hxxps://url[.]uk[.]m[.]mimecastprotect[.]com/s/t1JOCkZQ3IKq801f2f5fGDOID?domain=andrea-bothur[.]kit[.]com

Analysis

user interaction
yes
max time kernel
385s
max time network
380s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://url.uk.m.mimecastprotect.com/s/t1JOCkZQ3IKq801f2f5fGDOID?domain=andrea-bothur.kit.com
Sample260730-mc6sgsy1ev

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
140	4328	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298804255678306"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{548FCC67-F936-4D1F-805A-556453E4559E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3128	756	msedge.exe	85
PID 756 wrote to memory of 4328	756	msedge.exe	86
PID 756 wrote to memory of 1920	756	msedge.exe	87
PID 756 wrote to memory of 1920	756	msedge.exe	87
PID 756 wrote to memory of 1920	756	msedge.exe	87
PID 756 wrote to memory of 4396	756	msedge.exe	88
PID 756 wrote to memory of 4396	756	msedge.exe	88
PID 756 wrote to memory of 4320	756	msedge.exe	89
PID 756 wrote to memory of 4320	756	msedge.exe	89
PID 756 wrote to memory of 4320	756	msedge.exe	89
PID 756 wrote to memory of 4200	756	msedge.exe	90
PID 756 wrote to memory of 4200	756	msedge.exe	90
PID 756 wrote to memory of 4200	756	msedge.exe	90
PID 756 wrote to memory of 2976	756	msedge.exe	92
PID 756 wrote to memory of 2976	756	msedge.exe	92
PID 756 wrote to memory of 2976	756	msedge.exe	92
PID 756 wrote to memory of 1812	756	msedge.exe	93
PID 756 wrote to memory of 1812	756	msedge.exe	93
PID 756 wrote to memory of 1812	756	msedge.exe	93
PID 756 wrote to memory of 2876	756	msedge.exe	98
PID 756 wrote to memory of 2876	756	msedge.exe	98
PID 756 wrote to memory of 2876	756	msedge.exe	98
PID 756 wrote to memory of 2028	756	msedge.exe	100
PID 756 wrote to memory of 1208	756	msedge.exe	99
PID 756 wrote to memory of 2028	756	msedge.exe	100
PID 756 wrote to memory of 1208	756	msedge.exe	99
PID 756 wrote to memory of 4784	756	msedge.exe	102
PID 756 wrote to memory of 1600	756	msedge.exe	111
PID 756 wrote to memory of 868	756	msedge.exe	112
PID 756 wrote to memory of 4100	756	msedge.exe	113
PID 756 wrote to memory of 2968	756	msedge.exe	115
PID 756 wrote to memory of 2968	756	msedge.exe	115
PID 756 wrote to memory of 5024	756	msedge.exe	116
PID 756 wrote to memory of 4732	756	msedge.exe	117
PID 756 wrote to memory of 4732	756	msedge.exe	117
PID 756 wrote to memory of 2568	756	msedge.exe	118
PID 756 wrote to memory of 2568	756	msedge.exe	118
PID 756 wrote to memory of 1176	756	msedge.exe	119
PID 756 wrote to memory of 1176	756	msedge.exe	119
PID 756 wrote to memory of 4964	756	msedge.exe	120
PID 756 wrote to memory of 4964	756	msedge.exe	120
PID 756 wrote to memory of 4964	756	msedge.exe	120
PID 756 wrote to memory of 4608	756	msedge.exe	121
PID 756 wrote to memory of 4608	756	msedge.exe	121
PID 756 wrote to memory of 2136	756	msedge.exe	122
PID 756 wrote to memory of 2136	756	msedge.exe	122
PID 756 wrote to memory of 400	756	msedge.exe	123
PID 756 wrote to memory of 400	756	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url.uk.m.mimecastprotect.com/s/t1JOCkZQ3IKq801f2f5fGDOID?domain=andrea-bothur.kit.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbecdfc188,0x7ffbecdfc194,0x7ffbecdfc1a0
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,1249083606742697309,17062996010065423876,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,9474864768649988641,15789170360678258474,262144 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,11247934609187858611,13093286660258237157,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15680787153653704512,7643960510567252652,2097152 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15996589540243739561,14702798532517832938,2097152 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,15165037900877986348,4431939983721573213,2097152 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,571581391559336163,9726051651969994979,2097152 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,14455400293264721682,1744590713736424091,2097152 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,8328140791807617775,2642025615872424741,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,9254326714168689852,6388594112871708050,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3043968708910922827,16919655228727516489,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3043968708910922827,16919655228727516489,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,10377276588267670769,10301671404392290878,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,12859470854794296895,773583710195320910,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,13136508393807245881,12867599046636586067,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,3857966723715271528,1933705100906616929,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,9088788614892806090,10018341248453560014,262144 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,6478849825917349531,4095436467793859453,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,16152371545814172957,5440299795075051537,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16355228172782784719,2032712942621879250,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5496,i,3915211603345515454,16460255549569123118,2097152 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14492169586947102700,8779786988478375964,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,15026551619756328951,9700856156160948967,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,6059065405909500635,3386422689970844291,524288 --field-trial-handle=2324,i,12072533730274261800,16275878894901698594,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 16653cf663eeb9bb40f8e0082f8a850c308ed3fed53674807e53eaf122933e75
MD5 85edaa82605029225eac874dc3a7d6de
SHA1 d89424cd5404cabc302f3df155c76b1774e34a11
SHA512 3753ad6f3712251ab1aae57d1be2165cfe10a6a369f2b77a733e93043456f3427c899294c197d6a9e63bae74486a3c4de00a50afa63a9262b02a145ddf30820d
TLSH
T113E026D545C8C3BEE218648F8278978CD2F0360E92C86D9A1B008CA4B0012A4E7F7AF2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f848aec9171f81617df5941ed4d3bf85f4b1c8076fe46fc40e3b0a3e1a1d6da5
MD5 2f441e4dc824c554e53baf941fa9e181
SHA1 625efaf2e407c226041b9fbccfc6b1ebe260d377
SHA512 cda30ce08ad6ccc80d249c1c46fd13e6855732759224d5d82a9fd547cd284bee3d2f59a8df24189167de2b5739a730e3169cfe95558ab594c03949f477116eaa
TLSH
T1C671B3BB010287AFDB2EE2FD60CE71613C70A4D9F9336D669E5047353917B0246CEA98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e4728c069947252592bfa9f6c992b099fddeb70aceab4680c1cee1cdd5dc33d
MD5 5c94f75dcb97d902874acc6a744783ad
SHA1 6352a106b043199d5eb964ce96fdab20f581bee1
SHA512 d94b421582d212f374368407cae9d985fa21dc92af569c58f415baf98a882e416757ea552eb0518b1673f268626bd2186bbdf42a90124f8e7eff574321b66366
TLSH
T1CC71C2BB010287AFCB2DE2FD64DE31503CB0A4C9F9336DA69E5007353917B1246CEA88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585510.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585510.TMP
Size 3KB
SHA256 f0643d7496b0179b811a34e6252d779870f755370c4ab01a0bb7e29b5cd8f074
MD5 56db58842b7af445e702298f5155c7a0
SHA1 8ef3f7a49e3dfd3bc041ceeb2b957ee6d4d84ac8
SHA512 d0dbe629ee378579ba75505adde372e9a5e50454d8b6c3a0de63565b24931ac04fb4f8255a70b16f0f945c3398868f328084095a943bf505cf56c925b84c9ebb
TLSH
T14C7191BB410287AFDB2DA2FD64DE71503C70A4D9F9335D569E5047353917B0142CE688
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1024fc754c26c86896b99609f169eab5af9b97b6084e340eb3fcc9f77a07ebe3
MD5 2bc9359a9170cab74f7287c85692d3d0
SHA1 5baa282008e4adaa730d6e001ae959dc8727a2ce
SHA512 2af16aaec88f03323d8c7cab058fd4814db152ceaa777aafcafaa29f44d0f2cfe79d538635741309fd21bdb2e52246704764d2d120a25cb930dff44613985344
TLSH
T19741CBF2C7E4866D8A0156F0AA14AE1BCE1C0517436C385A89E4EF9BD3F24B1E150B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c764d9d9c5a553a572dc5c702dbdf5ce4b06b51230cb9c71c54f915022248ca5
MD5 9559dee32e8fe800d5c1bf55cbafa027
SHA1 5e889761b2062a87e6b6f4b74bd8aed7d029ed59
SHA512 6d8f26a8192006987d62ba011b8b650e1e2585f0029830c940e634e27c85da2ea530e1298058b85ae7bbbccc79e46177dedaa687d88ddb162dc70dd4798d0727
TLSH
T1A651CFF683F4826DCA0156F0AA146E2BDE6D0516432C3C5AC5D4EF5BA3F2471E141B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ef156aaa048a23e0cbf6cf0224d24a7264e3b2a195f5018b771f799611e9a700
MD5 c29e31fb4b258ad5cc8a413c1c174924
SHA1 0a135ca39392379630fd9cfbe181439b675fc03d
SHA512 e52d1b897e8d49b67373f35f5aa9bdb327045f6b6cb690aa8d74312957673c4c9e0cc2ee343f8095f808395559ab71bf5199a04bb26f89ec74a4c28337c1e3f9
TLSH
T13641CBF2C7E4866D8A0156F0AA14AE2BCE1C0517436C385A89E4EF9BD3F24B1E150B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6d6aae2dfd34be7cc39f8659b6902895562261962ef84da5108464f7de1733fd
MD5 9c7f502365918ddcacc9d2952f8bb8f3
SHA1 eda4c489e33c9423ebf0e1dfaabaa4887b884f8a
SHA512 5e16ed09af54f994590c7d274f15eab63a274bbe669cbb0dfb82a9a3e707749cca757b350d0fed9b495e97fa2ab5f5510fdec2da226cd7346cd75b8aa32156b4
SSDEEP 192:sxZbR/yM/jK1Ml8Mk7/fNsx1pIdp4FHW6+WN/gm/YI8v0tIgrJ:sxZbpM7/fNsx1iEHbZ/F9
TLSH
T1FE42D6166B349977CCDBD209BA44BF53D6F90472D6904E48A9FCCA0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9b00c10726f59643e3e5c4428b77a09e354a5ecebf03987be8b31915ea6ee332
MD5 62ac1db0d9986665bd671de73213cfd2
SHA1 3306eb6ed8d44f8020d57c7ba05ac2bb5acff1a0
SHA512 97d00c2124c3f99755f6ea19fb13d7ec49871bcfe8703ba279fd5f2b3e5463608ad2ce14e6c0ffdac748ac9310e48f51be622a9647b252ff6805f5150ce792cc
SSDEEP 192:sxZbR/yM/jK1Ml8UQRk7/fNsEOpIdpeFHW6+WN/gm/YINIi0tIg5oJ:sxZbpqi7/fNsEOiqHbZ/cG
TLSH
T13E52D6166A349977CCDBD609FA45BF53D6F50472D6904E48AAFCCA0C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 35dcb27740cea94c07880e8faa13a67adce3d18f8f30838d9438fb4f4408a26e
MD5 6ba2a25f8b18518643bddcb8b8885cec
SHA1 e70655baa15bc0efaf61ce428963f7248c8ae83d
SHA512 6165eb6147caefab2ae059cb522e7366e6f6e39ed385bdc66d9ac6abe3a4636d9bf3bf7b0b6ae7266f0ad51d5d3ff3d406c4eada4297d9cd2809dad0c059ef83
SSDEEP 768:1dsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9mroYY+Y:1dsqxXlWvJD6Tu1ja54LAs9dYYb
TLSH
T124D21B3B694CCB7E4F840E5CEC266FD66ED801CBA7988D5447FA884C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 a322150247855554201239df45038acf87852dfa686e10ed92f0c8e0443d8700
MD5 b2555ddcebba64a983a9bfe52148c35e
SHA1 4e1442a82c3fe948bb3633a565150db5358852a3
SHA512 a422133a54f6374bc560854f6c45765564a3fe28561a73d578f59c2fac431a2935eec413fe63ee15cd422315c52f5d4c207ec59bf2c517a1b51fa6394afcf581
TLSH
T1D931518E8E51859BECA489B2107561A432B0C8CC1B11D3038C7C22377C2336A5A4B4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9c09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5c9c09.TMP
Size 1KB
SHA256 ccc849efb61677f0ab3606b2d1fa53ebfdaf1fefcfc4cee18808ca0eeeca16d3
MD5 3f2d36d82f5ee79dec62322105fbf1a0
SHA1 6baa55649686963d623c49340ccf8433415921e6
SHA512 6d4d32ba889e76a1b86a622cd7582b81bab1cbc6649cb051bec2373ebb294cc6dc3b827931fca68834e7127a9f2b62390646e5577169f0091773bcada0ac65e6
TLSH
T13731938A8B418A0FE8D401720996A4B83379C90053227387987C633EBC753BD1E5F1C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9b2782cb42511a9eb2ec32c9e962a5ff7215c5c65e420f9be6ac189c8c500554
MD5 4f94a359ec8268d51f886698368eda9b
SHA1 f678caea07e90b1cfadf6ff40286e0da3ae7187c
SHA512 88944da797dc763f1fa93ea661386195d503a2e297a9d1dc78e518882eab2ddeabfdd87f9c8218627a65d30b2b3549f97dd7f7f3fc0a1d25516c15a011ff3dfa
TLSH
T12DE0687A2AE70854A8ABC3DA087344964510F428C891EC4F1129928310622602822C27
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b615a4186c45f1dd851229df6aa624be6674ab8733293db63ac77a5450191f6a
MD5 6dbcf73e2a94435c4f400b7c39136456
SHA1 7facc536908dbf541d749768df5d8d85f2d4a88e
SHA512 3ab8f548fcc67ce2a7409a6f523468b69e25a7aef372d37fb621bcf6dd20a2a4ed7cc0a120b668c95ab21c37891ea034b9adb0b90f0b3b69dc9fc0e19b04da2f
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZ+I/Kjiojy5EIfKdmsJXIR:KYbaKYIK6+EKji2qEAKdmyXy
TLSH
T1DBA1154A363A0211383D2859B2A7C6375F423963301CA46F3FB951E55F6AE121CFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 36e855ea72be62bc56be18ad2761a38311824b888c4515f288bd37ddf81c89c7
MD5 8aaa18dd3efc7e96560c68964a9d5330
SHA1 cd56978b9197877fae3e3f5d6f5c1f6133693ad3
SHA512 a22b233be86ca87daeb5eadc2532365ad0f904a2b258879a124d7f8c9817e6bea54a19f26f253e08bf58363a4dd9f302c06f7b673f03c219a459005d6f44bd1b
SSDEEP 384:O7ZcISzsNkiHbsWiuVRN0OKq95MtOObjI9G6w7zJQE:Oj681H0OB95Mt29MzJN
TLSH
T11AC228F669E74832D99E9703A77E2E130EBDD027B6885A40B3D85B0CCD9657FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 997bc1c2bc093f64195674e95d28ca407553675b5334ee869bf11774d58d7dc8
MD5 3befdd6be0e6c3474c06ccc872c81b5f
SHA1 db7dad9ce4a4f1717796230c38278a7c52bdcfc5
SHA512 d0ac626f63084232aad7548e7a9c8af504e778b63b49aa0e473cdcd60442fe7f545043e61fa688670d3df5a31f3aeee19b959838aa21ee8aba16b7cd4802a4ce
SSDEEP 192:tONr6JkRtQmiUyEoW+RN0OmheR2h3nR5U6:tONr6UrwW+RN0OKFHU6
TLSH
T12702F935AD381C7B9EF26E09B98727135FA5207BEA956F80DAD41F0C01D764C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2e94acb9ce71bbfc4f53bff390cade3c0f6c998e3c207c1e5764ef9091b5e266
MD5 16d03a632f6a41bed24403b08e63bd4e
SHA1 d76ad829197ce5991839a3eed98813c90d9f8851
SHA512 8a289782ee7777e1bc43dac1aff0d4efab41428acd5f207bfd06ee0a2150e24761e36b8473ba2c29ffc6166e7b91e6c6ec3129a8b7b8ffac85f032fb7d567ad3
SSDEEP 384:WKZcIhsNkiHbs4iuVRN0OKq9GMtOObjI9G6w7zJQE:WohW1H0OB9GMt29MzJN
TLSH
T1BC929F36AD344C779AA3A511F58736135FF9903BDBC85F40A4EDAF0C05DAA9C130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 059c300f97292451b03e3dd646cac212a78c0d44892587b03f9fde6ff8ca5b71
MD5 c14b7fac3d9f80eaee3347ad115326f1
SHA1 c39e5310fbd1851d703532a2364c4375f701c943
SHA512 933088f2d67a5e9ff7d6c6ce6e6f72c84cf4ec7459f6e893a4b5bb2e06c390fcf58470501de9eff1eafb38ff6ccb0cb9704c7b88913d5b14c858761cbf6823e6
SSDEEP 384:+KZcIhsNk/Hbs4iuVRN0OKq9GMtOObjI9G6w7zJQE:+ohf1H0OB9GMt29MzJN
TLSH
T106929F36AD344C779AA7A511F58736135FF99037DBC86F40A4EDBF0C05DAA9C130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff6529fdc0fc935b539f2944f20ced1974c9c132cd705ec7e5ef50f388a160f6
MD5 62de5c4a7558594510b32909bb0738d7
SHA1 9869ab8a1173c632b9f286e8bd60aa9fd0a779bf
SHA512 09153d0493a411ba0ab99eb94c7cc8f86837e1db1e43503feebd23ac342e73965c83416d41ab788962a007c830fb3195024b98a0c95f65738bb53c3488ad60ef
SSDEEP 192:PON16JkRIQmiUybo1+RN0OmheRnX9eVcRqXztU6:PON16Uon1+RN0OKq9JMtU6
TLSH
T1D9121936AD785C775EE2A944F48732135EA5513BEF896F80D5D82F0C01EF69C230E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8fa4d3f7a2b701d14fe6cee5358b5fff45055f8c95d0cb60a4a040bd43b659ec
MD5 57cff4fc142f8bd3d7fd21ed3a74a94d
SHA1 8f4a2f016f854665f7a04585fb3bc01d6f73f0ca
SHA512 decfc48477d6c4c1321dc2a6d517a24b4504caa057840106f8e60e823882849fbbb73d0cb0b35e8eccfebad29cac0009aef9d242fd8557f31c3bd88a35c5979e
TLSH
T171E00203631400DBC020133045C357203FA3C5750612030A4D1105642C123001E401C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c9468.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c9468.TMP
Size 392B
SHA256 26a43471dea2327cbc716e9a06ae74ff5ceedef5f5ce3453bf10e4d0e48429b1
MD5 469a123a56bcd3b9fd9dccfd80bde5ed
SHA1 d2c29e10a3733192ea186481d036d98ea74d12b0
SHA512 f64883ef4c079119e27962230235ed04df8fbd765f1a585bfa110d4ff54972f1bde41c95820a885414741f78e04daa26d0c05c858602db1b6eef60c5cf6c9d50
MD5 SHA1 SHA512

Submit Download

4af26862-e8d9-4f44-bf0f-5c079cd3f356.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4af26862-e8d9-4f44-bf0f-5c079cd3f356.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5d50d6b43ebe751f91d4dbb8cf246b14ed0048076c30738867974cc262b9966a
MD5 d955ed53f683ae7fefc7cce2e1eb7136
SHA1 ca0e1c4bbc859f3cddfa21a48f351a8d81d2f509
SHA512 6207ed24073b1b25d9d63cb6905959f9100b23635035681dd32bf6c88a693d808c0718bf92f7b5891417212b31e736f11a5f832e6d72c04625ba7d5ba6de799e
TLSH
T14D41E78CA6FA1109B3736F4A9BF6696E847B78372E46D45E10010D4F0623A40D962B37
MD5 SHA1 SHA512 TLSH

Submit Download