5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c

Analysis

max time kernel
898s
max time network
727s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/cmp.html
Size 5KB
Sample260718-etzfqsf13p
SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
MD5 17241946e51074e6877c43737b94ad71
SHA1 16918c53471fe3f35fcae1e9902870d91c50d957
SHA512 b4b6e030fd1abe19fa308b32f04571a7c1c1f78a7cb789f169b37b54f281ec66d16e4cf0bbbdad81642bf28e266a6b2af7c19cf5106c683fb7f443bfa3110e05
SSDEEP 48:tZrc0/GdshWpo1rckthAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4Li1:4V+8v4jHa2NGiivmmpWsBVuQFwlE5vSG
TLSH
T15DB1DB1A2D5914A80077E3385B6B6208F72AA1B72105CA067EACDE513FB152BD58FFCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288217168915098"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{236A4388-72E6-475C-B705-9B192C097C48}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
216	msedge.exe
216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2024	1304	msedge.exe	85
PID 1304 wrote to memory of 4392	1304	msedge.exe	86
PID 1304 wrote to memory of 4556	1304	msedge.exe	87
PID 1304 wrote to memory of 4392	1304	msedge.exe	86
PID 1304 wrote to memory of 4392	1304	msedge.exe	86
PID 1304 wrote to memory of 2388	1304	msedge.exe	88
PID 1304 wrote to memory of 2388	1304	msedge.exe	88
PID 1304 wrote to memory of 968	1304	msedge.exe	91
PID 1304 wrote to memory of 540	1304	msedge.exe	90
PID 1304 wrote to memory of 968	1304	msedge.exe	91
PID 1304 wrote to memory of 968	1304	msedge.exe	91
PID 1304 wrote to memory of 540	1304	msedge.exe	90
PID 1304 wrote to memory of 540	1304	msedge.exe	90
PID 1304 wrote to memory of 2468	1304	msedge.exe	92
PID 1304 wrote to memory of 2468	1304	msedge.exe	92
PID 1304 wrote to memory of 2468	1304	msedge.exe	92
PID 1304 wrote to memory of 3876	1304	msedge.exe	93
PID 1304 wrote to memory of 3876	1304	msedge.exe	93
PID 1304 wrote to memory of 3876	1304	msedge.exe	93
PID 1304 wrote to memory of 4592	1304	msedge.exe	98
PID 1304 wrote to memory of 4592	1304	msedge.exe	98
PID 1304 wrote to memory of 512	1304	msedge.exe	97
PID 1304 wrote to memory of 512	1304	msedge.exe	97
PID 1304 wrote to memory of 4264	1304	msedge.exe	100
PID 1304 wrote to memory of 1548	1304	msedge.exe	107
PID 1304 wrote to memory of 4704	1304	msedge.exe	108
PID 1304 wrote to memory of 1424	1304	msedge.exe	109
PID 1304 wrote to memory of 4360	1304	msedge.exe	110
PID 1304 wrote to memory of 4360	1304	msedge.exe	110
PID 1304 wrote to memory of 4248	1304	msedge.exe	118
PID 1304 wrote to memory of 4248	1304	msedge.exe	118
PID 1304 wrote to memory of 3332	1304	msedge.exe	121
PID 1304 wrote to memory of 3332	1304	msedge.exe	121
PID 1304 wrote to memory of 216	1304	msedge.exe	122
PID 1304 wrote to memory of 5064	1304	msedge.exe	123
PID 1304 wrote to memory of 2804	1304	msedge.exe	124
PID 1304 wrote to memory of 5064	1304	msedge.exe	123
PID 1304 wrote to memory of 2804	1304	msedge.exe	124
PID 1304 wrote to memory of 1204	1304	msedge.exe	125
PID 1304 wrote to memory of 1204	1304	msedge.exe	125
PID 1304 wrote to memory of 1752	1304	msedge.exe	126
PID 1304 wrote to memory of 1752	1304	msedge.exe	126
PID 1304 wrote to memory of 368	1304	msedge.exe	127
PID 1304 wrote to memory of 368	1304	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7ff81128c188,0x7ff81128c194,0x7ff81128c1a0
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,2568698377050996548,14329000951219486594,262144 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13749909199443226738,7604225024900063835,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,3408611393735573667,9891885184157504723,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,17906121158310157379,14152262666407407509,2097152 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,7056961830433117413,12270821612974100187,2097152 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,10974937097227831418,13842961340698075379,2097152 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,18286528187543622810,16063245028561966995,2097152 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,9496264183642554302,3325164191590887148,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4231653986707951668,5779170640470621038,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8621849359587972129,17637222558949152887,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8621849359587972129,17637222558949152887,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,11034926627922143494,5098480858091621707,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,18233753180589157009,10915546529245847430,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,8979611921445319362,2094678941818951413,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,5658886419822757707,436177600149419474,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4253731725920188989,12724650408550146355,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,17788131470653413190,12581227160057569122,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2784,i,2358853564019130137,13456730585916139029,262144 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5030813423673908910,272663787095830947,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,715474039024800345,549522076512217257,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4220321886079831338,1637042123772956505,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,16915137077819407826,3295168261454889364,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,4956277569340990265,11993198749850639014,524288 --field-trial-handle=2732,i,12921142314928628101,10557788891152179043,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a7e1da42932dc2b51f94dbc6d90c70e0fb1eac2490500e8641ba3c911facd3e9
MD5 22c1b7d2f6c58eca4ce5d9ae4fdfbdaf
SHA1 0837acf626db1e9e09809d90943f7272a2000001
SHA512 5abaea8447714d945f05dc775f74a5397bce982677c421958b0d18c8daf6d5c32520718d87fd5d23635a397f2f0023fb9bf5d877935b47d63fe71cbdf24f5e06
TLSH
T1D9E07DC91CCFC32ED680A6474278831DE3813E8FF2C87A1A2B40C9ECB345590A3C3598
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b5755ef11f9462cdcdfb75006f430b4470678067a5ac48bf797d6bf7c95ce599
MD5 4f069ecae0aad8346a559463a243284d
SHA1 23da972f621ca3b297be2d3f48c0a4b07e334fd8
SHA512 c1f267fef5804bbd9234ac8ed21e45de4c1f66d6cbd548166e6418d58f75fb911b5f4868b2df88136cdf90ed01888a5b9d703fa62f5cdab85ae104970d666b34
TLSH
T1FFE026C52FC9C2AE9250B6478268430CC3813A6AB3CCAE1A1B54869C3245C50B3C2598
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c08b9b4bb5e53d6634fbbeba86763d0c1509f135fa19ee421cd100468c8c701c
MD5 da5e860c239b2388194b4a4babe7ce8a
SHA1 83c951ae4d7f6bb466cdec3f3e29ab3e4aeb65b0
SHA512 cc820e69a732a3975a95e5f7445c81d84d15076883e4fc2c348beb51da7047ccd775c39a8128800147bf8683c82940b596f1c4aba23f900f4adba7bc53c17277
TLSH
T128E026FE3AC0C5A48143D64790E8531EDAD2BDC5F68C869A33C87B9C2796021C7C6DC8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7d91edc492f121b6b61fa3e651158bcc2f2a6602c3685e98a701fc51ebaf68f3
MD5 62496bb6ffedd2880678f1a6e1ebafd6
SHA1 b8c1a2fdda07d09e30dbe584f3f36805737f6aba
SHA512 377190fca27531a53ffeb3e38ba465f4264fd4cc0144d017da571d90fab35673ec978e3767f4a7dbe166c37af413411056dbae4cfb8f5a982b5ad43eeff439df
TLSH
T1E7E026C61CCCC2AEF340A5C78168430CC3C13B4BA2C87E0A1740869C3207074A3F2A9C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da335dc9d93982c84431ce94d0f51ded0496a23c5b2811f8b71571feff564219
MD5 c94ed3bad76f48bed9a74a84ecca8d6c
SHA1 a0fc883e474047d12ae979ca278c0cc70a72d481
SHA512 7e6c04f3e9c2128aa45eb7e404af285010bfb98a2e142469d7831314ebf49eba7ce6e043c403bc99c867cd01b165bfde37a29a1e3bde32759f28ef7a466daf3b
TLSH
T1527160F431111B7DF3300271ABEE02217539BAD9F4477FAA1064A836990DBED7C2842B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586906.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586906.TMP
Size 3KB
SHA256 480fbf3aa62bf56546b3165942044a685a22a1f8d41fa01c97a3b4bc06331ad4
MD5 f19862b48f4ea97e2e2e8dfc7fa927ed
SHA1 27d2f25f49cbdfdf8d8df197731ed4c6bc913d87
SHA512 2d323c675562531d144a47c9631a974d3832173e10af8200027496ac1f1308644ff8591d4330b79fb517e981bb614f23656553933c0714f17021a5184efef5f5
TLSH
T15D7160F431111B7EF3300271ABEE0225B538BAD9F4477FAA1064A836590DBED7C2802B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e8477b9d27f89baa6b96d2d4949960b5c26dbb1e73a57b37fc675c235f5142b1
MD5 87296fc09c9ac682e2084ced590036fc
SHA1 b4645866e3745772c982bcd9d7e8645cc758d3b3
SHA512 3b5a3f9e6db921b237cbec5d7298179c617ef8503dba716e5ead4d79367efa554380b7246ebdd34b655831ba349bbca8787e447eb3afe0634991cba577cd8caa
TLSH
T180116DFBC3E4866E8A0152F16A14AE1BCE2C0547431C7C5699E4AF1B93F2474D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 335e49260c3477f0ac623245ee743ebfd750d54f24847e62de0bcfe6f1ea350a
MD5 0a459e12fedcc889ff05eefc92027000
SHA1 6ebb887ead6c0b0b973c3ef080475b3f293b63f8
SHA512 61a6fe0bcc6e7db181458ee7067ae8aa9c78935672dddfc70307fe1332d968ebf5bcae6fe7a227e0e14ce18f452a90098552811e91824b937863c035a5135dda
TLSH
T1CC219DF7C3E4866E891152F1AA28AE1BCE1D0946836C3C5689E4AF1F93F2474E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f85c04656597115c1d603ca0d67d0352d0a7d0e5162d0082356c917eb897dc90
MD5 5b4e43ef06b61b91f5814d6bfb6be446
SHA1 812145138c6c9ba30b0c94d3b9428c8bc2c2da3a
SHA512 16acd2755e2d1f97c39a9861c28054d043ee7c8a511df40fa52b69cf754730dab12e503db527992f1973a97857669d94142d9aecf99841c879ab2f8ba4acef5b
SSDEEP 192:sxZjREyM/jK1Ml8MkV/fNsOAPdV3Idpd1HW6+WNGYvrxkVKIgrJ:sxZjaMV/fNsxPQ/HbG3c9
TLSH
T19642E9166A34997BCCCBD20DFA51BF53D6F51472A2900E44AAFCCA0C04E6ADD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2d65058f40a1890b653be836d25d1276c72030d1429114dfdde1637caf59ead7
MD5 feaea94a75e9739fe81a67b096353dcc
SHA1 a62df95950706b747a7f6a7f8de459a69deaa16e
SHA512 b71f1705ac3ca120168bcfcf4242551c60f014fa140c487c7c29278fab2663afeba2507e3c20a0e286b05db5861b3bd2497f1875a10a2caa914eb69cba49cbae
SSDEEP 192:sxZjREyM/jK1Ml8UQlkV/fNsLA4dV3IdpH1HW6+WNGYv/gRVKIg52J:sxZjaquV/fNsk4QVHbGpcc
TLSH
T15D52D8166A34997BCCDBD20DFA417F93D6F51472A2910E44AAFCDA0C04E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d0cf7b3006d7befbdc5d6bc20be79e1478ba6efbf03c9ae4505a201af01a6104
MD5 43799fafae9152fb3996f4c249035b0f
SHA1 cc0c3f09911395ee2abe69561a42cf98f0320f66
SHA512 682bfb06da25eb52ae5975bc8d5050689279b03d37ef7aca45759d02565582a5856a8e35464a2ca08a4e00dff6be3d199f9f3ac4b79034e6c3e1391ea998621d
SSDEEP 768:D7seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppErocK:D7seJ3xWvhfynu1jaVcL88pPt
TLSH
T1EAD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 bd9d8ac227963cf6440b11c777daf20e569308e4a243eb9bf2577841e172fae8
MD5 c5db9b1d257f6288c02722be0f04615c
SHA1 16d1d09beea7ab6e9f20e142a36f91c00e8f507e
SHA512 13c6a98440e2bb3cc7ea06ceeb2665ea4b6158348e1fbdd329fd36859f2a6eed42b18a1a77cd0c056818a577c06fa5a07eac8ea50a92fc0e471794008fcae0a1
TLSH
T1A231338D9E81959FD5A888B2117674E433F0C9CC1711A3534C3C763A3D263AA2A4B0CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5caf23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5caf23.TMP
Size 1KB
SHA256 56db327bd1d5179eaf6e22244ed451727f79637b6e0071f1c20e5fd66b58be48
MD5 73789a9129c2c79b1eb6d230cf59251f
SHA1 9b0f89e155fd4e6fc158472d74b83539d5b01aec
SHA512 3b7acd11910c5653bb0cf0bef509b4ce4396759f3ef6189378fd397aa7c7e18a058f3323ce34fba5385db02d08abab7ea3dd40b3280b1d59a779ea121547f98a
TLSH
T15F31758E4B81590FE8D444720552B4B83375C94053227783987D63396C7579D2E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2a0afe4d8c1725449da95ce96386564f383f355e2c2febce4057c63b82a195db
MD5 27b4effddb1418def7731a0a40bb9e8e
SHA1 0b3d4d93d8920c7f50ea61456056fa8328beb7c1
SHA512 8a1b0f9bd8285c5e7e38670848062c4ef5b460dedd557f17247f997339d0d3e6be4fc13547417d526ddabb635f333b132c07c92d5c5e6cb1655ae9996324b68e
TLSH
T144E0C0762DD72460BEAFC3D2603080900A0A749DF941FC0E541BF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ee06c52800f041a6bf4689d93016469824133762f529e4bf192c007b8d94b557
MD5 51a3ae9718e1f8ffea50934bc87fb988
SHA1 92a88595f830cad2841831f1278acec4d9ee683d
SHA512 9beb20826317bff2958fbfc18b3d8fe253a863951f776f5f9964c086d907e25ce1ef4ea3cb841aba866baa79b3162e0a7970f94711cc020d73686b8e3bd2ee1f
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1ED:KYHIhKggkXyBcIHK5W8Ty95I5KSEch
TLSH
T115914506347F12023C7D254DA6A296368E4231E375ACB4AF7FF800955E66E124EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590584.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9c425b6d9de59c5de51662f8586dbc47bd214f958c7fb1716241359822ef830a
MD5 e218cd0cc9b9c4247b6736f42fe59b86
SHA1 843467531d2c854208811ed660189276c1256674
SHA512 7bff88b4303731341a041799b642f21328da5c0e7335385ab24608ef5fc5def3fead2c486fdf9333b2613693e151717db165fcc7ddc0c741eb5be6a6fcc6a3fd
SSDEEP 192:u0LsN55QT0qaM7MELQmiU1twQB4MTFp+FdLXKxzSJr48z1EQqId51:dsN55IF7J9UQuldLKoJrxxd51
TLSH
T1B9423A326C789C3B69A3B185F00A37135EF495AB96C56F94F7ED6F0C05DE2AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5283333cbce8cb916311c7579e8b250a4788d7019ac0d1a966c134535c6a6b47
MD5 957da11c846735c27f7a49e04d469140
SHA1 5d751d83c2a9536322527c9c41b0c5fa84937d00
SHA512 0318facb3b046f343317c7dc989f3b93a7a75a2f360b9b89d4d388ebb9f572276a5a2962f02e8e83421359dac26b97ca33b598b31fd885285ef8a6940f67d24d
SSDEEP 384:VtNn/s3n9SfsN5RIF7J9UQuldLKoJrxxUBl:Vj+9UPwHlhxx0l
TLSH
T1EF625C326C289C2B69E3A185F14B37075EF496AB96C12F94E6ED7F0C05DE3AC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 9c50ad5b0f84e7238bfc71f3b4db86206c5ecaac9e486629484c2484fd86f632
MD5 ea7b5c9ea223c1f561f9163d8f175ef8
SHA1 d99f46b9713de9963673f56e18781a59de941e50
SHA512 a88bdcb14be46140ef4f32c5706d6bac69c52707b7b11590189e6f9b8cc16670d6b5916b318610522cfb47325f840a2d23a3d7abbe53f6c6136db955c22cfb2c
SSDEEP 384:biF1tNn/s3n9SGzsNb8TUNTUlIlsIF7J9UQuldLKoJr7xUBl:2F1j+99WwglwHlh7x0l
TLSH
T1C5823A335C58C93FADA6AA84F54A37079EF451A7C6C2AA94F7DD6F0C00DB2AC1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e02ed7d38e05b37a4f299e9a14eeef20db62ecd258c6c95b2d6842cbe0d82bde
MD5 892a2ba3817289e545982f000d8c18e7
SHA1 ff35b67d381e57de7b764a73bb3075423dc1cbec
SHA512 3e6ae05aca75b955139b7fcd1a09285bab5fa8d394a4aadc2b34ff034e0a1778b947cf4c24a30a5d0c81551e2b5a16dcc67def7c9d0e172b666fb9fcea9e260f
SSDEEP 192:lON76vMtPQmiUyj4ThTFp+FdLXKV847EwFU/u:lON76UtRnTOdLK1/U/u
TLSH
T192020935AC786C7BAAB3BD46F48E27175FE4216BE6D11B54EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 340d0c4b115b23065ed56daf4e78bbd8306bca8760d89345d208fa6c09f5db3a
MD5 9c2997cd0b28ece12bb4752f98233dfa
SHA1 945e857449c2626c037c72dea0045465a3f2fdc9
SHA512 ad481320c056bdab8c6cd5412777d09121442f71a7bc50b7da018cd54e3ece8255ff4756db005f319db9720f8e9cfad765c32c4b9b81845a5fbab8be3139aef8
SSDEEP 192:jONE6vMGPQmiUyi4rhTFp+FdLXKxzSJr080IEQqIU/u:jONE6UGRsrOdLKoJrZxU/u
TLSH
T14A122A32AC649C2B6D93B581F08A36135EE0926BEAC56B50FAEC3F1C01DE66C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4674a95827560387e58c0a69bef9321724cf2579b79e3cd2326b8f4c3ff63665
MD5 78d175162dd5711c8894ad63a0ed0509
SHA1 f5058170b3d75af98d11cb6fac738e34aa66e652
SHA512 633985b05de1e8bcf9f49348989f4f4522158ffbb24f0075716afed22519e589a4734d276d023046511e557fea63567edb6c6e4bbde4d183e498aff8a58af667
SSDEEP 384:XtNn/s3n9SfsN5sIF7J9UQuldLKoJrxxUBl:Xj+9U4wHlhxx0l
TLSH
T1D3626C326C289C2B69E3A185F14B37075FF496AB96C12F94E6ED7F0C05DE3AC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cbe9e7ea05a03ea4ca33031217104a943ea4e0e7b20d979e750eb425042de396
MD5 d99d901a1594c3f2d3a19f65dd83c4c0
SHA1 eedd1f2aafa101f9660d3f2bac849013191d8090
SHA512 a5d67c61eae9e1c5773cd6c907ea1e8b174a192ba8272a9ac88455edfb355f607e74d825a2d17ece8c22d56e7c4d840fa0b3b5996457e710069889e45af6790b
TLSH
T110412898AAF91158B3B36E5ADBF2686D447BBD672E06D49E10110E4E0A27A01D871B33
MD5 SHA1 SHA512 TLSH

Submit Download