hxxp://gmail[.]com

Analysis

geolocation tags

eueuropefrfrance
max time kernel
899s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gmail.com
Sample260714-2jrpgag16w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285424272410129"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E93BF0B0-0708-4AB3-8305-CC253A1AED72}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A58144E3-EF68-4EB0-A4E2-505BACEFD80B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3772	396	msedge.exe	86
PID 396 wrote to memory of 3776	396	msedge.exe	87
PID 396 wrote to memory of 4396	396	msedge.exe	88
PID 396 wrote to memory of 4396	396	msedge.exe	88
PID 396 wrote to memory of 4396	396	msedge.exe	88
PID 396 wrote to memory of 2952	396	msedge.exe	89
PID 396 wrote to memory of 2952	396	msedge.exe	89
PID 396 wrote to memory of 4560	396	msedge.exe	90
PID 396 wrote to memory of 4560	396	msedge.exe	90
PID 396 wrote to memory of 4560	396	msedge.exe	90
PID 396 wrote to memory of 732	396	msedge.exe	91
PID 396 wrote to memory of 732	396	msedge.exe	91
PID 396 wrote to memory of 732	396	msedge.exe	91
PID 396 wrote to memory of 1132	396	msedge.exe	92
PID 396 wrote to memory of 3356	396	msedge.exe	93
PID 396 wrote to memory of 1132	396	msedge.exe	92
PID 396 wrote to memory of 1132	396	msedge.exe	92
PID 396 wrote to memory of 3356	396	msedge.exe	93
PID 396 wrote to memory of 3356	396	msedge.exe	93
PID 396 wrote to memory of 3956	396	msedge.exe	98
PID 396 wrote to memory of 3956	396	msedge.exe	98
PID 396 wrote to memory of 3956	396	msedge.exe	98
PID 396 wrote to memory of 3424	396	msedge.exe	99
PID 396 wrote to memory of 3424	396	msedge.exe	99
PID 396 wrote to memory of 3424	396	msedge.exe	99
PID 396 wrote to memory of 1776	396	msedge.exe	100
PID 396 wrote to memory of 5036	396	msedge.exe	101
PID 396 wrote to memory of 1776	396	msedge.exe	100
PID 396 wrote to memory of 5036	396	msedge.exe	101
PID 396 wrote to memory of 2960	396	msedge.exe	103
PID 396 wrote to memory of 2108	396	msedge.exe	102
PID 396 wrote to memory of 2960	396	msedge.exe	103
PID 396 wrote to memory of 4812	396	msedge.exe	105
PID 396 wrote to memory of 1212	396	msedge.exe	116
PID 396 wrote to memory of 2360	396	msedge.exe	117
PID 396 wrote to memory of 3780	396	msedge.exe	118
PID 396 wrote to memory of 3716	396	msedge.exe	120
PID 396 wrote to memory of 3716	396	msedge.exe	120
PID 396 wrote to memory of 1020	396	msedge.exe	122
PID 396 wrote to memory of 4984	396	msedge.exe	123
PID 396 wrote to memory of 228	396	msedge.exe	124
PID 396 wrote to memory of 4984	396	msedge.exe	123
PID 396 wrote to memory of 228	396	msedge.exe	124
PID 396 wrote to memory of 4744	396	msedge.exe	125
PID 396 wrote to memory of 4744	396	msedge.exe	125
PID 396 wrote to memory of 4836	396	msedge.exe	126
PID 396 wrote to memory of 4836	396	msedge.exe	126
PID 396 wrote to memory of 5112	396	msedge.exe	127
PID 396 wrote to memory of 5112	396	msedge.exe	127
PID 396 wrote to memory of 1948	396	msedge.exe	128
PID 396 wrote to memory of 1948	396	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gmail.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc1b7ec188,0x7ffc1b7ec194,0x7ffc1b7ec1a0
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,2632877013113055071,18416930621801759807,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,14423378478842558783,12993322915679666206,262144 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,11922715863028123256,12815462843942445868,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7333778392119049237,14724815051950221925,2097152 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11720182369752064611,8297927912204374636,2097152 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,3888555357591285837,2109282757642329433,2097152 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,11687715527660648618,5373426686087296104,2097152 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5012,i,16289536813220868948,2524190748989128030,2097152 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,9498824146178616553,11486323786270512991,2097152 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11403488607141071832,8953793160815894907,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13502605354127350796,13058659329435423481,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,16699201736662516865,13467036158542551249,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,10489040901140500311,6059669699254646576,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8943543588269056183,10257980453952993749,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8943543588269056183,10257980453952993749,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,7401001093182258237,12686167258064060368,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,15608048198893595934,1122378757149425652,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,5802164929130827018,16138148403169105420,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,3799636294233144731,769491765455390181,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,4158475919593798843,17040471405611930670,262144 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,4299142754428908655,13151180306437569143,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=1540 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,11342874632685068554,13920096984143004855,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,16886833895472324011,12160484490464378318,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,1076371607639541081,11455726242517135093,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,13519502322431770899,10536182629514394712,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,6853851467811620605,8169813620607061117,524288 --field-trial-handle=2320,i,9649210724477856690,9987460726405844144,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 249a25e53ffa98ecd0bd4dc8396affd9c2edc7f18850184c224d228aed2f8d87
MD5 83678f0f318d04810c1ca8f8ee3a6133
SHA1 10c7c6c1927851108a61a61025be1242ec9f218d
SHA512 afe8d5466872ca31c003a6dce69afaaea1db44219bd725720912c2d468691997d00b1abcc0f201b31eacd4f067a6de8203d7cf029690fddfadb0d5752e38505a
TLSH
T1FBE0209915C5C63ED344764742B8534C83503A9A93CCAA075B8888E83086048B789951
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 fb065f10c0bd20e3484096536b2f81d8771f398e334206f7648690d324b57902
MD5 4cedcd9e04ec7323846b14df9f7d7c44
SHA1 adf1febde8c6c28c888804fe4a480d0b5530cee2
SHA512 143df8bda6340a07447bbf700ad9c6722b8334839f4131af1dd9a23ff3699aecb2f4913e83a1b814b1605296385a2b243612347a941d557de67bc043fa45f11d
TLSH
T1B8F0817953F0C665C24172574644420D5051F9CFDBCCCF66638854CCB4D130CD7649C4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 275B
SHA256 c34f721e60b4ed2be88a25d01e0a7b72bead84abb96d27420e8aa615ff7f3c5b
MD5 d7c2b8bb14dae6e8c064c6c01b7ab381
SHA1 9ce45850d941e18c105923f24aa46ac66be93482
SHA512 8d3fc5240f14b53cef7fcd38941dd944abfe2f58f2bcb5201ffecd0746550326637d492d618100437d8b7d1e5ba89cfbf244735a3d3fb89d994dcaea200081b9
TLSH
T127D02BE9BDDC9D8EC3D01DBE4B66B4100B5562A2881BAB031520FCC03281AF01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 07edf20307f05e54ce350b47a39a4594dea3e77d2b5b3307bb295ba45f784639
MD5 cc99c3c9519e416eb2e00a189a9ca091
SHA1 a97f6d3da9bb48f92c33b9b5cbcb8ff2b33e9400
SHA512 2c6481eacd13868bcf62b8d22e6e6d1e03df865e875b837c2d7b1ce7ce71cc25b0e1387a7db16e72a1a182557628616af6c135decb9eab93b753c011e8859cf9
TLSH
T143715FF8C44207F1EF5670B283DA466F76F182F8FA53BE4180E067B8570A3618ACB155
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a5ac29e3e818b0579a29a763e3abb43994bec52812686b9a7947135b21e1723a
MD5 8333b87de3d408ca930b4492cbb5f1b3
SHA1 55969f7ec18c3cdaab9e7a93042a85b2fcfd07ea
SHA512 26edd04e8d2c035fbe2297edf6b6d5a7018287a6d1e653f58dfd11743d7e0721f659e9a654c3952bc74a0ba761ec84fa435a7c2703a92c7e0f98826523f85811
TLSH
T1C5717CF7C3E9812DC91156F49B25AF2FCE1D0614432C3C6A88D8BE6B93E2871E11665F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c70fc4ff60011dfbbec4b64fa8d0952b163230b681b1183af7353fdedffa89ad
MD5 d9c8db071c76d8dcfef5c601782c00b4
SHA1 b4f9a888d0e20381b16d81320dabc16acc0ebbc0
SHA512 04f96c2d029ba641f5672eff3a6a3f37241140b9e2a6d82703ff956fc6e5737ec13943e396b70de2f0a11d142b63e28e5a4836bfafc07241853fe0825229570c
TLSH
T1E281BDF7C3E5812DC91156F49B15AF2FCE1D0614432C3C6A88D8BE6B93E2871E11665F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0b76241c12eca3ebe78a14c90b560b3590462eeac3079d6483ce5bb14c231761
MD5 c3eca3d66a8d1d9cf5bab4cf3f23dcfe
SHA1 d36673a0ed7cbfb4754762cf0d915c01dc852b12
SHA512 0d8de7f46a43a01374fc097de110a8a85195654ea12a6f715a0121a142ab9393203d89cf9e0c11699d9f6313e31d2244c802b89dcc4531b0615a4fb068205894
TLSH
T1C7717CF7C3E9812DC91156F49B25AF2FCE1D0614432C3C6A88D8BE6B93E2871E11665F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5d50f52d49a59cf5272e8d6d0a51614a6e963cfd4601c089f31ec18ede1db113
MD5 ffd02075c1bde0531e616ea5a5bee42a
SHA1 ae5d2d22397f65ed1091cd68be5dfddb5649c7eb
SHA512 169538c95badd37c541f4d2c4a49062b702b21a66c2cf5dfa1d009f2580c80926dbfaa96cf03f85bcff8c3b6480e6667e526b54c91f3df152bbc502d3efca61d
TLSH
T1607188FB83A5812DDA1156F4AB15AF2FCE2D0114432C387A89D4BE27E3E2431E116B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2ef72e0b1a682fe807dc56f1e210df516529f3dd8501a82cecf6995e620f8920
MD5 47eda483fe2d20624b19c9c680056577
SHA1 f5a2764a78cf74b1958f8c4238469440267db81c
SHA512 b59e62fa030cccc560ada12a420d9ed2687076722f7f4a1bc98634b5e2d75bee15d8e736b848ed8fad8496fafa54dab3f4d48bd2c7a2c12311b6e240d15f396c
TLSH
T1867197FB83A5812DDA1156F49B15AF2FCE2D0114432C387A89D4BE27E3E2431E016B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 232933e7461e8820d307aa473344c81202efbe83c4bd697ab0b23a21ce0dea40
MD5 167f70f1b7f70c6985daf33c49ef5dab
SHA1 04658381ed29515e78a6ccfba98499ac1f956b76
SHA512 f331151c78879ebd21b6a19d680bd17f4412f0dd4d4bbd584118638d4c0728bca8ceaa35d9b9b47f6f0faa25565fbad496e4fdb445d310469fd7407dddd7835a
SSDEEP 192:sxZ9RryM/+K1Ml8MkX/fFXskYSuIdpJCmHW6+WNuu7/Yzex8uIgrJ:sxZ9cMX/f9skYqDHbj/59
TLSH
T1FA52E9166A34697BCDCBD209F955BB53D6F90472D2940D48AAFCCA0C04E6BDD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 43a8a07b1f4b218a68c7d9a949468a03b3a1caa1400177a2d0970cca9923b2b2
MD5 35db98cfdb847200c8d06d36ff980aaa
SHA1 467ebdeb89571f148a22af116aebc014fd5f566a
SHA512 22e7b625e4a3ef0cf20c1eec2ceefe56b4cd72647d896ea2d8c2c38617fc1d30b187dbdd2610d79b481e2242b59f8d741ae55ca6047d3661ba66be782053cdf8
SSDEEP 192:sxZ9RryM/+K1Ml8UQukX/fFXsWfSuIdprCmHW6+WNuu7/Yzw0CuIg5qJ:sxZ9cqFX/f9sWfqlHbj/Qc
TLSH
T11352E9566A34697BCDDBD609B941BB93D6F94473D2540E48AAFCCA0C00E6BDD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 d61d2a2ea00436451cfe16b59156f5123973de80982b0e8889d8e4795b769042
MD5 2060b07be92dd0b21ec30eaa6c47f0ca
SHA1 17637f136929f78ed614fc3c5a22786a7b3deed8
SHA512 295fed771fb8c58dc3f07f0064d5a804c12525a7c4e59a2baabba44f090e498267d1d629e23a0bdb596aa787739735583ec19836fc027f2721db51215d453804
SSDEEP 384:sxZ9pqFX/f9sWs66s8qMpRiYnazAW8pZS15posJWeT+gqlHbj/wc:s1wFX/fPs4Mnc7WeT+g4Hbb5
TLSH
T1A4D2F706A924D87BDBC35D19743C7E73DAEC40525284CEDA5AECCA0C019D5FDAB47827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a9611bc1739dc671cb3e5ee21bd0ea9e418f286101785b00e247d1ea789857c
MD5 f87918c78b771205e0c14b2816a166e2
SHA1 c974ff82b453052c260713bc153ee8deda7d8206
SHA512 92480574aff850a356b4086df73a9a1bca1bd9ada6f1fe4248474c091444c661854ea775e05959997b1dcdaef6bcceaacceee07ebab1adf483d0406d24231210
SSDEEP 768:zSW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OV45LlWYSj3roILHIYO:zSW7kf0Wvqidau1jal5LA3jkwO
TLSH
T123D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 504B
SHA256 801ba51ae0e9663b422a42e2a7f0a84586bdf2679b7b34d1cca91d9442026c12
MD5 0d409faa93901b885e190bb16622d634
SHA1 59b44d735a484423a88ddb5733f96bdcec97a1c3
SHA512 a832a6b807e72ea535b270ef2fb427a259954ae67520ee5a2c1da1ddb003758ce4ecba9e8fd3cb1ff6d613f8b4e4cc7ffa74eb088ca698999f8ffa0c4303925c
TLSH
T138F0F8484F802026DBA809F320B700E233B1CDEC7222C81B083CAD2E3C6A2D8601B0C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cddc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cddc5.TMP
Size 504B
SHA256 6f7e078d67aa323c88d8f5886da8156ed38c1ed987631dbccfbd715cca10aa50
MD5 9b8b8515a3104515c00bd3f9ca1f7bc0
SHA1 4f430293a847378594b6b72871d787a5f63c6689
SHA512 a2bd1db240f29d5dbff289929eb35e8813d746e8edf6a9d31fb3cef710ff1552aa1a06e8180a2c0284ff10ce671d6c3b9a447dd2799caf1ef4434c1d8714377b
TLSH
T187F0C08987911407EB2009B3119508E6B375C9107172E8922039F92E2C797C8A6930CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2247b6339ac23e4358b3413e39da4ef9e8d0102f9ecb05b56e9e67d69bb39cef
MD5 d5746f369cf5de9d494005b7962045a8
SHA1 eb84f0979879f81b3100f07f2520cf88363bc6b9
SHA512 83594abfd767efb6b76cc70e5e32e7e6ef8af85c309215f26844a9295393419b031120addf326054f573b3fca9aaa59205c1fe12c05c7b35ed99fc5d5daba89f
TLSH
T139E068BB2DFB1C34AC7F97D138B064A08185381CC500EC0F3027A28770F27562406C71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c0685e615b3ce5da316b2b7831b6a415d8ec1658456de6024aa5be5098f30dfb
MD5 8a8443f54a292e19ac85e0d4ab8dc252
SHA1 5c9e20363dc20fe007f4a788b001f0bbfe807985
SHA512 6793d113be69b132b651e70f279b53a571f3e090b726c1aefb0a479ed1a14b98042bc3edf19ac522182c8e0ec8085250dd20f3b74c8b369997d05e1cf39fba3d
SSDEEP 96:KIbCKcXj+KM42CkIKRSCOrWKkIrWwKXqKg:sqlnPtLPg
TLSH
T1BBD1775272370602387E2D2C966D8A77DE8235633458A86F7BF801655E2BE121EFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c08.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2715b13e5c4c8f0d2d5f6c67f4704ad66816e728ae912e6bc742f084a5010096
MD5 61c1b68e4aecd48c242240c43980ecdd
SHA1 089ab939a9cd29aab06446cd549da0e206b7cde3
SHA512 d6159842df3aa063781329a26d044e378d2e799f5ebf77538b2c9a86ab646aeee36dd850cc4b0f34d972c0d5b8a247eabf91629787763f34763ea4bb18b0241f
SSDEEP 384:cGtNn/s3n9SfsNbTV66bo5RDdmmaHCEJrQKUcyglYOJh2jq:9j+9U6+tIhhQ74Pn
TLSH
T1A1927D369C356D6F5AE7A041F5473A179FF4406396852F98E6ECAF0C00EE79C2306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a37b51fb84d5920c9da6ab97af2c1d5c8cd93250ecf6c7ed96e14cba6770bb36
MD5 3c87b99e6b423225ab3a71bc1d8352db
SHA1 4e5180f433642ed243bd407915489429722af79b
SHA512 a64e20ef63d536244c1bad797e6242cc21e1b28294de93a69bd9c88551c83d6b5266edee98af9b26b2777a6d95c993b748550112fe7a330dd75137a51040e756
SSDEEP 384:soiF1tNn/s3n9SDzsNl8TUNTUlIluV66boNRDdmmaHCEJr9KUcyglYOJh2jq:yF1j+90MwgmqtIhh974Pn
TLSH
T102C22AF648D3993AD9AE5743B73E3E038EBCC053B5856994B3985A0CCC961BFD301915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 300ad19d617a564cf9708833171e8c55a18171180508fef77d45bbba5ab7183d
MD5 4594e044cc6f7913af18ac1e24cdcf37
SHA1 d9eda5fc2a95d779954dff69c2a10c003c022a7f
SHA512 832fb840e94d5578b9a3c7ea3f054185a900a1ecbd6ef06ee8e29e9daddc8f6b5a0e98021dd760a9931a1679f820ca8aa73b0994b5c3968d31e6aad4c604c97e
SSDEEP 384:kGtNn/s3n9SfsNbuV66bo5RDdmmaHCEJrQKUcyglYOJh2jq:1j+9Ub+tIhhQ74Pn
TLSH
T123928D3698356D6F9AE7A041F5473A179FF4406796852F98E6ECAF0C00EE79C2302D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d5f67e5901f8dffea27ef5eb2de21f68f565f99220357980ce51613ca55f7b5
MD5 8ba71d8de9bc055855f4e216d69eab41
SHA1 567064327cd9ca874c1a0962e3e2ef66c499eeff
SHA512 fcf041d6ab23c9e8b4de3d66ca8bf782e5119d4275cd17d582eddc74372c7e82a3bbcacb6643a0c997b7e4b17ad7f8c7f67a5ed241d0e0346f1e21eb22c46a05
SSDEEP 192:kONu64BzQmiUytdj5GBPK7H+FdGBma2dEFC1SJrwWwsq4UU6:kONu6elcjIdmmaHCEJrWKUU6
TLSH
T1E1120B35A874AC2B9EA2B541F48736175FE8412BEB856B84E7EC7B1C01EF75C2306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1571c5ab50b229071ebdd17747935ecb5eb7333537cbe761851a38acdd1ceab
MD5 f25935a9a5036e425f5a3623f4dce508
SHA1 2a39b428c2c67a7c2dab8caa66f104fb8241e908
SHA512 e1dbde60bdb1a0dd1a3d344e3fc122bdc0398f385c652a7f4080b39917bfe07b5d00ef9eea55941a92863cc0819c81977092fcfa998555050d0b40fef9e61bbe
SSDEEP 192:MONK64BAQmiUyi1dW5GBPK7H+FdGBma2EaDb+U6:MONK6eAlvWIdmmaOCU6
TLSH
T13102FA35AC786C7B9EB2AE46F48637175FD8112BE6945B44EBE81B1C00D775C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a4ebfa6-2582-42a2-acc0-9aaec246cb76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4a4ebfa6-2582-42a2-acc0-9aaec246cb76.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cb244bdeffeb6eec70bbc20fb71aa5af3867f6807a574c5e37ddc93ca2c7c0f4
MD5 16d2b9aa9796a3c7afaac781128a900e
SHA1 bea40c2a1d1f5934d6fccabfa6b104fa591eef5a
SHA512 1e0da5fdcaa97d095af966f82c0ef950c738e1ed4f593e56b5a9aee2b1b7abdfd2278052f56c95433091545304e3d9b163d64d00e5a6103558d9430e31f7ac2d
TLSH
T16841D69CB6EA1148B3B7AF16ABF7A86D487E78371E07905D10110D4F0A62B00D962B37
MD5 SHA1 SHA512 TLSH

Submit Download