hxxps://salesforceasiasummit[.]com/register/smc-dg?utm_medium=email&utm_source=marketing_email&mid=APC&sid=0eBKX0000004KMP2A2&j=4251258&l=2&jb=106

Analysis

user interaction
yes
max time kernel
899s
max time network
728s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://salesforceasiasummit.com/register/smc-dg?utm_medium=email&utm_source=marketing_email&mid=APC&sid=0eBKX0000004KMP2A2&j=4251258&l=2&jb=106
Sample260723-fpclvaej6s

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
72	api.ipify.org
73	api.ipify.org
77	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4920	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292565571823750"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C25CA3DE-9742-4D68-AABA-CF18F2BA13C7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3320	4872	msedge.exe	87
PID 4872 wrote to memory of 4920	4872	msedge.exe	88
PID 4872 wrote to memory of 2832	4872	msedge.exe	89
PID 4872 wrote to memory of 2832	4872	msedge.exe	89
PID 4872 wrote to memory of 2832	4872	msedge.exe	89
PID 4872 wrote to memory of 2508	4872	msedge.exe	90
PID 4872 wrote to memory of 2508	4872	msedge.exe	90
PID 4872 wrote to memory of 800	4872	msedge.exe	92
PID 4872 wrote to memory of 800	4872	msedge.exe	92
PID 4872 wrote to memory of 800	4872	msedge.exe	92
PID 4872 wrote to memory of 1440	4872	msedge.exe	93
PID 4872 wrote to memory of 1440	4872	msedge.exe	93
PID 4872 wrote to memory of 1440	4872	msedge.exe	93
PID 4872 wrote to memory of 4428	4872	msedge.exe	94
PID 4872 wrote to memory of 1208	4872	msedge.exe	95
PID 4872 wrote to memory of 4428	4872	msedge.exe	94
PID 4872 wrote to memory of 4428	4872	msedge.exe	94
PID 4872 wrote to memory of 1208	4872	msedge.exe	95
PID 4872 wrote to memory of 1208	4872	msedge.exe	95
PID 4872 wrote to memory of 4168	4872	msedge.exe	98
PID 4872 wrote to memory of 3552	4872	msedge.exe	99
PID 4872 wrote to memory of 4168	4872	msedge.exe	98
PID 4872 wrote to memory of 3552	4872	msedge.exe	99
PID 4872 wrote to memory of 2700	4872	msedge.exe	101
PID 4872 wrote to memory of 4664	4872	msedge.exe	110
PID 4872 wrote to memory of 4136	4872	msedge.exe	111
PID 4872 wrote to memory of 864	4872	msedge.exe	112
PID 4872 wrote to memory of 712	4872	msedge.exe	114
PID 4872 wrote to memory of 712	4872	msedge.exe	114
PID 4872 wrote to memory of 2004	4872	msedge.exe	115
PID 4872 wrote to memory of 2004	4872	msedge.exe	115
PID 4872 wrote to memory of 4692	4872	msedge.exe	116
PID 4872 wrote to memory of 3392	4872	msedge.exe	118
PID 4872 wrote to memory of 2384	4872	msedge.exe	117
PID 4872 wrote to memory of 3392	4872	msedge.exe	118
PID 4872 wrote to memory of 2384	4872	msedge.exe	117
PID 4872 wrote to memory of 2664	4872	msedge.exe	119
PID 4872 wrote to memory of 2664	4872	msedge.exe	119
PID 4872 wrote to memory of 4456	4872	msedge.exe	120
PID 4872 wrote to memory of 4456	4872	msedge.exe	120
PID 4872 wrote to memory of 2640	4872	msedge.exe	121
PID 4872 wrote to memory of 2640	4872	msedge.exe	121
PID 4872 wrote to memory of 1560	4872	msedge.exe	124
PID 4872 wrote to memory of 1560	4872	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://salesforceasiasummit.com/register/smc-dg?utm_medium=email&utm_source=marketing_email&mid=APC&sid=0eBKX0000004KMP2A2&j=4251258&l=2&jb=106
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffd884c188,0x7fffd884c194,0x7fffd884c1a0
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,12437504719859057286,12000602563129190932,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7219050168386618260,12605594850574483867,262144 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,7217325264312606187,862375607079577394,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,11659829869271580244,6913111194082758862,2097152 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,16655081935051830346,14976736323576063088,2097152 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,3261402593394964882,2139247357233632914,2097152 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,3797076901890602346,17454563178707934671,2097152 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,5133622324600528233,4457398752092732688,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4233132199912924625,2898104661058516739,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3689558789067007175,15272570276929583142,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3689558789067007175,15272570276929583142,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,11231170790975086184,4493054662736437135,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,10413443529036245625,7251541200556316853,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,17229868458643865634,9349713287566538168,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2709350822711489669,2854731564799719166,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3191871848945873930,5826187420787300440,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5648,i,13759085276082348805,17871140404841356849,262144 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,1200536406794391656,6868350935105079482,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10446828464621795331,12393112068085737688,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1536,i,15728286631013166160,1166213904875104742,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3144,i,1819269103056207665,4545265421049105296,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,4356663960471567736,6344771874081939954,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,17866162141218290649,10265029784460129508,524288 --field-trial-handle=2284,i,4325926171900589963,9838897934033856904,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 894bbde21b3cd82ec4ef10c4e4b7771735fac7e9753ec105cc27c41b40970f35
MD5 d744200845cbbae63d0e66d8d808827d
SHA1 1569cae9b21047ca4519e180b44a0d6462dec311
SHA512 1bd7868f51b86d73acf3f088a1a38705caa224483c27019dbdaeff0b0d04e79ba8804f422a2132aa349209c56a9d2c30939de28a1e9b5b359b8ed9cf3946aa9f
TLSH
T1E3E0209509C5C31DE14D64878294538C41CC370ED2C96A0D1B08C8D9F4465806792551
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ec5b0ab7989a0a3aba991f1a56e40cd27a3b363d8f192aef6745c9bbac3205d4
MD5 9593741137035c6679e8ad3d2d38ce63
SHA1 fd98bb873ddfe4870167e8fd0a0bde4dd903e26d
SHA512 b0110bea7289abdc21b702ee49d692d35c2f62910a97dc81b193ac3aad8c6ab39981480dbb58b806e099694999cca8d7c79232a778b96f54334abd3e909915bc
TLSH
T16EE026890BCAC22EA349A48742684F4C8281370B93CCAECA770CC4F8F2020D0A3E6D90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 42a5fa824e890423d09f068443aced71f934eafee785802ce0bf4d60b4d5eb31
MD5 4caf1baff0c308643f0cf5595d8a54af
SHA1 01c633d846f3cf57ac027b5e8d2d43e2feb714c8
SHA512 f052183b4f1721b39791a9baee819171b89d10ea0506bbb6cbdaa6cf7610e64a210eaf17d2c7ea375bc83191ee13b97f648e53c67c5d1d728e8a44b12dea1ccc
TLSH
T1E2F08B7942C6F675A640997B895C43CD85D47307EBCDD849234CA8CCEC83099EB603DC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 36249ef5dee3fb37a993904a9e0411e80649986463594609c861efd5201cf7e6
MD5 63e06a52f320d6437cfa3fdaf263e978
SHA1 4f0732dda4fde3ea455fd1add4b106baa614eb80
SHA512 a72c48dce488f58369fd24613b5f1e86eabfa3d315072556883bd3cf3d159ddd5a3f5c8f6b460a1005caa8ee228f37ab2f8056709a622d133528c4db7c7d4655
TLSH
T12CE07DA406CAC22EF280A4874174C34DD280370FD2CCB90A5F1885E8F0034C0ABF2990
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4109223f3dc555c0669d768cea87693b4afe740aec69d6b817f67134e6576588
MD5 c76a6b4937bec71890369651e1b821be
SHA1 45d5c7d59dc5457861c8cb360b08766def37b47c
SHA512 635e8090b463171754898148fd170f715195a4e0b40b29e9681d07828c24f6f8d6e5200805a831aa4f362f4117decfe330c646df287010ae786c9daf1fc6187f
TLSH
T149612BCB0A0A44B1FF1501B0DDE1E6903573C4AC5A1F19D60D105775B701BE1DAF2BCA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588836.TMP
Size 3KB
SHA256 bdc37e9a3f10e7738baf6a330ae80658aeb5cc0b7cbd1483cb02e70daa14a4f8
MD5 cbd0a47466b6924bbe80ee9a273f4952
SHA1 c1b463d7557c8d8399aceccaae2d02798eec3b85
SHA512 cbf714fdaab4bb9dd8b7879f0e55d56fd33019b066033ce29044375a5c3d8359ff7dea022b87b58c06d38ad0305d63f0768b739ecfaa7929500f72e9aa8ac7c9
TLSH
T151615BCB0A0A44B1FF2501B0DEE0E69035B3C49C5A2F19DA0D045BB5B702BE1CAF27CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 629f697a13dd7798553ac38db19932be0054161957ea32d02c7e07811e5e37f4
MD5 63b0d5c2a2c11c9127b633ca21af4bd4
SHA1 6a2635313e086c32cb0006d0d4824853a501be40
SHA512 73a19add856a3e8f2abbfc9f11d7f83496a9fd03f8dec6dd70e322a247987c18056099182b38008f602afcdda01a8d4db60bf4ce817b9a8ded58654a94eb6ada
TLSH
T1D4519DF7C6E8992D8A211DF0AE156E26CE3D0515533C3D0BCAE4AF57A3E2470D111B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 49363d9e7024c40be12fd62a68270e1e153c29737ca299e59f1e2679d5d823e9
MD5 bb7f455688c8ad01547170a5004f9e64
SHA1 711eaab1e510f1d4ecb9399b9fa62e742c7bb68e
SHA512 2fcc0c44a8f9e561fcbfb089710bdc24dffc6ca785d7257699103d1082af9cc5891fb78dde48d5fd74b29f910476e065717f3b2a5bb7092956f4f5001729a711
TLSH
T19B51CBF6C6E4992D9A215DF0AE156E278E3C0416432C391A8AD0AF57A3E2070D111F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9da0afb6847c2c3988deb58020a2bc5c6ddafd25fa76060c7fe82d8e070dd65b
MD5 23fcc0b59dc3635d2d2621107a52b644
SHA1 2cf9c33cf79923a15f8dd3a71380a5f66c9bd211
SHA512 57effe26682efbcc17b59ddd306b1c04d8fefbc84f2ae9b1fed80c17fc1c82bcda8b5973f6a94a7b28c1c5ce7bcf99438d499de08a5c9d9834e7533463c17a68
SSDEEP 192:sxZIRKyM/jK1Ml8MWL/fksS+IdpiPHW6+WNRg2/YHFyxzIgrJ:sxZIcuL/fksSvcHb3/J9
TLSH
T1E442E8166A345977CCDFD209F9597F53E6F90572E2900E84A9FCCA0C04E6AED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 925af891132cdee408fd5e18fb462f2791450690a5215f04a42416764487f126
MD5 d794b541b66859e5f0cbbe0de987ff32
SHA1 41d151cda726d137d35a8d6719a5c5edad0154b4
SHA512 ee748d421bd55b016025573a01d61233474db95397bb172ed68080cf6b4bbae0cc233979e9b11a44ae648bcb842ca411b0264ec714aa2a197e300e689b386e02
SSDEEP 192:sxZIRKyM/jK1Ml8UQ3kL/fksZx+IdpgPHW6+WNRnLZYHaVbzIg5gJ:sxZIcq0L/fksZxvqHbZZRG
TLSH
T16052E716AA345977CCDFD209B945BF53E6F44572E2900E84A9FCCA0C04E6BED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 104a06de99dab234f8df0d4ba8e5893892cf15b9089a85e436136cac706086a0
MD5 a7a200de977bcf7512b804ff11595ebc
SHA1 fd2f335321e4e10579a84832f566d1e2b15edc20
SHA512 37a50470a0bd0120e7725a3535c40e5b706457b8aafc74007d4ca26c47344b0ec5347f45bff88d7a964a785fbfcfbbb99952690661da0db29c3c8ca533af9ee2
SSDEEP 192:sxZIRKyM/jK1Ml8MkL/fksZx+IdpiPHW6+WNRg2/YH8yxzIg5gJ:sxZIcML/fksZxvcHb3/iG
TLSH
T1C952E8166A345977CCDFD209FA497F53E6F44572E2900E84A9FCCA0C04E6AED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fcba4f18130518a670f369b600cf06fdd0f620fbc3e8578d95a4bd19f16099fa
MD5 db9c51fdd54a1bdb6b3c6154dc5571cd
SHA1 a742b3e160f94acfde8ec9e25858882881f6f078
SHA512 9dc4ac8ba4a2e9ed3503f5e22e43bb928c38cf00aaec4e499171293f62c58ef89091138c133ee012080a856c25b4ff862109e612aeb1ab6dc5c6183b41005215
SSDEEP 768:xcUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4ReroVc03:xcUZYTMWvg0Pou1ja7eLZmR1J3
TLSH
T1C5D20A2B280CCB7E4F844E5DEC2A6F963ED801CB9A584D5447EA894C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 d88e2403e2e66a6cf05be4bf2fafd94883ead85ea1421a7b7abdf5fe6b08d0d6
MD5 ac5fa61998156c2743fcbbf6a3849b56
SHA1 333f00c565e9e529270770a1fd112eb5c315ce95
SHA512 df201f72d7bdc5e914035e8336039f94ff88291413c9a3f6bd41eeed2612623d9e9e15c921adc0b3283c07d60b437b2b69ef6336f6baa9d71b11160459a13559
TLSH
T16B31304D8EA0C99FF9A884B21072B5A4B371D8CD4A22E3134C2C3132BF233592A574DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca679.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5ca679.TMP
Size 1KB
SHA256 306546765c40e6f2409a37d57eff9ed71a83d631c0bc823f1a4f99a67c7b98ad
MD5 9ba8215b17a49bbd0e0f0630aafdcd48
SHA1 d54e2874c69e61f2c13485fe3276732584a62112
SHA512 e46bb597a9ef65f0a335f13551c728facb455c9a36ade9028798895a2ea981a4ff81fda52c27ec02cbe85bd8ba918dd830285c9803190bfe63b7f9cde586e6cc
TLSH
T1A931124A4B918A1AF8D4507B1E62B4B8733588405321B793987C62399E35B9D1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8b6017ce412ddb19194eafcd0800cb3e66e03775fba92348370e33f6d60719fd
MD5 941c005a291420e89f9414333b4518fb
SHA1 f64b4cf4552bb908e326455724cf06a1a5b7a901
SHA512 4e6f6cca63da94e811a3ae5ccabbaa43261d9713af26a66bb71f5ae1e6b9d33c8cbb8afa3bdf2cfeee6c1c03656d4dbc5e4d8b9843b61694edbc310754239498
TLSH
T193E0C0F37DFB1820AD7FC3D74471E4A402013CB8C64CAD8E00AEB2A310B23002806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 520fc5a3bf06802a8f128c8d418001627fa8bc6b2b441419e32529c8e2ca30e3
MD5 4466923ea902a41221131db98e95317e
SHA1 da543ec0e8bd6afef891734f68d127b88cece137
SHA512 d002cc97606cc9c8e455878a3b78307d355c8b624b3c0e5a0a624318eed0d3c3ede43d13f8e63b4eb166b56488cb9283eac74f7bde1b1c4458686e38e612b202
SSDEEP 96:KA1eK2AIhWKi8i2tGKOYrkPwE+e+6g25JS06K6PSC6uEsRqUzHIDsoqiS2git9SX:Eol9gJBX
TLSH
T179D1E50271FA02513C7F2A0C92D6AB569E8172637214E42F3BED04B64D6AE209DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ef1e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ef1e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7f7671453648201d8f3100d5f0278aa0940effbf1d4e1434630aa10906d63da7
MD5 c66de7cb839f69945e68855e984fe6ef
SHA1 df673a844cd0065ad86ced6c56c01cbf08406d70
SHA512 3f1c2ae44fd858851377061a8f89a0125145e1d5f2d739710f00df8c2fc7c1cbfcf0f5a5d78650c1c05353e4d315dd197e58e8c9a6b2dcdacb9ed0f511135446
SSDEEP 192:u7LsNVnQVpIt5FEQmiU1PDT4zX5Obd+jvOIdo4QhjqBU8:MsNVn0pGAVczX5od+zOIdUhaU8
TLSH
T1D4320A366828AC774DE6E584F54B32139FB55067DB842FC0D2EC6F1C05DA6AC630BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 38b2051fbed7d4858e4472e17bff6a81b2a95db0f907a055dc6739320756a005
MD5 637bc891a96894babe3590665cc7d3e6
SHA1 54fb61bd1cdff676616e7277b77d8abf1f152e2e
SHA512 444d8f0b64a4eb085c761936101db3c60d39499fe178faacbbdfe292e0fe4bf4789d0d9cbef6ab54f5a12d27f329d761f17adf357585cbe4d1eaa4acf57ec9e5
SSDEEP 384:bZcIhsNV+0pGAVczX5od+zOIdUhaOObjI9G6w7mKb:DhsDUOyO0Uha29Ml
TLSH
T1B3928D366C285D378AE7E954F48A36175FF89077E7D81FC491ECAF0C05AA9AC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 22f778daf0e95c3fbcad21b1611b9e5e38a471beef04e6490a0ca0d3d445ad48
MD5 5c745f117bf8dc71219ebf3e9eeff33f
SHA1 6d5d6e41c85d86e2fa9bfcfd126a5ddbb30ed44c
SHA512 d5ffd148e76eaaa56c7f63137a0df0bdac569b2a9920dd2ee981a3e23f84dcd4975460fb084caaf9343ba4a23187676bcd623ae845c52d556c3dfbaf8b6504f2
SSDEEP 384:XiFiZcIzzsNv8TUNTUlIl+0pGA5czX5od+zOIdohaOObjI9G6w7mKb:SFQX+wg1nUOyO0oha29Ml
TLSH
T15FD217F258D78936D9AE9B47B77E2D134EBCC067F6945A80B3989A0CCC560BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d8533891bc9eac214983a9628bad1bfe614a368027f7e63f099f54c51dc99bb
MD5 ce61ffddcbac7dc1176807ae652ff8c6
SHA1 53804e40d2a5970516b919ba18d86145776bd692
SHA512 4d319f906e87c70082e7a1ad288b9c5f3e20724cbb62ebc9ae3a7ab174ed48439da9e8a5757ed72ad291d8f32eef829f9c99d6ba37944a1dd2dbc7a39e1c3fa4
SSDEEP 192:yONZ61VWQmiUyG2gGX5Obd+jvOIF/ahK3+YU6:yONZ6WigGX5od+zOIIh3YU6
TLSH
T14802C83568286C67CEF2BE49F58B77135FA5206BEA516F80DAEC1B1C009769C2347C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 34955fcda5a5a561df16c8293d6abeea2e60c08d9cff51ef0964d86a7b56fa3f
MD5 3af8a362971d30c1d0ae3850fcd020ec
SHA1 da24013dc5e5a48e61df0e713e751ee0990935fe
SHA512 f2264bb7c1438a59398ded3f83ad89e712fcfb160dc16a438b7eecf9b19fb734072d36abad22177c037bdab9ed5fec69d0e525b3849117536a414425657fd4a3
SSDEEP 192:0ONg61BWQmiUyZ2MGX5Obd+jvOIddjJhjqBU6:0ONg62vMGX5od+zOIdPhaU6
TLSH
T187120C366928AC774DE2B544F48B32135FA55167EA457FC0D5EC2B1C00EB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 85f577c6de6a146df1bbce508e2cbdfae8f6f7eee53c512eeda82a8b9c5e9282
MD5 51c65098247d10378a063d89632f01e9
SHA1 b1139d179b40121136c91552cc36ec0cb6dbc2dd
SHA512 31af55431a6e53d6fb17729486e6e497ffd1bc2f79647e9eeb972209a2e0aba84ce0d536f94c01a5e7f9d5e77e838635a1e647152ac7c640dd28d368091dca30
TLSH
T13C412859ABFD1108B3B36E475FF6A96E487BB9732E06C59E10110E4F4A66A00C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download