hxxps://securemail[.]fennia[.]fi/message[.]cgi?B24UnkBr6qVij3mrLjYoJ6zN_1XbmrgMN5UnRNL02G8v8vo2vc7OkJGFzc45U2SP5xVYAYFCkNc8sCRdJBAJAUsRZWQRQ2TD_uq1PxfkhK3Nq5GiPjgVftdC7pUoMgXy

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://securemail.fennia.fi/message.cgi?B24UnkBr6qVij3mrLjYoJ6zN_1XbmrgMN5UnRNL02G8v8vo2vc7OkJGFzc45U2SP5xVYAYFCkNc8sCRdJBAJAUsRZWQRQ2TD_uq1PxfkhK3Nq5GiPjgVftdC7pUoMgXy
Sample260724-j3m7aavgla

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293543228571720"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{1B71F55F-0947-40E8-9DD0-4753B63D7E23}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{99EE36CA-B1B7-4221-84F6-21D8FB71DF8F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1396	4104	msedge.exe	86
PID 4104 wrote to memory of 2856	4104	msedge.exe	87
PID 4104 wrote to memory of 5016	4104	msedge.exe	88
PID 4104 wrote to memory of 5016	4104	msedge.exe	88
PID 4104 wrote to memory of 5016	4104	msedge.exe	88
PID 4104 wrote to memory of 2804	4104	msedge.exe	89
PID 4104 wrote to memory of 2804	4104	msedge.exe	89
PID 4104 wrote to memory of 3772	4104	msedge.exe	90
PID 4104 wrote to memory of 3384	4104	msedge.exe	91
PID 4104 wrote to memory of 3772	4104	msedge.exe	90
PID 4104 wrote to memory of 3772	4104	msedge.exe	90
PID 4104 wrote to memory of 3384	4104	msedge.exe	91
PID 4104 wrote to memory of 3384	4104	msedge.exe	91
PID 4104 wrote to memory of 1924	4104	msedge.exe	92
PID 4104 wrote to memory of 3096	4104	msedge.exe	93
PID 4104 wrote to memory of 1924	4104	msedge.exe	92
PID 4104 wrote to memory of 1924	4104	msedge.exe	92
PID 4104 wrote to memory of 3096	4104	msedge.exe	93
PID 4104 wrote to memory of 3096	4104	msedge.exe	93
PID 4104 wrote to memory of 776	4104	msedge.exe	99
PID 4104 wrote to memory of 776	4104	msedge.exe	99
PID 4104 wrote to memory of 776	4104	msedge.exe	99
PID 4104 wrote to memory of 2276	4104	msedge.exe	100
PID 4104 wrote to memory of 3064	4104	msedge.exe	101
PID 4104 wrote to memory of 2276	4104	msedge.exe	100
PID 4104 wrote to memory of 3064	4104	msedge.exe	101
PID 4104 wrote to memory of 4788	4104	msedge.exe	103
PID 4104 wrote to memory of 3188	4104	msedge.exe	112
PID 4104 wrote to memory of 3188	4104	msedge.exe	112
PID 4104 wrote to memory of 3388	4104	msedge.exe	114
PID 4104 wrote to memory of 4956	4104	msedge.exe	115
PID 4104 wrote to memory of 2624	4104	msedge.exe	116
PID 4104 wrote to memory of 4904	4104	msedge.exe	117
PID 4104 wrote to memory of 4904	4104	msedge.exe	117
PID 4104 wrote to memory of 4904	4104	msedge.exe	117
PID 4104 wrote to memory of 3096	4104	msedge.exe	118
PID 4104 wrote to memory of 3096	4104	msedge.exe	118
PID 4104 wrote to memory of 4440	4104	msedge.exe	119
PID 4104 wrote to memory of 4440	4104	msedge.exe	119
PID 4104 wrote to memory of 4440	4104	msedge.exe	119
PID 4104 wrote to memory of 4764	4104	msedge.exe	120
PID 4104 wrote to memory of 4764	4104	msedge.exe	120
PID 4104 wrote to memory of 4764	4104	msedge.exe	120
PID 4104 wrote to memory of 4224	4104	msedge.exe	121
PID 4104 wrote to memory of 4224	4104	msedge.exe	121
PID 4104 wrote to memory of 4224	4104	msedge.exe	121
PID 4104 wrote to memory of 5028	4104	msedge.exe	122
PID 4104 wrote to memory of 5028	4104	msedge.exe	122
PID 4104 wrote to memory of 5028	4104	msedge.exe	122
PID 4104 wrote to memory of 1480	4104	msedge.exe	123
PID 4104 wrote to memory of 1480	4104	msedge.exe	123
PID 4104 wrote to memory of 1480	4104	msedge.exe	123
PID 4104 wrote to memory of 1260	4104	msedge.exe	125
PID 4104 wrote to memory of 1260	4104	msedge.exe	125
PID 4104 wrote to memory of 5796	4104	msedge.exe	126
PID 4104 wrote to memory of 5804	4104	msedge.exe	127
PID 4104 wrote to memory of 5804	4104	msedge.exe	127
PID 4104 wrote to memory of 1716	4104	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://securemail.fennia.fi/message.cgi?B24UnkBr6qVij3mrLjYoJ6zN_1XbmrgMN5UnRNL02G8v8vo2vc7OkJGFzc45U2SP5xVYAYFCkNc8sCRdJBAJAUsRZWQRQ2TD_uq1PxfkhK3Nq5GiPjgVftdC7pUoMgXy
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,6578940997736114489,4818388504067219958,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,16820456259172628481,14940682895109665838,262144 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,11188370240011668977,11715683414180682135,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11842393706509511282,4912041556478471887,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10141436314141670403,9277050327205832480,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,13888437542285509736,2102136461156129699,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,9479039699060115540,3678349200626018521,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,8798943389977129944,913939488611552684,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,11459607407430426888,18080819839991995314,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,17827182193447859945,14484368783936828225,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1778276131506221844,1131644190880716906,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1778276131506221844,1131644190880716906,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,8978223079659609698,7647264404840252757,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,6615836279005032718,9048143076454765175,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,18080230292500106039,1999347206962573343,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16296281047343673976,424463223246629840,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6420,i,2259545393813657819,12960887300535102344,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,10500276646481953168,1157240176184698307,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6972,i,9637491125774608209,12192605464474623486,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6492,i,6102249205954986705,3039691447608369668,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7156,i,7848294009729128027,15546305401474019672,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6680,i,17798545007982714338,5470250268628687855,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6272,i,810837596560426223,18268571376572231659,2097152 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,8728763561319836309,16279132424107750495,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,7487959132441488920,14927698676471034445,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,6616656363123203644,17066760343670013486,524288 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3724,i,7066832828909480892,7076233755411786624,262144 --field-trial-handle=2280,i,6729236071834560871,13458375519585325960,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 402KB
SHA256 aa6cc85e6422918c8f28615f5a6229fd95551db4866a953e94db3ede85e74157
MD5 1d14a54ebcbc8ab643de128a275df7ac
SHA1 238af131932ae71c9b5904dbf79312969b686d89
SHA512 7c7ebf7520304f1184b033b4d353a4ba4b13f97a9b25e2ec01bf603581e68d961bd62ac512b523203f21d45a3a10aaf570398cb723ed00dde4b27547a1a1bd3f
SSDEEP 6144:+Hixx+mZCMYrU6Em16QfXqI1DRDextUnQngWg/4dHyA6928F6iuHHLlXcJEOXkeA:TpCMbfkz/Hi/eD/2SAq3ELYvXVGF9
TLSH
T1F79423BDB31924CEB2A5E3388E75CF5A050C7E709A980E2FE7EA5445BC5B790704E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 67KB
SHA256 083e4b904aedf73603201d5b3c7baa27df72db55b3146d3845f0be8dfb9a1fce
MD5 7834c4d0d73c0c39adea3e576be1f3e4
SHA1 d960d84cc5e517feefdc6b23d99ae406847e603d
SHA512 fc336a69e9e3a13adef75e294688845ed03efe4779d901f67285bb91639e9cecca6bbb06f4e45261bec3f8577c4bb8ae803ad9cf70aef085de92b4fd591d1bdd
SSDEEP 1536:uxppd9LrL8qqSlSdwavN8Un5m98oODLLDHocIXhLA1Xbodcwz4RnF:KpL9LreS8TpA8p/wklb29z45F
TLSH
T1DD6301195338F172A5C066C64C330D91B53DFFA636DC63DD490709B5888A8A93FB39A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 5dc8d16ce45aa9a96b604891ce7b2aee67c3e263544639554f3f803491a9b5f7
MD5 47c5aed923c53274e5f7bbab6fa61515
SHA1 2894f38f22d81ba2061c190abe38b280b9f254ff
SHA512 3a9ff9592a60494c649b627434925090876571aebe2c7e2e803df4a88c778128319ad83f23c8c2120e2daaa30168f5d2ba831ac7b9cae2ff9aea7edea96827ae
SSDEEP 96:n3o+z9vIlZH5P5uovO98gf+K3heB6NKJQKKhuCyowzxBqAJEnFWJlgkd1tnJfJI6:n3o+CHH5Q83kFNLuLzgKzJBg5HMBD
TLSH
T174F1A3F041D65CEAFB1816B92CF2293676B188F6F417AFDB2180D438A492BC85228871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 536b26e1123e10e1e9011f70024fd630626d9af5df6e91103d55d15aa9bf8f63
MD5 1de71751b565af52a5aa4497b0409fe5
SHA1 80c395fa03897e9981aba98092062473e7383b51
SHA512 d07c550e3e20de40c07b384609c464ca424138f505ed8d0d3da9aa96cc08e977c0190c9ac6f37d264b6b463951ebfba3ccd8db9a208fbaaaaa16308c06964acd
TLSH
T197713B7806868DEDF35D033E1CF2165570B188E9F423EEFA3260E874E869F412619DB9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a7b93fd4bb042ca7449dc55a4474a18e8db10868fa6b703f185feefaadb7b8d9
MD5 096fbf795b0c73faf1d1f14affd676a9
SHA1 85ef7107026ffd0b7efedfa6b38fcddb6724fb0d
SHA512 8888f660c5af9598066bd6cf306b785d4b546ce348c5ce417d88aea62fac303ec6e4f02a00280f92cefaa8236019ae390052df48c5a7a734ed98c6e572b3e89c
SSDEEP 192:DY81SHiKMhxGPAR81gA26AvFtGuncPuqZgRC4fMZktlR:DY81SHiKMhxGPAR81gA26AvFtGuncPuf
TLSH
T143F199F7C7D9822DC81166F09B15AF1ACE1D0915832C3D1A88D4BF5BD3E2471E215B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b860a2e711dd6f093c2dc23a4762026404e5a127cf5e568d0d6b32578880cdb0
MD5 28d1c0429edaf4f2cb64fba667036104
SHA1 4a7cad08baa479c18cdb385884b6b4208187ba85
SHA512 44d2ef4ed946dedb0e7ac5ba557a813a3cfe4348b998c547ec09e9d5f7a813a5776538928083ea1373b96d20fe66618006b8f342f38f056b9d102ea366ce6952
TLSH
T142D022231B0830B9A67D3EC2916BFC8FC32B10748992FDD820E4BC982532D7E561F140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe599253.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe599253.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0110f17cee3da64d5789f2cbb6f9ff18a101f54cf369cabc355ce6b8c071e570
MD5 0668249f5fdafb6ecf3b167c40afc828
SHA1 14734c58a3eafefd77c4e37e2e1b3786c929056c
SHA512 f3e65d633f34799f36d6665397d4db2c85c866c2ee646e24dcf6900d583d69af55ecf5a95d4c463e10cb31e75cf58c18bf046127179f88a34f8f12e5ae386725
SSDEEP 192:sxZIRgyM/jK1Ml8MkL/fbsR2DIdpBPHW6+WNSIX/YCY8JQKIgrJ:sxZImML/fbsR2cZHbF/7B9
TLSH
T19352E916AA349977CCDBD209F945BF53D6F954B2E2940E44A9FCCA0C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 9ac4b39ede7db594c573b48b4a69b1ce4e7fe2efcfefafd92bb1a77b904a2e60
MD5 b425b6fb23ba87e9d68b6d8ee4201551
SHA1 9f4c80cd36fe9658680bbfd40300df9425434d2d
SHA512 a10a8a94d6cf36b06f42b2cbd51b58e96399ac822dc6065d094bea645e12c707bf919cc8adc3141ffba4da2b388efdc2353873eaedfd1c78d01cff90bcee831f
SSDEEP 384:sxZIdq0m4L/fbsIHDzUHbAqAEAoI8/NBIgX4wM:sQs0m4L/fzHMHbSsN3M
TLSH
T1C482D657653489B7CCDAD119F924BF62E6F504E2DA515E4CAAFCCA0C00E6AFD230681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a970382056be9d92f23aa88c02733a12d7cd89913bb41be10636249ec82c1ba0
MD5 1e8761f9d8c0242ec371f14cd5199a1c
SHA1 2726d73f185754681cb57bec3ab9fb4b612ff0c0
SHA512 83721733794d78cf5c52fde74c581c21cf83d5450be08e7b0ff3953c6cdd71983df7bf15d0592eebca1d82bcbc1da043d046f2b777fb00aa2fb085920b852295
SSDEEP 384:sxZIdsm4L/fbsIHDzUHbAqAsuI8/FBIgX4wM:sQ6m4L/fzHMHbcF3M
TLSH
T1B282D753653489B7CCDAD119F924BF63E6F404A2DA515E4CAAFCCA0C00E6AFD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 2d48ea19750689b4fcf81d670fd3c98e73bada955217355fa73249791512ce0c
MD5 957654523f8f0ce0b9dca264cf6ac147
SHA1 653dd07060bb18336bdd8e2bcc60787eae756bd8
SHA512 cb6eea7fff9895ae396430caebc348066e8343359b3564aa823333963e7f7359fa90309896a46e6eefcbd03731260e7f0ba327c9a93d16e0d069eb75ca4a4414
SSDEEP 384:sxZImsm4L/fbsIHodHbYqAsg8/6TBIgX4wM:sQvm4L/fzHgHbLo3M
TLSH
T12982D653652489B7CDDBD108F925BF53E6F504A2DA950E4CAAFCCA0C04E6AFD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 68600bd68cc1bf8acd12ad3623e86f1ca71fe5386f49ce3bc7013cb398c37a18
MD5 1d0e4a5f7c6470644167d1c7d4527a48
SHA1 a986b1febf841c23e7d4c91ac5ff1c343b6b1a57
SHA512 95916908ebda83702e9c93a7c6a0dee21acbde28acfd8f0d10c8c6f5d2f69f81dcad805cd4b8c20d1e90106c21b88c55109f576432587fd37e4b0acf81705a18
SSDEEP 768:Gv8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVOrobd:Gv8bqn+WvSCt6u1jaCZLbWVF5
TLSH
T16BD20A3B280CC77E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\temp-index
Size 2KB
SHA256 1ac992d0e83484497aea5a9864200261913b25185a617f4b13e8da6af9b2adbe
MD5 472c1d1380d3124e96e78074c04a3cc1
SHA1 cf459f8fa6ef8ea613568d71e5a9c470ea64d70b
SHA512 601f9ccd701de41dc393b0716b0c5c3be09dfc0b78cb91844c8e44094d539a7c226d22c6232e8d8b8ce2501ab5769b5740476960cacd03f8a103ef84fcc348db
TLSH
T19151A74D5D4B6F66CD6C10F224B708823B3524FE8A884B07E59CE5746CC32152D69619
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 888B
SHA256 7dc8236986adf2cfcd50dadc32296cc7a811a1519d5dfcb60dd5a3cf14bd50f3
MD5 5ba8095d37b7748981e6825f398b9ad5
SHA1 06c2260464f79f72026d953fdef4bbe8132a653c
SHA512 ef0d7b6f28e302f36e2cf2fef4d756af4a9d2fa14507ffc1920c0d8c71ad704840c649460b3e717a777f199c27bdec1dffe930e02f8886fa055e76cda31c152a
TLSH
T19F112D865EA59C2FEE5A0AB314BA70F47370CADC6B11E323543D323B1C3634A15570C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59551b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe59551b.TMP
Size 888B
SHA256 98c5f15e409b504c60da3ab8f750da7255d1bdd1f852ef6877ae790f5552eb29
MD5 e6d44bc85bf9b14b7493d58ac77d4dd7
SHA1 28be99295db248afc2710c67eb8a1ffca66e7756
SHA512 0ffd20e270da1f644ddd47f74293e37560cf45eb5f665a54dff496b90c089de9f3a1d0de00ac7b5e6496550c4ebfbd35f3b6265c34b77c382611ecda72800278
TLSH
T12D1102464BA68D1FED5455B7059660F87330CD006362F753907E253B1C7978959470C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 10e205976f52f8c8b10042925c0521de53cfa24260b70e48ffaf26c4c5e70f63
MD5 8613e198b02095167f1e6b21534c9d4a
SHA1 24e8cb33aa5ed55bea324e98ea756a21094f7e6a
SHA512 b46f6c9125f47392c3b6f32ec948aaad4f5f0283fd52b938859dda277720a333ce3d01eaeb96596ba1e5580be918a0b7d49bbb939684e8cbc8e0fb60e1a38b43
TLSH
T177E0D8FA29E72860BCBBA3F5247048E002597998CD46BC9E1069A1D750B33623856C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c8f989ec1b23fb972dc952e5a8afe43a7c9dc5fd4c13d23919f8f16fc290a0c3
MD5 fa7ee44e14dc9c3bc59b3a7b610dcfe6
SHA1 ff1c826032dd039d2dfa0f189af1ce6104d32dfc
SHA512 100a1dcf2f28d63425009561852037bf5ac718d80d10a1b4c291865c456b974c45edbd72dbd8aa6dcc3ae45bef772fe80ee9d06e7c096c1a1c4a28d02372fa81
TLSH
T1B9A002B2DACA980FC900467460B9D593336048F9021713B5C8E8D4988C9534151D1111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b1a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b1a3.TMP
Size 48B
SHA256 ba3e0b041c103ff8cbedc4dbb84aa0c5b1792d17c2023b63a3751d25b80f2e4a
MD5 ca1d893e647325629ed0aa50a038eaeb
SHA1 85461d828ecca390dff39a46036367721876b7bb
SHA512 86585078efa7fdff83d8aa501dc4d4fccdc678b76e253309190cb9c64cff2371df2223520ec32ae2a75e74e9701d67e6518a07603a6b2465020ae0adfe44fd3c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9c17606d7e1852368a08e3c1fd71cb462ae504cb400f7db2519b745daa568859
MD5 adab016dd6a7baebda8c5865b0f6a9a0
SHA1 d065454e139ac01436a9452b192d7859000ca839
SHA512 72b511064f16ce38d5402cf54385e06881ef4c909ae80456bd47d19aa7520ad9cddb3d561079b63c901d9a88d5c2e166015ba2e7996559279ef737624c596bd8
SSDEEP 48:K4aIfK3qAry1/IxKkY87yB4InK52EPQLuagK8:K4aUK3qGm/KKkYii4QK52a
TLSH
T162914B2732B7024128FD241DA2DA96779E4531633428A56F7BF860F11F6AD216CFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 cde60381bbc291b3a8356f87e18a623100e6c3286305f154fcf1d6f1222aa5e5
MD5 0384ae8f7eadb531795492bcdfb763a3
SHA1 1ebebb742fb698020c9e2ea848b9277fe5432c00
SHA512 2dbde2cf0759de2f69db02be106e182d034b0ec2a1dc3e1fc0bbe3fad0a087cb18cbb8f0888f9e0fa68d54f05c7f1cc079805e8544b8b803b36ecc21ca51de86
TLSH
T1F021558093F950446FC9A942C10E9593D8E1BA2E261D5975232E40F44F48C275B7FE25
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b25e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b25e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4f745a9e0b4b8af2b0805285275df32cc5aaae6950fd8f4234a8698eff135c51
MD5 6cb9e4252dd8803f9668c3a2fde0f0e1
SHA1 a6459dacdba6715924f306898c58f28a2b7bc8a0
SHA512 ed9634ecd2617f3e8b31c9b541030268e7c063c6780eb149d8777fea69b2fe276f5a0c378581b58faf378d14f9b51e8d176ace272537199c5c944bf76747dfb6
SSDEEP 384:YZcIhsNEXE2TvvEa+qOfZy9OObjI9G6w7C+:mh9cafORy929Mn
TLSH
T1AF929E326C388C3359EA9555F88A36275EF8D0B7E7D96B84E1DCEF0C05E799C030A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 90354888695a33b7c05f038c18e573ee54a9a5b3f5955bc2f914b1f4228be11c
MD5 9bdb9ea7bd301080e06cdfaa663c80fd
SHA1 c107b34f33b815d9adeacafe89a54fe3a26f170b
SHA512 c01471bbb989ad54d677753b250ddb64f266f90eb209f25ff216662eb7b7e89fce8194cc409bbd05d3c28b1b875ce98dbdf7e390e022470963b5ce721f9d0c8d
SSDEEP 384:3ZcIhsNE8Tn2E3bEa+qOfZy9OObjI9G6w7C+:/hOgafORy929Mn
TLSH
T153929E326C388C3359EAA555F88A36275EF890B7E7D96B84E1DDEF0C05E799C030A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 da8d448bb9e2fc11143fc59d7ca1fe05d6368cc96fe0ac83455c63d91e533913
MD5 d451040f32b25a65a766f7f5f7952cef
SHA1 5a698337a27eb0ae49c50db79ad0e5fefae2712d
SHA512 602a1da55cb4a2e0ab305395b2780e90100b2b3da2c4143d9f3480d8bee8c5703a5a88bcdc910563cbdd2c5d4cd2dfd8bb3049afbc0f97a012d8310e9c4799e1
SSDEEP 192:zONF6Db4QmiUyqQtBa+jeOmEtmy8iNzPquU6:zONF6g+tBa+qOfZL9U6
TLSH
T16B122B36797C9C775DE29584F48B36135EE45167EA8A7F90D1DC2F0C00DB69C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 743a283524cb378d00b0409cc98105d3221dcdb92f12b06b2f4260c23af9ad7f
MD5 fb20c96ff2c1b131ee39bf391b699f55
SHA1 8fee181cf74402775fdb60928cda04544132778b
SHA512 c711ad445a67efaf278d36df1a1650a6d25689b374f3e311257a7c73b400ea221b5ef18eb73d4957e5f3d8b7c11dc9babae85cc668e65f5dbe70ae01798a0947
SSDEEP 384:niFiZcILUzsNM8TUNTUlIl8Tn2E/bEa+qOfZb9OObjI9G6w7C+:iFQ81wgAgafORb929Mn
TLSH
T112D22AF258E78836D9AE4747B77D2E135EBCC0A7F5856A44B3889A0CCC964BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af38d146f3d84841041623185c69f4d80ccdf1b81d063e8ba6e0e474b3bc353a
MD5 ab0a473d6ee4d389477f94838ceefb29
SHA1 282a71f09d8f794598c4172cd09e53305e3de56a
SHA512 a22455e2dcc7d7f74bbc44226248e9418d3e35035f0bb070e6459694fe47d7e1a343ca305fe30158816b1357c16d22f5112246921e07151faf5735b88120394f
SSDEEP 192:vONI6Db6QmiUyAQHBa+jeOmEtm8Rg1DU6:vONI6uaHBa+qOfW1U6
TLSH
T10B02E93969386CB79EB29E49F48737275FD4207BD9562F84D6D81F0C00D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bc326be4bf3918cf2411c4c683258f9a7253bbf4ad31c25d3013f67563d2a45e
MD5 3d191f0ce97edd20cdd55211fc82efa9
SHA1 e1024362fb626cffd1555986f8cbb778e40690fe
SHA512 5fcd2f20d1c026d84e2d7edfd6363fd432fae46bbb652080d4cab53e119ea57f94a77d1300b9d962b75635b5c7b118e458b3bdd912f5de7e43103b7b650e60b9
TLSH
T1BAE00113A30104BAC428037101931B202BA2C4B04AE203075E20016A1C322446E34EC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 952db407db29289b3233bbefbccc540d6dc8f205df13cc2c00ea02adedb63bf3
MD5 b650aea309967125f23b5cb6dcd0e360
SHA1 a9b9c6269131d7e56eb991185cfa3f7c50a635b2
SHA512 f0d9f4aa002e8413aafa69475b6de215a6da485b4b0226f88e79bc46a549669a74bf0df1ced234e1643f46ba18fc2600c59d2c58c6462976474df3280d6c2769
TLSH
T1DCE00113E30204FBC86803B101931B342BB2C4A04BE303075E20027A2C253442EB4DC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9db53a932d1656cc5636b9ae0e243acb4862c1c8c8fda4090a921f94100454b7
MD5 23148b26c52fca3fd8eece4aa3b7e93a
SHA1 b128eec9927c9eeb35a218b99db62252bc1a51af
SHA512 ff2a82a6158c8c58260c0fe169a43fb781df8744b674d2652e8ad272c67f428a0ee8c03d6295d7d08defea68482fcb78c1d7b0a81dce44d5f711e0c86ae47106
TLSH
T124E00213B3010478C42C03710013172007C1C46044F103075A2001571C321445E34EC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 77b7901544ce1397ab145edfcd4cf18b26fb492604a3d21ac3192cea31676b81
MD5 18dc3e52b41257f7eb52818aec111b38
SHA1 d8abcec9006886b5dba8102a5274471dcf4254a2
SHA512 de6113c70931fadbf865f0e4bc742368e774305e7ca96523fe97169ef21dcff9727d9d3b0ebc4920f0e1e9b332fd64e6d6d08a55aac7148d2579f65c8f86ec91
TLSH
T145E00923E30204FAC86803B102971B242BA2D4B04AA203075E20026A3C663442EA4982
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59699d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59699d.TMP
Size 392B
SHA256 f7eb36fad027761e72ec8063ac991d915f0d22f3a3062f8d85dd34fbc8635078
MD5 2947ef88baf8936fc481f5d66570b49c
SHA1 bd1a8c071a24973f5f13f6cd4372c80fcc33e7c8
SHA512 37f430f0ee80858080c1d558af23e2b23f8eca87d7f57346e6592bc5e8f38e76e8c7f7bd179489645a2f4afe22aa6e96296c62fb91613cf9f2e3fbbbcb393aa1
MD5 SHA1 SHA512

Submit Download

88e3b00b-d9a2-48a0-9518-e0c4c4a75f08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\88e3b00b-d9a2-48a0-9518-e0c4c4a75f08.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c08347b450f0b5c023664af9f91a40711af4a995acaf94faf5e43e5ea425ea8b
MD5 8feeaade0744ff407cf6a5e0357f560e
SHA1 54207f47d5edb795441f8820f7bdd5f98f2082d8
SHA512 f5b19482d82a25aa4d1ffc40ddfd93dc2ce3889433e0607e16f608e72f7f1b15db83d6e01ecdaa50fd2d5df0136a5e8fc6b571ae6b8f233dea1143bec9b093c5
TLSH
T18F41F859B7EA1148B3B36F59ABF7A86D487E78732E4B945E00110E4F0663A44CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download