO2oazE1cNbVqTKeU6:RzONE6Q8jizt9nODawiIU6
TLSH
T119120936687C5C775EE2A585F98736179F651127EE8A2F80D1DC2E0C01EF6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 94d4b15ab526f787570c692ebc5ee0bb77ebaf301aca27cebfef853988563726
MD5 6082f0c8440cfe715113eb280f201cf4
SHA1 272174005c2cce66456b9dbedc938aa31f458775
SHA512 e94d08a8b47541e356dd7d311573840f14216fa938b2a004449841ff3ab098f210fb677bbb1948557ba9ac023818521f4a1a4952ee72495567439e9d0170bc31
SSDEEP 384:jFtNn/s3n9SfsNZqm2yEUGBa9nODawsIScjmwfc:jFj+9UeJGUdO2wsI1j7c
TLSH
T18C927C366C285C665AE29189F9472617CFB851B38AC62F80C9DC6F4C01DB6FC2357E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b0f6387284804dda8aa523dcf36f8d6bcd0be555b6a5d5710a51bb543a86896e
MD5 d27af9b652637141cb7c34a46c54647f
SHA1 c1f70b6eca16a2c9553ad9d5f8bd6b4a7462f853
SHA512 c2329223255ce3b299c6a9ff9c1fef3f745a801f1a83c3d6f35fb995f7601658aac3b4f882416a01cfb7a4cbefeec7d1abdc925022d2ec769b9b7aa52f2cf6bd
TLSH
T16D41E758B6F51148B3B36E5AAFF7A86D887BBC772E06D45E10110D4F0A22A44CDB2737
MD5 SHA1 SHA512 TLSH

Submit Download