hxxp://screenconnect

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://screenconnect
Sample260720-regnlaev7w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290299820950143"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{FADA7FCB-DDA8-481A-B66A-60E525D70257}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
372	msedge.exe
372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 4644	1064	msedge.exe	88
PID 1064 wrote to memory of 4856	1064	msedge.exe	89
PID 1064 wrote to memory of 3808	1064	msedge.exe	90
PID 1064 wrote to memory of 3808	1064	msedge.exe	90
PID 1064 wrote to memory of 3808	1064	msedge.exe	90
PID 1064 wrote to memory of 3860	1064	msedge.exe	92
PID 1064 wrote to memory of 3860	1064	msedge.exe	92
PID 1064 wrote to memory of 4052	1064	msedge.exe	93
PID 1064 wrote to memory of 4004	1064	msedge.exe	94
PID 1064 wrote to memory of 4052	1064	msedge.exe	93
PID 1064 wrote to memory of 4052	1064	msedge.exe	93
PID 1064 wrote to memory of 4004	1064	msedge.exe	94
PID 1064 wrote to memory of 4004	1064	msedge.exe	94
PID 1064 wrote to memory of 1768	1064	msedge.exe	95
PID 1064 wrote to memory of 1768	1064	msedge.exe	95
PID 1064 wrote to memory of 1768	1064	msedge.exe	95
PID 1064 wrote to memory of 1948	1064	msedge.exe	96
PID 1064 wrote to memory of 1948	1064	msedge.exe	96
PID 1064 wrote to memory of 1948	1064	msedge.exe	96
PID 1064 wrote to memory of 964	1064	msedge.exe	99
PID 1064 wrote to memory of 964	1064	msedge.exe	99
PID 1064 wrote to memory of 964	1064	msedge.exe	99
PID 1064 wrote to memory of 4608	1064	msedge.exe	100
PID 1064 wrote to memory of 4772	1064	msedge.exe	101
PID 1064 wrote to memory of 4608	1064	msedge.exe	100
PID 1064 wrote to memory of 4772	1064	msedge.exe	101
PID 1064 wrote to memory of 3408	1064	msedge.exe	103
PID 1064 wrote to memory of 2896	1064	msedge.exe	104
PID 1064 wrote to memory of 2896	1064	msedge.exe	104
PID 1064 wrote to memory of 2896	1064	msedge.exe	104
PID 1064 wrote to memory of 4636	1064	msedge.exe	105
PID 1064 wrote to memory of 4636	1064	msedge.exe	105
PID 1064 wrote to memory of 3512	1064	msedge.exe	106
PID 1064 wrote to memory of 3512	1064	msedge.exe	106
PID 1064 wrote to memory of 3512	1064	msedge.exe	106
PID 1064 wrote to memory of 3716	1064	msedge.exe	108
PID 1064 wrote to memory of 3716	1064	msedge.exe	108
PID 1064 wrote to memory of 3716	1064	msedge.exe	108
PID 1064 wrote to memory of 4320	1064	msedge.exe	109
PID 1064 wrote to memory of 4320	1064	msedge.exe	109
PID 1064 wrote to memory of 4320	1064	msedge.exe	109
PID 1064 wrote to memory of 3636	1064	msedge.exe	110
PID 1064 wrote to memory of 3636	1064	msedge.exe	110
PID 1064 wrote to memory of 3636	1064	msedge.exe	110
PID 1064 wrote to memory of 1784	1064	msedge.exe	111
PID 1064 wrote to memory of 1784	1064	msedge.exe	111
PID 1064 wrote to memory of 1784	1064	msedge.exe	111
PID 1064 wrote to memory of 2100	1064	msedge.exe	114
PID 1064 wrote to memory of 2512	1064	msedge.exe	115
PID 1064 wrote to memory of 3836	1064	msedge.exe	116
PID 1064 wrote to memory of 4780	1064	msedge.exe	117
PID 1064 wrote to memory of 4780	1064	msedge.exe	117
PID 1064 wrote to memory of 4780	1064	msedge.exe	117
PID 1064 wrote to memory of 3332	1064	msedge.exe	118
PID 1064 wrote to memory of 3332	1064	msedge.exe	118
PID 1064 wrote to memory of 3332	1064	msedge.exe	118
PID 1064 wrote to memory of 5052	1064	msedge.exe	119
PID 1064 wrote to memory of 5052	1064	msedge.exe	119
PID 1064 wrote to memory of 5052	1064	msedge.exe	119
PID 1064 wrote to memory of 2312	1064	msedge.exe	120
PID 1064 wrote to memory of 2312	1064	msedge.exe	120
PID 1064 wrote to memory of 1528	1064	msedge.exe	121
PID 1064 wrote to memory of 1528	1064	msedge.exe	121
PID 1064 wrote to memory of 1528	1064	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://screenconnect
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcd763c188,0x7ffcd763c194,0x7ffcd763c1a0
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,3372625489552427431,13361289850159898814,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,17832581043283362921,2366399200584887145,262144 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14623028707601584146,16182788343878017219,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,81834801047538833,14763153660335562679,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10781201246482017057,11235600037841474511,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11758076108586948815,1006301364652317954,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,777612141299650320,17851505206106116947,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,5245637242635217593,16787110689787434588,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,7525085437503556018,14676469630085720489,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,6480627929193699036,1525201304853288601,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,17027829467209785405,2306869765886506257,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,17027829467209785405,2306869765886506257,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5996,i,7770757229541379559,11576189611120105410,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8265971184244069805,6975317535072791470,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6520,i,5214083451437075927,7308618536183677952,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6808,i,8134400144242258370,4415123888037423689,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6848,i,11914580307985909016,8447472274494794666,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4464,i,14210035595085480639,9997447951855786501,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4296,i,7753620941648753810,17738127019429098051,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,6993860006245824696,18257677346237459379,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,9113604252913191266,11777706370636178295,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,3338290318179341660,5950745471250575639,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5160,i,8059211197919673635,6529359031432129674,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7312,i,1257014729107040151,8637493120931315676,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4412,i,7170649560052065166,4101969785964445806,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,11541188238696726069,14257863982977257258,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6824,i,13578494001908833862,15673838559875857754,2097152 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,16903861828580424549,9996899872556411974,524288 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5260,i,888772231975504925,11623887497706434454,262144 --field-trial-handle=2296,i,12470494440359307711,11594716406245841408,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 102KB
SHA256 840b14bf56ab6b0c95da12421bb7cceffaf245f2581b8856fd1745c89f50f7ff
MD5 781aff80f165285d95b8f1b97547fe06
SHA1 3c6ef90b0e33a5440b41d564a9d591f6580292b4
SHA512 41f240de7b6d769b5e1c90253b335472d2a892be3117a63ffdcb3bfc497c1c058c2564d3bdad16ceb12fdf3e354444d2060909e06ed574d46b43adf06f0b50e3
SSDEEP 3072:UEvSKRQA3Lh08N6uWfdsDnMdxbgnov4VM:LHaAtXNZgQMdxbFv4u
TLSH
T103A3125381BE076FC96E8E6DAB9D83E747EC012085C79AE61480FA29C9E105FCC5EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ea
Size 24KB
SHA256 3096c47012a7255879304054c9d8d260fd67a0f4b3fdffae385fda6d519856e6
MD5 e8ff9d6fbd28ef9169d377c958235e8f
SHA1 40e43683f211f525348978e338f3d963649e6f55
SHA512 cdcba0c5532d7e53018569ad2c02326d92cb6ed58f38bd10cc94b8a848cbb6aa2e69a73862fb820ccfed233cf4144b4323c4cb2d352dd7249d66fa3cdc7b078e
SSDEEP 768:2YpFhYdDFIJXM6o7ybBcd99jYY/JRcwbU:phiDoXM97UoUaSwo
TLSH
T1EDB2E1A787D0E46D6E9F3BA3B1A4880CCA59760FD7E41C80503FC5167BE22D2058B76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 2eff4452874ba19087e1c2dad2abc50b3fcb581947d1bcf7d486ddfb756ad562
MD5 44a98ff69395bd91f36342d114d2e1b0
SHA1 9456defc429122002fe7d4572405ad193d749d95
SHA512 ae3507dda35caf96b9e4a0a97dd76b3fd16bcca18777e461415c6560d876dff1ac10b2f81de15a2ac4561d9c6923f7abb4e37c0a679ee2384cc5755c239af7c8
SSDEEP 96:n/jBMmbkQm/ouqMWIFT/lNF8i+leSnu4OkYF1vknNDXGVIu:lMhfouZHTbaisePqY2YIu
TLSH
T1CEF1EC291D93317ADB790731CDEC2921F931B9328CFBFE59B205663C4D673A9C0998A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594e26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594e26.TMP
Size 3KB
SHA256 7e1459e1b2fd27df82eea9922ffb27d17226a8a9b5b9fa410407469e377a94f0
MD5 487d3c1d1abf97a8840815d9fb88b9f2
SHA1 e8be6b41d26732a204db2cfd7f1115530a549189
SHA512 d9275dcf9579dfb87ef9437bb33321c9aa10ba1621329de55bd54a588f2026c730607f8e63f3cd8d25732c2a82297a387826830425a3d8c07d730af87971cb18
TLSH
T161713C7F0293307ED7612231CDDD1A06F9B5C88949FF9E0AF146B57C86A379285EA818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 02c22009d90c2872d0a905ceb6ce76441d3541a133de40791365595ea668043e
MD5 b1b38fbcbc5dfc97d927b3325ab437e0
SHA1 f52125c66f0165a7fd61202155198b194838b60b
SHA512 47fd0f13922fbcfc98f195372747df9edeca6958da5c2f0da0c1ee05d45d12b674c91a3b6156b6c735d63095b269a716dea3c39965db436387ffd575e8a773d1
SSDEEP 384:Da7ClETD1hkVlgDdVe9t6v6eOewLpeqE/FR1b9+2m4D2FMXCa2zAavSF+MkM4lww:k1sY7eXI7g
TLSH
T159B2CEB6C3F44A5DCB6121F166142D26CF6E0674875C389AC8D8BF8E93F1276E241B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ab78993f382f884fb4758962fa422792506a647727c612e12ad99a9b1b08e73e
MD5 66279aa9fe8fd8d4949843c88806cdfc
SHA1 e002a032a278683702ff9a1f5f4ece9e2e71637a
SHA512 7fc17797e21538e9ced2de2c5b2b3a1cfdc79a64c807893ea0d9c8439a6efd98a66408e845a5c323d9abb63a272305b952f2c3b33ae2d0ffa0885e98f43d0cfc
TLSH
T187D0A9632A40A0B6A6AC2E81906ABD8EC33610284943FEE412A0A8AC0921868552B140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58ae2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58ae2d.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f1bfdb3a4bcff26a9bb605e677c44aee8c4105254103270dd1c33d390982c193
MD5 2f009e1f024b61abff122ecbaa2c5372
SHA1 3a4864b03f288e803c0159d5a7b8bbccfc5dccb4
SHA512 ac94e71e939e0a459bfcda19032ab04aa6969615cd680f7b23ee2845d48f2582e32ffb1a6e0ea49225119a0af0c036e91b069153aa61f5117dd8cf6729b84670
SSDEEP 192:sxZPRsyM/jK1Ml8M0cB1t/f+suFv36dpT+PuHW6+WNifZ/YwLx5IIgr2spY:sxZPmsm1t/f+suFv3KNHbs/KJm
TLSH
T1F762E956A72489778CCBD60DFA617F13DAF50472D6511E4CAAFCCA0C04AA6FD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f5148a778b53536d7eb37c4186cfeb4ec48ab08aba45fb552022d05be4d0ce1d
MD5 73d2bcc56788a298b2f1b8067b2a6ce1
SHA1 72fcd142240507890ccd3f4bff0f5c2117754203
SHA512 a778af2a0b36be65381e1589b8d2528af5d3b179e4a4d1595ecdffbc91bf6a1c2ba7362341ee17829026effdb530aa87d292abd9e22d83f2adae179ab9316ff4
SSDEEP 192:sxZPRsyM/jK1Ml8UQb90cB1t/f+s5FG3WAdp9EPuhHW6+WN6ZqfZb/UVYwby5IIQ:sxZP+qKm1t/f+s5FG3WQ7HbXIVlqm
TLSH
T19B72C75696348977CCDBD609F961BF13D6F51472D6911E48AAFCCA0C00EAAED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6eab8f286ccea39dd54faa841ff4a2568b8ded3f743fba0ae0f86cd4db96c3aa
MD5 fbda05258e225112565472ebf7773f14
SHA1 807d3317f24f69092cad222b5207c4be90706c0a
SHA512 0beab0d9b4a14a8cdce3e6aee32a9c823ea0cf85030386e6043467dc7f1cf66dfc144a404ad58180ee596b67d2c3b615e5871f4bf64c589c233cad0d9198d5fe
SSDEEP 192:sxZPRsyM/jK1Ml8M0cB1t/f+s5Fv36dpTEPuAHW6+WNifZ/YwLx5IIg5Y2spY:sxZP+sm1t/f+s5Fv3KgHbs/Kcm
TLSH
T19562E956A72489778CCBC60DFA617F13DAF50472D6551E48AAFCCA0C04EA6FD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 052e4088448ecec26f5c54d1c5ac4a3b882f214bf2c32b9b6cf8578084e7d091
MD5 0cf3b39de95312fe1693952581488851
SHA1 c0a45e2289055604db62786a2895d345e0bf14ea
SHA512 3439970af99c4f79e42d94f3ec52decdb0b227b300d362b463cccc0cb148b078c7a2c15643c22827f1705bb649f8d18d7b02aa5f80b8256f3932501815c89e4a
SSDEEP 768:wt4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d3rohxcyaw:wt4jeXmWvmKLEu1jacPLZQdkAG
TLSH
T1D0D20A3B280CCF7E4F844E5DED26AE976DD801CB6A584D5047FA494C03CB6EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a9c998b8d6d141eee5249d8063044f8c7c743ff8809f48abd5f581cdeb805f79
MD5 d6d09865d2abf18c74f8723f8e8c7c49
SHA1 076bbaa09342057bd444ef53556d565f830074fe
SHA512 a8845ecbe2bba6b79653f00768c207d00894b98289e2f32312c8520e7d37053c396ef39f7a4924c1b38489d9dde526571a5bafc55fa7947ef5af7747462ffc26
SSDEEP 48:KQLIhK0IMnyNbI1Kc04fM/A82SOkeSxPIx0kKoBgukkc0PR2c5y5:KQLeK0I22bSKc0nFmKWYKO
TLSH
T11B91740536BB02032C7E351895A09A7B5786B5777099AC2B3BA854F60F27E234CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd141a20-6d4b-43cd-83e1-a99e3521bcfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bd141a20-6d4b-43cd-83e1-a99e3521bcfe.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3c471768ad8779645f43fd114400a9198eb66eaeba3df6882e5ec133b73fe47e
MD5 a7290cbc5422a7a095e2509e12ba4797
SHA1 746d6ba7c0de0be22f3f029c7c427d564213c3eb
SHA512 846fe1779e9538839d0aa95e015f33c59d99bfaac39f61cc74c760196468af8669272bce18725dc5215311882e8b0b5210abd54be192c8cfe2e1c8763cfb12e9
SSDEEP 384:itNn/s3n9SfsNxI/BUOdQ1f+5OMYHo5JFYYOObjI9G6w7SD:ij+9Uk1kOPo5jYY29M+
TLSH
T184928C32A9289D334DD29A9AF48736174FF8427BD6C53F84D6DCAF0D04CE6AC1316815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88123ebc0d8e67ffd8cec5aea9f26061eb8bb3509605d5b59e3816677707525b
MD5 311294e2c371fca177f4ca594f607ed6
SHA1 112ad6a635926cba5378cd6716f6f4e7baf7b82b
SHA512 4d0eba50d90b348de67ed757487ee5049fa0940514ef7488c447f005cbfebca762dfe54657da3c727e2539434fd98284e3bffaacf5c2f38e97365679b8e95c7c
SSDEEP 192:EONU6hZ0QmiUyyEpc/+jVnO1GYc5wOZYILU6:EONU6oSpu+5OMYj2YuU6
TLSH
T1CF02EA35A8686C778EE2AE46F48777235FE4112BE9956F84DAE81F1D00C769C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9cd959e92698c680389db61959e90900f158c474c6a62c30f952dfeae83e23e5
MD5 978f8019f969851e9670916383853dc6
SHA1 4ca2eca1e1df5fa154bce6e879d2e713316c62b1
SHA512 af9e93813ccd667b589bab4a1965eb97f4384705cbf416d7756a29f3993dbe437dedcb274e7fa5717c1ae0be58a006d64466e18d9c0039d492bc02cbb59e7786
SSDEEP 192:zRONM6hZ/8QmiUyjEHc/+jVnO1GYHLE5b5cOqY7qPU6:9ONM6IpHu+5OMYHo5G9YYU6
TLSH
T11B121B32A868AC774DD2A985F48736134FE55127EA857FC5D6EC2F1C04DF76C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e973f3e0545f9f16a716d3e2679ef14d03f870a066cb3750c98b60b5bb98982f
MD5 a7be038dde1096f899ce22db73a9a98e
SHA1 9963fbfca162e4170554d27801429e4bafe6152b
SHA512 1e0e03a1ae6553b191d1f29d4e7585d2eeb3b15eceaece7eaf0a9220bef52181a5d0e26085f73cdaaede41ae75e9adcbe255812ab2ee171079683d10eb79390f
SSDEEP 384:JtNn/s3n9SfsNxZ/BUOdhe2f+5OMYHo5JFYYOObjI9G6w7SD:Jj+9UgemkOPo5jYY29M+
TLSH
T14E929D32A9289D334DD29A9AF48736174FF8427BD6C53F84E2ECAF0D04CE6AC1316815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 051a777cb26d4d8eaee3bb84719df8ad451eaa8733d0309e9a8df2454c4eada0
MD5 08a2afa3d9e6763ce22c0206dea4531a
SHA1 7696e7315192e7cd63e7e842c4905184af73a4d0
SHA512 2ef2aa1670646028d1f755a97ae322aef1363488370771f0a1502f574be97ca5a1638452120f8c93bbdb36b0b2dda20e3e6e78da2388a4cae97131b17e50a4a1
SSDEEP 384:xiF1tNn/s3n9S3zsND8TUNTUlIlZ/BUOdpe2f+5OMYHo5/FYYOObjI9G6w7SD:YF1j+9w+wg3emkOPo59YY29M+
TLSH
T1DAC219F688D78936C99E4B47F77E2D164EFCC167B5856A84B3985A0CCC8A1BFC306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 64378f69cc2e0ec9845883d797028dd9c18aca9a0d5b76359a8d3dd6d7ade1d6
MD5 ff48720213a75d05809bd57af8e22273
SHA1 8d1ba942becb42dfa4807e751a001f6690cdc378
SHA512 c1b3dcafe9167dfc48ae2e5ff7f7b346786e6c959521e0bcc15ca498b8eb894c658a4b0d1dd8464ca2c68f3f940ff5d74c5045fa10a5d74045841771caa0cff0
TLSH
T1D8E00202634000F7C01C137014C32B507FF3C03003E343078E2141781C223012E30E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6b9e203248f0e6359289e80a0670ecd93834a9e236349affecc3418df80efe21
MD5 51e1c79234d7dd36292699dd690d5350
SHA1 1ce13f831459e73aa9e8ee5b76c12114f3032351
SHA512 32ea97a8e0e523be84bd6e1e9a0745b2c8aa8a7908cf49762b4fd1879d38f1a2e76c1f6af3e4b36545e5088bd8ad18e9774e2f46c35ef8eff89857811fb3a733
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58b33e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b33e.TMP
Size 392B
SHA256 c5809a8b21a2e5c230c9197426d262caa348d0fd3d543a19eb975d03b661bb80
MD5 0cdfffbc947c8888d9112ad1c6bb7e1c
SHA1 916a1fb2c1ac38b745da41447ead1514c23a3312
SHA512 6c1bbdae22d765fde0cb71697e905917af552aafa0b8788dd094ed8a9b3526ad2d511d745e6ce829164042664ea81c5fc563ae2622f819257608f799a322e253
MD5 SHA1 SHA512

Submit Download

6c9433e4-46fe-44a5-bef5-afa7d7e17adf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c9433e4-46fe-44a5-bef5-afa7d7e17adf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d2d1cc0bfb84b5bb37b84075c0c0ebc6d8e1d28d21d4c21973f3a61e7bf4a56
MD5 d5782fd76b6e6d2cb3a676abd2a0a01d
SHA1 e1f52d03dc57a2710ba0d204ad91f32474469ee5
SHA512 06c8053766a14c7aa6332b0f0f079b8b7b0bc9bc4eb865dea1622bab09bca32361f6d422d1b7f381d4786147fc9263437e3ec4310d1752595e68323ee6dc336b
TLSH
T1CC412B5CB6FE1048B3B3AE5AAFF6A86D447FB8772E16D45D10110D4E0A63A40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download