hxxps://us[.]list-manage[.]com/d26SE7XSDOR

Analysis

user interaction
yes
max time kernel
199s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us.list-manage.com/d26SE7XSDOR
Sample260729-pmxnnsthpf

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
209	4336	msedge.exe
215	4336	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4336	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298016538683499"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{9136A21C-435B-45B0-B717-924B3AE0F274}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 60	3864	msedge.exe	86
PID 3864 wrote to memory of 4336	3864	msedge.exe	87
PID 3864 wrote to memory of 1860	3864	msedge.exe	88
PID 3864 wrote to memory of 1860	3864	msedge.exe	88
PID 3864 wrote to memory of 1860	3864	msedge.exe	88
PID 3864 wrote to memory of 3668	3864	msedge.exe	90
PID 3864 wrote to memory of 3668	3864	msedge.exe	90
PID 3864 wrote to memory of 1712	3864	msedge.exe	91
PID 3864 wrote to memory of 1712	3864	msedge.exe	91
PID 3864 wrote to memory of 1712	3864	msedge.exe	91
PID 3864 wrote to memory of 3828	3864	msedge.exe	92
PID 3864 wrote to memory of 3828	3864	msedge.exe	92
PID 3864 wrote to memory of 3828	3864	msedge.exe	92
PID 3864 wrote to memory of 4284	3864	msedge.exe	93
PID 3864 wrote to memory of 2364	3864	msedge.exe	94
PID 3864 wrote to memory of 4284	3864	msedge.exe	93
PID 3864 wrote to memory of 4284	3864	msedge.exe	93
PID 3864 wrote to memory of 2364	3864	msedge.exe	94
PID 3864 wrote to memory of 2364	3864	msedge.exe	94
PID 3864 wrote to memory of 744	3864	msedge.exe	98
PID 3864 wrote to memory of 4504	3864	msedge.exe	99
PID 3864 wrote to memory of 744	3864	msedge.exe	98
PID 3864 wrote to memory of 4504	3864	msedge.exe	99
PID 3864 wrote to memory of 892	3864	msedge.exe	101
PID 3864 wrote to memory of 1980	3864	msedge.exe	107
PID 3864 wrote to memory of 1980	3864	msedge.exe	107
PID 3864 wrote to memory of 1980	3864	msedge.exe	107
PID 3864 wrote to memory of 1368	3864	msedge.exe	108
PID 3864 wrote to memory of 1368	3864	msedge.exe	108
PID 3864 wrote to memory of 1368	3864	msedge.exe	108
PID 3864 wrote to memory of 2036	3864	msedge.exe	112
PID 3864 wrote to memory of 3920	3864	msedge.exe	113
PID 3864 wrote to memory of 2512	3864	msedge.exe	114
PID 3864 wrote to memory of 4316	3864	msedge.exe	115
PID 3864 wrote to memory of 4316	3864	msedge.exe	115
PID 3864 wrote to memory of 3920	3864	msedge.exe	116
PID 3864 wrote to memory of 3920	3864	msedge.exe	116
PID 3864 wrote to memory of 3340	3864	msedge.exe	119
PID 3864 wrote to memory of 3340	3864	msedge.exe	119
PID 3864 wrote to memory of 3340	3864	msedge.exe	119
PID 3864 wrote to memory of 5020	3864	msedge.exe	120
PID 3864 wrote to memory of 5020	3864	msedge.exe	120
PID 3864 wrote to memory of 5020	3864	msedge.exe	120
PID 3864 wrote to memory of 2532	3864	msedge.exe	121
PID 3864 wrote to memory of 2532	3864	msedge.exe	121
PID 3864 wrote to memory of 2532	3864	msedge.exe	121
PID 3864 wrote to memory of 2224	3864	msedge.exe	122
PID 3864 wrote to memory of 956	3864	msedge.exe	123
PID 3864 wrote to memory of 956	3864	msedge.exe	123
PID 3864 wrote to memory of 3164	3864	msedge.exe	124
PID 3864 wrote to memory of 3164	3864	msedge.exe	124
PID 3864 wrote to memory of 4156	3864	msedge.exe	125
PID 3864 wrote to memory of 4156	3864	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us.list-manage.com/d26SE7XSDOR
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a0
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1648819069529167656,11075406771912378832,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1808,i,15865392904563411511,6658378737417872599,262144 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,4435041965216067281,7832317067500870733,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15363277721875156330,3241964830042388048,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13027122960446390922,14771433235452275832,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,8462411802625622444,1105417081515945561,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,2472513245890181001,3997574091694820769,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6947808267912456752,5058078795469060041,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,7063173793815664368,9803701717279053990,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,6636280711965607678,5581425928873391410,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,6636280711965607678,5581425928873391410,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6400,i,466640550751867440,10228711715028780454,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3384,i,16975691678722032214,17006496606320618740,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9562273999916152305,5460727238739331080,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,7408705459315524033,16058505048393624195,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,2184666500402133079,3975322752382011976,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,8489652849111821290,8547741622989154849,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,15767662744276741448,5625848613094402403,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6252,i,15680397565212750055,16512725304629933624,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4216,i,18256955806862472226,9611809849206469548,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6632,i,10367213522988661034,7279316034775738319,2097152 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7076,i,4116711362338515232,750065821614460157,262144 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,7102397478849262647,15619792404157905429,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,6613865857994890789,16784305879355465055,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,16852747898408336618,269239898092316364,524288 --field-trial-handle=2408,i,12887038959483129592,16606784766382548706,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0fb23bca3c7486d8b9a492d0fe9d58deb09d66e396a94e28cd8a807c95335086
MD5 1a0f220b2f5852c5b26efc57c5a334a2
SHA1 aef29710fffc4d71786837b5d495d6f8db6d18d6
SHA512 49c09f93da107cd3387bad3e185cf8f983df870e8a70d9c5ccf49f3fb2c5c9e2414f1e03552f8cc83228b35335386db9912fb83180b8e37ab43c4d1ddcf31f10
TLSH
T1BAE020C918D4C27E96086547417E632CD5403F0BA6CC694D6B048565338344067D3551
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e80428ebe00ab254cfd7ffcdcdc4e7892358f23f54282c7b7fb0a72a6075510
MD5 6b44713702a250ca6851173f9207734a
SHA1 df9cc2321498feed2e47828657186c35debfd1f3
SHA512 18de58c7e7654838c987157f6330f80df2aeba964022b1910754fa8141f8f676abff4eb4f277c11de2c31bd87259024d0d778cb14aa77d5dfdaffacb7d4df8a7
TLSH
T1F77109090E05448DEFD31631E6D123B83AB4B3878E8F7E5A425CD9BE6A35F3246C644C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5c34974ea67044a50bac34f3cd3430fffc8ea2bae8a3f352122a6ada0bb50c93
MD5 a6aabeefd21af025b626dd3aebeb217f
SHA1 1862b1575c4a5d0ac63ae72febde59d756a3f0ee
SHA512 8433328718c73e3ba867d6228e5b0d12b4de88532a73b69850916535482080d48f974a04138b1732cf3ada6db6417c86adda6439e2792122a33df8f4da123d91
TLSH
T1CE711C190E05548DEFD71631D5D123B83A74B3878E8FBE5A425CC9BE6A35F3246C604C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57ca0cfa5678a951a9991395516a78d8ff1c8940bf53e3967568f1fe80433e79
MD5 0b822603ed5e728549eb9869644a6204
SHA1 0a60a624feb9e6562e9d6ecbb1ad41fd461a6cbe
SHA512 92574314845c67dde274f6319b1acda9501eaabd62446f634cd958176e4e1bd9806fa8ac38e33f4eac9c6b9b76a174d85255a67260222408a8a73d44dff9338a
TLSH
T19771FA090D55848DEFD30631E5D123B83AB4B7878E8F7E56429CDABD6A3AF3246C644C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a18.TMP
Size 3KB
SHA256 4e39683385c7397ec77e9aa306cdec01886a5fb10d72e22d7fb9c2fcbf9e93c1
MD5 a2df10051597265ba4e7ab329861c50e
SHA1 c5163e7ebebf99e72278f0cea4608d11f0aba32a
SHA512 f03f6464a030c6fc5c98c6fdb22b7df801c20f5fa4e03a85a7d59c7597f6a1134e0d39a34e271e4ea0f90c93b7f3de10e2e3c88d0a657352c8de853520917646
TLSH
T11B61F9190E05549DEFD31631E5D123B83AB4B3978A8FBE56421CC8BD6A35F3246C600C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6bb2670b846bceb1667c8d27ad96f327e3c82024d34e439d35f0ad2880c4b7b7
MD5 2f47e41168ce04dbb4a066650abe02e6
SHA1 6bc80eb80e1453a828529addaf36a38c1b6bfd0e
SHA512 28ab15320583b5c140d1a6dc7cc42b8ae9a55bc56a71fd8fccd01d56860a63101d171c5a0e4cbffd0757078fb065662450d2e4f41a8738f43282b5985d48176c
SSDEEP 48:YALlNAOXnIyISBIaU1NSTsTzEsv1nyPUOsdC7wByYKEs2fUsTFsmfsVesQisjcsH:DCOXbL5Kpz71yQGwBjKSHRAy1YV2
TLSH
T1A3918DF7C7E5862D894256F066146E2FCE2D0619432C3D26C9D9EF8F93E25B2E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2e62f9b67cec0f9393df692fe1aad23d826da8cd862b1988eff25a2e494a3efb
MD5 26236e98cd1a83df8d0d2465c1c6c321
SHA1 e28f929350d085bc56580918afae1410d58e58e8
SHA512 acecf7fbfb8434f00b166ec55daeecb454d0d8c8cc15b0f914a0883be5bbcf3c283e41f6d7ef15a944b4a42a8e69c9e681cbc0e9b5ea5ba822068e7f59fc0378
TLSH
T1D841C1F7C7E5C52DC94256F0A624AE1FCE2D0A14431C3D26C9D8AF5B93E2572E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 701d90194f53c2941cf019d2f348305248a7890c7430d2253005b0b8b64908b5
MD5 6260fface8d2a0ca2161066d53987fe2
SHA1 dd1340207ef272a955f605bdd205dea207a09c9f
SHA512 ab36c2d8c096291bb149a7a504952ca9445249e186590daf1dfa22457e0eae89e4dcbb3d2501a5d2bd0ce91889e9d18a23508f2f2eafc31e1aa34fd32c42dd11
SSDEEP 192:sxZMRUyM/jK1Ml8Mkc/fZsLFBIdpJHW6+WNGYHllL0IgrJ:sxZMiMc/fZsLFqJHbGp9
TLSH
T1C942D6166B345977CCCBD209FA557F53D6F91572A2900E48A9FCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 98ef98bbe4184d3ca736cb14819ac18bf3195e89677681fbb82adaf1c681c60b
MD5 ed0db4c994cfd4bab5be79493febe796
SHA1 c030cbb39f9aa73847c0f4558e708069191324f4
SHA512 5af068dac5861eabb584f70270cb29eb7d81ba9e21984b2e709e5da7de98e4c4cd32038def2725df1e8bac2b4e1c6726d42b647d868d3faf8194815616a5b99d
SSDEEP 192:sxZKRUyMojK1Ml8Mkc/fZsIkeIdpCZleHW6+WNyLO+XYHVYh0Ig5VJ:sxZKJMc/fZsIkP9HbsXWt
TLSH
T1BD52C616AA345977CCDBD20DB945BF53D6F55472E2905E84AAFC8A0C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f40d153b0f12d9be4f7cb647aaecc95dfc8d789f32e3e0ec7a1b4f69eea0ea2
MD5 20961a0374f8d57aefd0589a1da8a9fb
SHA1 3ccf5949dae377a643aee46468eabbbc80cedb60
SHA512 5da6ddca49191259377de777cb2ab24c711019fb72ce9d7f147e3bb4b50f7a1eb3a167507e4a83f6d935be02769aba1557bf867d98cccc8027ef68d585e438d8
SSDEEP 192:sxZMRUyM/jK1Ml8Mkc/fZsIkgIdpgCHW6+WNfvbTkXYHccXL0Ig5VJ:sxZMKMc/fZsIkh/HbHnkXlpt
TLSH
T1D752C616AB345977CCDBD209BA45BF53D6F55562E2904E44AAFCCA0C00E7AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 238259f1d24841e86355008b96728a2b5f6880302a3e3ccf536a36d4dc9aab4f
MD5 6f90263ee48a6ab5825d26b1ee4733fe
SHA1 f1871e55eb22c9a55153e11f4de11f0128438895
SHA512 701abe4b62eb7738343d0e10e735c1d7e740f228744844a233788d45dff30497455ac8ed379e793a9e97387a013ffe60153c9623037a97784e49b57f7e39feca
SSDEEP 192:sxZKRUyMojK1Ml8UQjkc/fZsIkeIdpCZlEHW6+WNyR6O+XYHVYh0Ig5VJ:sxZKJqIc/fZsIkPnHbZXWt
TLSH
T15C62D616AA34497BCCDBD20DB945BF53D6F55462E2904E44AAFCCA0C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 649aa56a8ac795d0d708a75ca90c524c5e78d22f8cb155d989f2ba56035df051
MD5 f20de8f46ee7613fa964c2cb88489e42
SHA1 88dd0fb44527ab1c5ff77f46ad01a5ea033c2902
SHA512 e720d86bf23f7513143515a78776967a9cf3358cc0686d17583762589efd59c03eb5667127055231a823e1b9e232a6edb4e62fe2c6c4e12115875c6d9314c2e4
SSDEEP 192:sxZMRUyMojK1Ml8Mkc/fZsIkgIdpCCHW6+WNfNKxYHiYh0Ig5VJ:sxZMJMc/fZsIkhJHbIxvt
TLSH
T1C952C5166B34597BCCDBD20DB945BF53D6F90472E2905E44AAFC9A0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6b7a509a3826c782194146f5150e26860efcbb16bb1d7dc0b8f83f79ca82db16
MD5 ee0cb55cff9a41ee83b5b538ae3c9a6b
SHA1 9614c10da5b8337e69210471b1d266b2e37881db
SHA512 1417866df9ed2535d61e7f214d55f60d3144223a200a48b9c96b1f8a0951e99632d83a7b13510f1d19693713d13a4c8b93a68aac5af7a153e886cab333bd5f62
SSDEEP 768:raUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RMroVb0j:raUZYTMWvg0Pou1ja7eLZmRXqj
TLSH
T13DD20B2F284CCB7E4F844E9DEC266F863DD801CB5A584D5447EA894C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9f74b2db545d5ca0afb4c7516790619541d6ecb596a253d10ec6212f5c48546f
MD5 f07e80eabcb7dbf632ea7bc0aee2313d
SHA1 b2564daab68896768c9a67203ca675d1466c8a90
SHA512 80cd10428433f294d10f3c30cd45af5ca0ad0343cc970def5850942fbd411c74bfc1e8e8be25a705c44b6bd4d6b9ecb58de9668c2b6ee15eb6b4746d5f071117
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU0E:ES3D2rZF
TLSH
T1C8D1140272BB02033C3D2914A2AA97774F85F1E33458E42B7B6854B64E66E741CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f5f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f5f4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3e9c7c7241c81a0fbb06610c9b8b59b1d8645a40c569a53862e4031cf6f4dd61
MD5 5c861c002bc2ab49ecd99337d35abdca
SHA1 1b98abb7863d97c739b458fa90c36de47ecc9293
SHA512 2004363d8626586f85975f855493afc25ea5a7e51fe5aa8b203db6443db4f75fd5521af4fe387ad8d5a7e9c1a81f8d5c676125433c9d59652179daed21c30a6f
SSDEEP 384:UZcIhsN5cQF/5ZuzX5od+2OU9mnScjmwDzr:ShiPcOTOUAn1jvn
TLSH
T1A1926C376D286C765AE6E145F88636138FA890B3EBC46FC481ED6B1C01DA5AC1317D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 644054d5e1c56846d1d2e0e991bf612cc2bc20444b453a1710fe9d100d4bf9cc
MD5 fa2db912810f7cb4ee974a34259b2f1e
SHA1 6acc4e7e668e1f1cd43e1a931b567d5cd448760d
SHA512 b80e1b66e294a1610be1278d0b65d34bee1744dfefff929335b0409dcdc5a1b2670fc880f1a47e327b132ca77cd66f926cde6364457e1e672c23adfce0101e2d
SSDEEP 384:BiFiZcI5zsNb8TUNTUlIlNQF/9ZuzX5od+2OU9UnScjmwDzr:oFQ5mwgI/cOTOUin1jvn
TLSH
T1BED22BF359D79476D9AE9747AB7D2E028EBCD063F5805A80B3D85A0CCC961BFC306921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46c90a57b05436ef12c0aa8f9f72b15b0a6e8e843877d51ad2c303c4b117d3e3
MD5 7569be25db1cb78719d11241a91ef283
SHA1 30de057a74b0642648bd01eba221140e3b9fe323
SHA512 6899d7ae03843a29bef314d8cc6a1a076e57164297796c7cd427178f71ca5c05bb1a78066f7c97db150f3a79077c6366677316076f226899d3ae54532c6ad27b
SSDEEP 192:yON061VWQmiUyiRgGX5Obd+jKOImm/aI3GFU6:yON06WBgGX5od+2OTdFU6
TLSH
T1CE02D73569286C778EB2BE49F98737135FA8207BEA546F84D6E81B1C00D769C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c4749e3fb552307d49217eb6950bde9033a8467a5da6b45db8f95c0d6fadfcf1
MD5 73c84732c2189311da22f82a04914a5b
SHA1 1d971d7d5f78b16f7b5b435f34fc186c85f0093e
SHA512 ff6e211126382e795c1211ecb1dcdb4b4048d09b500cdf953a8baf2347f0e65fd885c93d5b4615c03f8280dd807eeb9cec7d658e0ae50d9dd5654422f2dd6d40
SSDEEP 192:jONM61qWQmiUyAR/cGX5Obd+jKOImy9WjJ8qNU6:jONM6jDEGX5od+2OU9ynU6
TLSH
T19F12E9366928AC775EE2B585F48732135FA55167EB84BFC0C1DC2B1C01DB6AC234AC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 98661f618382fed9f6fc26dd2604828d45f098376c40fd57727112e2810d06f0
MD5 eb061aef0940ce003e0ced9fb05092b2
SHA1 367ad9a938a1969ff278b167434fe5c933c71e0d
SHA512 ae1fa98bdd164e3795d98c474f39bad7c2849e75f90209438523e5f6b38a0c0c39cad125139efc459656db21fd7f0206df5e487e6819a486737c69e1e37993ba
SSDEEP 384:EZcIhsN5NQF/5ZuzX5od+2OU9mnScjmwDzr:ihZPcOTOUAn1jvn
TLSH
T130926C376D246C765AE6F145F88637139FA89073EBC46F8081EDAB1C01DA5AC1317D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cab03f80568057151fe45025eace9d455f64e58c58055c97ad44f56f7d130022
MD5 86a40cd5d0ed5860d1dd047c88459a61
SHA1 1ff0a0db9ca804006d8b10f9d71f46fe08f6aa34
SHA512 b5273467b283058bc5aa88a02e335363ce7288bcf6489fe7bf4b53c8c7b7d18907bff0baa1f5ba65c43d5617ee06bf56e00d8730305c08ab647f61055badb9ce
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59dbfe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59dbfe.TMP
Size 392B
SHA256 4516cfbd85ef1c61d6a9532969de3e62b4df8b81222a7d8a8988d2f8d0889d0a
MD5 3ffc59010897fa41c958b9e85f5566a5
SHA1 4619d3850b3f0b4159da1fd3519e0a198ba7bf7f
SHA512 ebb90801938a5d8da0a579e5291e56f5c322ecfc4edc68b978d54eb97d28deaa30c417796f355456d06e6347f57560760486e9d40da676d8a62ff2b142986bad
MD5 SHA1 SHA512

Submit Download

ef2ab9f0-732f-4d85-8287-ce6bed67a966.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ef2ab9f0-732f-4d85-8287-ce6bed67a966.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63f0893cedfc7f1fbf53143f7f3b4832d9efe99525af2da13c35644951d7a8d5
MD5 2ce65a8c1eaf75f6695058efb8eac265
SHA1 6dcd250560af39c576e6b3373d34ef6bf23b1a04
SHA512 fd68ef95b4ff6f13fcd35ac9df644c45afe5c418981e2a088bb498127bb30f96db4a438d96c80e7b672ab6c132f3cef33348f9e6e3290c655b9201a05953eb09
TLSH
T1CB41E958B6F91144F3B76E5AABF7B86E447B79372F17D49D10110E8E0662A00C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download