hxxps://msworddesktopevisortintegration[.]png/

Analysis

user interaction
yes
max time kernel
898s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://msworddesktopevisortintegration.png/
Sample260728-mn2ynsvarg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4168	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297086677240840"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{58F128A7-5B83-4B87-843D-896264980351}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 3796	3396	msedge.exe	86
PID 3396 wrote to memory of 5024	3396	msedge.exe	87
PID 3396 wrote to memory of 4168	3396	msedge.exe	88
PID 3396 wrote to memory of 5024	3396	msedge.exe	87
PID 3396 wrote to memory of 5024	3396	msedge.exe	87
PID 3396 wrote to memory of 2248	3396	msedge.exe	89
PID 3396 wrote to memory of 2248	3396	msedge.exe	89
PID 3396 wrote to memory of 1324	3396	msedge.exe	90
PID 3396 wrote to memory of 2440	3396	msedge.exe	91
PID 3396 wrote to memory of 1324	3396	msedge.exe	90
PID 3396 wrote to memory of 1324	3396	msedge.exe	90
PID 3396 wrote to memory of 2440	3396	msedge.exe	91
PID 3396 wrote to memory of 2440	3396	msedge.exe	91
PID 3396 wrote to memory of 3448	3396	msedge.exe	93
PID 3396 wrote to memory of 3448	3396	msedge.exe	93
PID 3396 wrote to memory of 3448	3396	msedge.exe	93
PID 3396 wrote to memory of 4760	3396	msedge.exe	94
PID 3396 wrote to memory of 4760	3396	msedge.exe	94
PID 3396 wrote to memory of 4760	3396	msedge.exe	94
PID 3396 wrote to memory of 3800	3396	msedge.exe	97
PID 3396 wrote to memory of 3800	3396	msedge.exe	97
PID 3396 wrote to memory of 3800	3396	msedge.exe	97
PID 3396 wrote to memory of 2556	3396	msedge.exe	99
PID 3396 wrote to memory of 2556	3396	msedge.exe	99
PID 3396 wrote to memory of 2556	3396	msedge.exe	99
PID 3396 wrote to memory of 4480	3396	msedge.exe	100
PID 3396 wrote to memory of 760	3396	msedge.exe	101
PID 3396 wrote to memory of 4480	3396	msedge.exe	100
PID 3396 wrote to memory of 760	3396	msedge.exe	101
PID 3396 wrote to memory of 3960	3396	msedge.exe	105
PID 3396 wrote to memory of 816	3396	msedge.exe	109
PID 3396 wrote to memory of 816	3396	msedge.exe	109
PID 3396 wrote to memory of 816	3396	msedge.exe	109
PID 3396 wrote to memory of 456	3396	msedge.exe	114
PID 3396 wrote to memory of 2628	3396	msedge.exe	115
PID 3396 wrote to memory of 4344	3396	msedge.exe	116
PID 3396 wrote to memory of 3960	3396	msedge.exe	117
PID 3396 wrote to memory of 3960	3396	msedge.exe	117
PID 3396 wrote to memory of 3960	3396	msedge.exe	117
PID 3396 wrote to memory of 1796	3396	msedge.exe	119
PID 3396 wrote to memory of 1796	3396	msedge.exe	119
PID 3396 wrote to memory of 2704	3396	msedge.exe	120
PID 3396 wrote to memory of 2704	3396	msedge.exe	120
PID 3396 wrote to memory of 2704	3396	msedge.exe	120
PID 3396 wrote to memory of 3428	3396	msedge.exe	121
PID 3396 wrote to memory of 4428	3396	msedge.exe	122
PID 3396 wrote to memory of 4428	3396	msedge.exe	122
PID 3396 wrote to memory of 1496	3396	msedge.exe	123
PID 3396 wrote to memory of 1496	3396	msedge.exe	123
PID 3396 wrote to memory of 4492	3396	msedge.exe	124
PID 3396 wrote to memory of 4492	3396	msedge.exe	124
PID 3396 wrote to memory of 3024	3396	msedge.exe	127
PID 3396 wrote to memory of 3024	3396	msedge.exe	127
PID 3396 wrote to memory of 1712	3396	msedge.exe	128
PID 3396 wrote to memory of 1712	3396	msedge.exe	128
PID 3396 wrote to memory of 1712	3396	msedge.exe	128
PID 3396 wrote to memory of 3456	3396	msedge.exe	129
PID 3396 wrote to memory of 3456	3396	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://msworddesktopevisortintegration.png/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fff4d27c188,0x7fff4d27c194,0x7fff4d27c1a0
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,9211920619633182704,10131214747959908850,262144 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,12724370044386717229,7081001083218846675,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,3323605544875626434,1627830974829540132,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3736055056358389687,13926008040210261338,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5094255415505142122,11043719347431893331,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,16307906546832086412,13572261785088159952,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,17834280884839674157,8905627357795953375,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5044,i,1634926182623138167,9972100266080301222,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4296,i,8181297731433802022,9431990288216730232,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,1904807595503468545,14351158946078995512,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16490332133157105473,6399044784857989866,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1173606436292149105,16727249830818738999,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1173606436292149105,16727249830818738999,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3492,i,5391136766260474255,17291164605848699014,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,8050300960027555095,7298406913130099100,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,15211154101229351766,8672801951202588599,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,3040391380983056031,11503854069991204406,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4856,i,7695867949155235605,15311033546299722807,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,1530560673510871971,11459422594215968427,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6316,i,12217729511018319844,5891724884823477765,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2516,i,11239230610496374539,2427194433161863917,262144 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,12218268390870067063,17043452522248035926,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11356656706958258100,8073882783254095198,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,16841070927450269281,8477440232440435394,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,257910039535584389,1729956439130804237,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5016,i,18181828762204479028,17545633234125868490,2097152 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,18415787104544799129,2372217155456147870,524288 --field-trial-handle=2632,i,17430806967418808607,150942889816355153,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 19661e32b5331084bb9ad7102d6972954d85a5e265d4e8c3888441eda1b01407
MD5 b074f19e97d805b75a6b38647866d018
SHA1 e5618459ee52f67f98dee6b61c413f0cdea77d7e
SHA512 17d9dc14093b8649b99815ac0f4ad9171824256c01e14ce5cb4e28ce839791ad2a12b5f1d653be1a9b292aed89b8f029a241f69b656db7a94747dd38e3c4e9c1
TLSH
T172E026C954C8C26EE210A48B457C6B6C82863A0A9BC86E2E1F0898983281440A7F79F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 b8918dbd576e6e094cced114ea2cb45ea9a86bdf6f93aa52026e58579c1f4e79
MD5 ebb80e37706ee41977463bdcb20e9d5b
SHA1 ecb54f6e33e7bf0cc22808308dfe0a10b4886778
SHA512 4f52c5dcb0a66ffb6b5dd65c67ccf67fe7409d353da7ea7d21c91df61a1d8c84c0258a0731b2fbc7ffc6709f284d94d34f0abeaf0f2d033215db59e77303b5a0
TLSH
T104E0485DFFCCC16A52319787927DA31545B2750595BCDAAD720C64986441001837E9A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 60255b3c1b5efe17d61cc5ab1ac627155e06876b7b37e27bf3408a2a4812bb6b
MD5 a663394a51054a88ce638715c37f2699
SHA1 bf6142af6995abd2382fb0b5c472c871951b05dc
SHA512 c6fe128b1f183e64ba779ca08d043e000d0bb6eefd6d5d8bd5d1e0f1c2c460c715d22b696b4e4dcfb2a26ee41c7f2e985d2267761e5dc0548592095a25674db1
TLSH
T183E020C955CCC25DE304688F517C535C42423A0A96C46E572B04C458750104067AB5BC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2fac6621bd0bf82a958d06fe079c50f18fefd83c9f012774cdbe6b0ed937b9e0
MD5 3981bfedebea7dfc4248871e20eefd11
SHA1 cd497754cbe1c84557b77e38280bcdd570654841
SHA512 f2e9cf63752df3f2056439533323c6b4e44268aa799614fbdfc24199c2bef9fb868895637c5fedcecd8e01f926734792dd6db5cc0e945c9a16f88f43dd02069c
TLSH
T12D719158126BCA8AD7200331E4E33174FCF28FA90EDFFE8511819BBE19D0F6D6126408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f79a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f79a.TMP
Size 3KB
SHA256 e373dbdeb283f5d88023e66dfa22b555f5e94cf45de5fb778769772211da6ad6
MD5 0658cc25f6f9c20231ff50632f312a43
SHA1 5939c964921de6cd6430543379fcebc1572308f9
SHA512 99aae6caf310d69505e1f166c07ae3449261178c82fa58062b4b4445cec3fbbc5242ad8a800c74fe59317516ffdc1ed4cf8a48a98286d1d82c1671a42f7ed96c
TLSH
T199719118126BC98AD7200331E4E33174FCF28FA90EEFFE8511855BBE19D1F2D612A008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 22bc04eed0572a105a63718abc5f5eea0bd71ed31b581e2691f77e69e2b11a1e
MD5 5e42d2291c736b687c1fcbaff91318dc
SHA1 10632db103f29e1be4f27393111042e011954e90
SHA512 25902761f73e1bbb0edfb458d6c83394e7963bccae251ce9a118c3252ab9fe8ca6868c3fde9057591d2ba6fdfceb4594547b2d62c09bf2bcbd137f97740847a0
TLSH
T18C115BF3C3D5856E891516F06A28AE2BCE2D0615831C7C19C9D4EF27A7E3475D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 5457b4b8787bc9810d270e268dabc7a64a1c91668c9e701a3b5a419a964d369a
MD5 5bf3b3fe9f4e97c06c195d76ef1605d0
SHA1 495263871de98592745363d70d1a98c5f6c9d626
SHA512 c2815900a029a3b9e239dff3359f04145d4f4f31b662437d83bf65f35ec2e299f0217e44b553178bd08664587740fb23d99d50d51bcaeddd69a84dfd63f22a74
TLSH
T13C115BF387E5856EC91516F09A28AE2BDE2D0506831C7C6985D4EF27D3E3075E102AAB
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f790233cfb6c2e2c4c534f87d37d0a14a41d5e6191a5603be0679867533e839
MD5 4e8a5fc495d46a1c0b511a6fc4f96908
SHA1 991306a16c6d1fbd60925519cb28f7813aed8ca4
SHA512 0d7ffa3c2799de64daa9631ce5b9abbcd933fced925d74f8d8954ca58ee6d6aecaf185ebdf9188d2dd61fc2f0e3afc93852bf7b70143c185e8a939f60d32d6b0
SSDEEP 192:sxZfRHyM/jK1Ml8MkH/f4smHQwgbIdpX2hHW6+WNGYwK48aIgrJ:sxZfbMH/f4s3wJeHbGl9
TLSH
T14D42D7166B3899B7CCDBD209BA557F53D6F90472D2900E4499FCCA0C05E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a62e3e64caa1765010277e4bf2d2c227eaa5acef4a14337d94e6695b5f2152e
MD5 e049648feffc9300fd5a03e5306208e4
SHA1 1ddbe02d099f267457041dc6de21632793ba0f37
SHA512 e42fd96202583b779d6fa65e19bde0709785d161753d5d5e04fff6007ea10c79fcf261f81c7c1f3f43799d612d274116bfeb26e4afa29fea35e9caccab17bc99
SSDEEP 192:sxZfRHyM/jK1Ml8UQ0kH/f4shHQagbIdpV2hHW6+WNF5+/YwB58aIg5fJ:sxZfbqPH/f4suaJwHbW/1f
TLSH
T1DA52D7166A3899B7CCDBD209FA41BF53D6F54872D2900E44A9FCCA0C05E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 25bc04ee66a6dd518faf0f56c1c690af547fbe7576cd3099c29a5e4dee90b9aa
MD5 fa1bb83588fead0fd628b09816d9f376
SHA1 ab5e0c1ee87051dca1e0b8914cce03d9e6795394
SHA512 28054d60ec5fdbfa81e44a90bc2ca979206311f6284d4632ae79d14f514253e2245f1cff4e988d953c1f927750b7e0a36ca27831ac7a59de3b0892f6a01d1bc1
SSDEEP 768:jg4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dIrohccda/:jg4jeXmWvmKLEu1jacPLZQdz5a
TLSH
T1EDD20A3B240CCB7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03CB7EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3dff8ce40b615ff7c5b457978e04df3b7e63dc1e77d05dcfd0549c0763700793
MD5 5a118a282d0f8c6db11554af41d3b0fc
SHA1 bfa24d552ef4d19e9822c78701661342a61741ec
SHA512 e765aefbd5cbb747d6926fbfb348b34e514539fe4215f188a69ce4cc7545d6df651c7e465e8c3c86b4a6673be2bfa0ebd3dcf0845a2a2b03c3687133611b5428
SSDEEP 24:KdRtfRoR7RSaR3dRfR7Rz4RLRv+RCIjRnRzKiRchaRJRz1ER1RjSmRdMR48R7RQy:K88I7KZiEzyNdIpKGkcquIXKLKwLyx
TLSH
T1569132A636BF43122C3D290C975096276B8671E73159A52B3BE800B60F27F250EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59939b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59939b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0c8a1f4f0a0fc7bbbde4f899b3f856a1379889e030e3528c7853f500564dbc12
MD5 872741a4fba71da8c9f1a9f781da60ab
SHA1 8cc87e98a56b3fae6e5121237542ebf6e8fc2c13
SHA512 565d551591a88f6af3168198ce1a13e96b5bf11c7a343a0befa8c88860b770a5c897da9a6a5c2eec5902bd5a175c4081f690aab1d3e03ea63e5b97ee7809d0f0
SSDEEP 384:1ZcIhsNiaYasVzf+98RUlXU+2mHF1OObjI9G6w7O:NhvbjqlUlml129MO
TLSH
T1A7928E32A83C9DB699E6E651F0873A134FF8916BD7D97B84D1ECAF0C01DA5BC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 42074b1813c5dbc9f4c9064541438214632885abe57677ba33d8934fbdce9e8c
MD5 579742622d2823fd80ca1c0c3c3f045d
SHA1 4daab839b7c2ab60c0997b6e80e329ac3ca8da0b
SHA512 9d8e57ac6327459bde563526d9f39c4aa1818acddf3176d596c109cf7edd624d28c32cd564f702b352f885886c4cde908e7e0fc8c5b18d2714cc5df17b97df99
SSDEEP 384:/iFiZcIDzsN68TUNTUlIl7YasVzf+98RUlXU+2mzF1OObjI9G6w7O:KFQHDwgqbjqlUlmh129MO
TLSH
T155A27D339868D9BB9EE69B41F44A36138FF95177C6D9BB84E2DC9F0C009A5BC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5016abf56ed8b0bef44274a6f37f1c33e6c90ee311f72885ca3fc2d36182e686
MD5 844c9f639c66cc3cfa380cbab3e1718c
SHA1 eff4410ebbb94bc553dc05e31ef58402d29dce1a
SHA512 29bc2095e4941171f089e04a9eacc62b7385dfa633c32f8cad0b5d386c1f5ebb308e9752491495772e973ba0350c5d6791ae55e2ef291fbbea710a8aba2d043f
SSDEEP 192:EONu6hZ0QmiUyImpc/+jVnjzorRUY5wOZAzU6:EONu6oOpu+98RUn2WU6
TLSH
T15302FA35A8786CB78EE2AE45F48727235FE5112BE9956F84D6EC1F1D00C769C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ae56877ebbe8d54c7c62089d69d83329585d7379da014e5346f03298dfbef3ee
MD5 f9826ab2971ace3bde263877b6f28abe
SHA1 d305489bb33c8e4749fd98e726ec9d6a88033d2a
SHA512 ced353f061bc138d879b5d52cf98cbf65f8c9f5de79bd3527be5ac76e56eb8f05e1ea83ecd820d235261231e880f90e2dfd64017645fb1cd0b82bfee76a93b35
SSDEEP 384:OZcIhsNi7YasVzf+98RUlXU+2mHF1OObjI9G6w7O:shWbjqlUlml129MO
TLSH
T176928E32A83C9DB699E6E651F0863A135FF8916BD7D96B84E1EC9F0D00DA5BC1306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3759a4e29ec4c140f20c4eca2893f3319655795b3703e87d6ece73688aa55413
MD5 53b86974dfe3f2b9f81da9ec3a888bdf
SHA1 0031fcc6fe4823604eabb46a106d9f3c3db94905
SHA512 35b9eb62f8079282fa08bd04d2f493b4d366bccaf727a974e4f304e73b057c6087117af7df8dacbfccf97bd92d950e1480d322f5b1c92a98e357711af9f259d9
SSDEEP 192:dONmS6hZkQmiUytmhc/+jVnjzorRUlXU+2my5cOqvquU6:dOND6oVhu+98RUlXU+2m991U6
TLSH
T16A12FB366468EC775DD2AA81F48736135EE55117DACA7F80D5EC1F1C00DE67C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e972678c-509c-4853-99fc-e5516f42a88e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e972678c-509c-4853-99fc-e5516f42a88e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff7c3177b455a1ed2e96bf0f9b1bccba7fdcdfa8bb2dc69a1f7ae04e45937053
MD5 2aae9a919d00b5b24fb4ac8c54ae0900
SHA1 61f47fff0c99d3c47ffbae9cbb99f84e864f1d6a
SHA512 59b8e2f197c5cd26151ceeba521fc0522d442458051e9b370f3c32866532b22dfa94c74f89d9ffd94e3d988e8e09490b2200efaf1a7acdd951981472da173b6f
TLSH
T11B410A58B6F91108B3B76F56AFF6A9AD447ABC373F56D05D01120D4E0A62B40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download