hxxps://curationposttechnologycontent[.]com/78052-568827/245069?uid=qMoMWKVwL78EtAAaTTfER2CyPZTQUU7J&prom_type=regular&prom_id=416495&pld=26L81sNgpwNGbf&answer=1

Analysis

user interaction
yes
max time kernel
298s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://curationposttechnologycontent.com/78052-568827/245069?uid=qMoMWKVwL78EtAAaTTfER2CyPZTQUU7J&prom_type=regular&prom_id=416495&pld=26L81sNgpwNGbf&answer=1
Sample260730-qfvfeaaa55

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298907760450150"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{045563F5-0464-478B-8608-03519F581F33}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1192	4348	msedge.exe	83
PID 4348 wrote to memory of 332	4348	msedge.exe	84
PID 4348 wrote to memory of 2480	4348	msedge.exe	85
PID 4348 wrote to memory of 2480	4348	msedge.exe	85
PID 4348 wrote to memory of 2672	4348	msedge.exe	86
PID 4348 wrote to memory of 2672	4348	msedge.exe	86
PID 4348 wrote to memory of 2672	4348	msedge.exe	86
PID 4348 wrote to memory of 1448	4348	msedge.exe	88
PID 4348 wrote to memory of 1448	4348	msedge.exe	88
PID 4348 wrote to memory of 1448	4348	msedge.exe	88
PID 4348 wrote to memory of 2504	4348	msedge.exe	89
PID 4348 wrote to memory of 2504	4348	msedge.exe	89
PID 4348 wrote to memory of 2504	4348	msedge.exe	89
PID 4348 wrote to memory of 2984	4348	msedge.exe	90
PID 4348 wrote to memory of 2984	4348	msedge.exe	90
PID 4348 wrote to memory of 2984	4348	msedge.exe	90
PID 4348 wrote to memory of 4764	4348	msedge.exe	91
PID 4348 wrote to memory of 4764	4348	msedge.exe	91
PID 4348 wrote to memory of 4764	4348	msedge.exe	91
PID 4348 wrote to memory of 960	4348	msedge.exe	98
PID 4348 wrote to memory of 960	4348	msedge.exe	98
PID 4348 wrote to memory of 3744	4348	msedge.exe	99
PID 4348 wrote to memory of 3744	4348	msedge.exe	99
PID 4348 wrote to memory of 4980	4348	msedge.exe	101
PID 4348 wrote to memory of 4328	4348	msedge.exe	104
PID 4348 wrote to memory of 4328	4348	msedge.exe	104
PID 4348 wrote to memory of 4668	4348	msedge.exe	105
PID 4348 wrote to memory of 4668	4348	msedge.exe	105
PID 4348 wrote to memory of 4668	4348	msedge.exe	105
PID 4348 wrote to memory of 4516	4348	msedge.exe	106
PID 4348 wrote to memory of 1188	4348	msedge.exe	114
PID 4348 wrote to memory of 1188	4348	msedge.exe	114
PID 4348 wrote to memory of 1188	4348	msedge.exe	114
PID 4348 wrote to memory of 3664	4348	msedge.exe	115
PID 4348 wrote to memory of 3664	4348	msedge.exe	115
PID 4348 wrote to memory of 3664	4348	msedge.exe	115
PID 4348 wrote to memory of 2420	4348	msedge.exe	116
PID 4348 wrote to memory of 2420	4348	msedge.exe	116
PID 4348 wrote to memory of 2420	4348	msedge.exe	116
PID 4348 wrote to memory of 5704	4348	msedge.exe	119
PID 4348 wrote to memory of 5712	4348	msedge.exe	120
PID 4348 wrote to memory of 5720	4348	msedge.exe	121
PID 4348 wrote to memory of 5648	4348	msedge.exe	127
PID 4348 wrote to memory of 5648	4348	msedge.exe	127
PID 4348 wrote to memory of 2256	4348	msedge.exe	132
PID 4348 wrote to memory of 2256	4348	msedge.exe	132
PID 4348 wrote to memory of 5640	4348	msedge.exe	135
PID 4348 wrote to memory of 3584	4348	msedge.exe	137
PID 4348 wrote to memory of 1580	4348	msedge.exe	136
PID 4348 wrote to memory of 3584	4348	msedge.exe	137
PID 4348 wrote to memory of 1580	4348	msedge.exe	136
PID 4348 wrote to memory of 4332	4348	msedge.exe	138
PID 4348 wrote to memory of 4332	4348	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://curationposttechnologycontent.com/78052-568827/245069?uid=qMoMWKVwL78EtAAaTTfER2CyPZTQUU7J&prom_type=regular&prom_id=416495&pld=26L81sNgpwNGbf&answer=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,6524348558066147953,1574784110154719704,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,8921833109594870631,9736600534093901360,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6721110053075127255,1571387176138005595,262144 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,10956900181312946304,6333412283742460694,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,2039420476601619470,12917160869141632878,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,12461041145382209399,15393801005321713521,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,15196433340160956439,2839649039464002158,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11490396072443414364,14899927440478859227,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,13314055599364660250,1604141258632816632,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16379093744618627924,3349596843096633108,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16379093744618627924,3349596843096633108,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,1129356315900306163,7339773322100539717,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6320,i,1808686839170390924,11427828624290481418,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,4172599861978261686,13965539395564507818,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5940,i,16897727891289273416,18053147063109890161,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6868,i,3138766313112642703,10697886914149438105,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7076,i,18390035548437578079,8712759729295642987,2097152 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,2769836854104723177,5168721750874304002,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,16512770777336354776,8047824033848755036,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,16708433329987374490,4857850795613775734,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5586473826727771530,14461112118661546039,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,8520207766322104425,15888872845251047993,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,3515040532553842892,9279915279420576712,262144 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14056186484238636717,7281564694065635862,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,15763668008206772747,812546619809408846,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14288232320048445468,14619433137025621014,524288 --field-trial-handle=2580,i,8524216993941457876,3352594579894498054,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9212983bbeadd175dfc0d1187fd14bb7c7e7d848c5f19b52c718b8aaf8a336ae
MD5 a012b314bb948527d7e4ee2166efac15
SHA1 cabe9a4d4c7d4aa8306405000a575325b07b6be7
SHA512 180a3e2425252a75c5d731e4db5307941e16822b726730b615c5fa830d04a29c1b282667ced3307e54af767a6689164bcc4b65bfed4782390aab036e13160a5e
TLSH
T17CE026E485CAC3AFF34C698752B8638C93B9368EDBCC690E3701CD9C7005440AB826D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cbf505b0f16a846aafbbceb6828442bbee13a4fae79fa2a081684c33909f9f67
MD5 aa7b3c9b78082154fc7f0f1c64871776
SHA1 b5128c0b6c0d98fb3e0e1c53382ae3a800d0bb0d
SHA512 c617fbd0cdd72f998335407405126257509b62352e5d2152796ba4e07de80559cf9b82f5e1bb3ea4233834d546f832a55127792395533ce7beb0e975a2b6f8d6
TLSH
T16771733D192508A1D7B18932B8CD16847DB4C9EEFE335DAE0179FA70E50E75B902B0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e606.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e606.TMP
Size 3KB
SHA256 9659fc1e882fefb9c0c592c40bfbef77c71175fec82291a59992b8d206216481
MD5 5484f6dbf048d13a917121629755f635
SHA1 297139ce619cde85d53bfbc65a7604953391427a
SHA512 8dfeaed59c03a254e1ae6a9f00fe2409a7e98f085855520337a64588ea81cb57333ac143be771305ede60987fb5c2487242816508bc139f77628e05080bad8c0
TLSH
T17871633D192609A1D3A1883278CD12847DB1C9EEFE336DAE0179FA74E51D71B912F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6836c1db47b5727e473c27014792f821a38b2b67185d94f26e356edb055a607c
MD5 49423eec40ed598198a443946635dfe7
SHA1 e5c39b046ef6ce0d52487da637a9f15faf95d0ad
SHA512 8a418325265881c76703e2080a5b983e74cc3fdd1e559051ec10a0ba1d531f83f1bf2356bfe858cb9b804fdfc523018ccdccacc8dd0b7a2991bb2e7990153dd1
TLSH
T1A0619EBBC3D9C26DCD021AF5AA18BE2FDD1906546318382989D5DF1BE3F1472D101A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c1b2a7409377df5b837b5441c68877f6137a2fe77e80a9c863f8624f240829d9
MD5 97c7d87d87c06a6ca77995aa5fade416
SHA1 a67ccc4adc34ab3174c229907b316b0adadd1b07
SHA512 0c08785952b1590e8411155f6005fe507d917a0cf393b370dcfc2f3b3791ef3fc8dd180e7c8aaaf9dcea23ea92de865eb7731cbdf871f7658f25bd339cbe0c79
SSDEEP 192:sxZNRw9T/fTs/o9IdpMMHW6+WNr1y/YIBgMeIgrJ:sxZNsT/fTs/o+pHbE/a9
TLSH
T15422A6166B38A57B8CCBD209BA15BF53E6F55032A1901E58EAFC960C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 009d144cdb4aa81adfa80b27d923e4b5642fb1081f0b40293cad30c0bbab191c
MD5 71d38e1e139a708639e77825300f9213
SHA1 7434358f62b714b9305891e6ee2dbf325d19afba
SHA512 8d458b270df4dc6fd6ba86c49e64e9cbc289ab4707d4507d547950abc5a227eb45f8bf672ebd636c2efe85e294c892b6531ab6137ed1f7837ace4496dabc4b49
SSDEEP 192:sxZNRw9T/fTsO29IdpdQMHW6+WNr1y/YIuuOwxMeIg5RJ:sxZNsT/fTsO2+jHbE/xOmx
TLSH
T11132B5166A38697B9CCBD60DBA15BF53E2F95032A1911E48EAFC9A0C05E76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d6b973bf07052dd42f0fc1f680b5570d333b405d4985faec3e733873ada39f49
MD5 0d26570720b9af6c846e656b1b1dd2c0
SHA1 b32decaca44099403cac4507b69ad481f28cb37f
SHA512 21722654b30119f6942ee6c3c1ee047e180c773ed2b91c47eac7fb8ef8f0e0e075eb25f2f5c0ea43ea3053f906176d09965a5d952f0228a8e384553de6700920
SSDEEP 192:sxZNRw9T/fTsO27kIdpHQTHW6+WNrUzfYIruOw6MeIg5RJ:sxZNsT/fTsO2xCHbsf8OVx
TLSH
T15A32C6566A38697B8CCBD60DBA15BF53E2F95032A1911E48EAFC9B0C05E76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a3aeb0ba2134f44f50624efcb575ba69456a0203d937c2c133486379ff9949dc
MD5 ea755fd2a4f2f5cd6128b5b4fa9ecd2c
SHA1 109395c4110f49daf33746f39e11d1bcfc6ceb6c
SHA512 5acdb32359109243e3ae54fe186a36e24b83241e48f3e8f79c3a6eedb945c3b5dcf99560bf66ff59d75ffb528e552033f7021830b753e8fcaf5fb59647321079
SSDEEP 192:sxZNRw9T/fTsOo9IdpdQMHW6+WNr1y/YIBuOwxMeIg5DJ:sxZNsT/fTsOo+jHbE/6Omv
TLSH
T15832B6166B38657B8CC7D209BA15BF53E2F95032A1901E58FAFC960C05E76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b30960736f2042953b88dc4bcf5dc6be2bff57bc02bb1a8e544de4741f4c2c26
MD5 e0128c50308b7a0a859ded620bd6234c
SHA1 96d5211a3f0d4d1b565bc560893aa6fee53719b6
SHA512 886da49b816e7073c3af95fcceb8986bc5b10fcd117ca31a15240c048e1a6acb37e6393084823c50a38a030fb908b213fa60238e8122bc043b7bf9cb3cff8c64
SSDEEP 768:1UyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7GrovyC:1UyqbblWvJDjTu1jah4LAs79vR
TLSH
T107C20A3B654CCB7E4FC00A9DED5A6FD73E9802C7A6588D4047FA994C02CB7EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 97ce5d10406e467c64707a4b9465f7e8805c8ac3732ad3648b4f3bc28efb8636
MD5 82a2ac6d170883749a7c6b1101e92638
SHA1 478cf7a95f6fe11b9db5b11803d719612f82452c
SHA512 ebfeeafa6c0f34da3d8e6fd38a3bd190e38310bbe0ff3815a5dba062c4f538d434c482acb4fd7a56dca458c71512b7b8aa02fe0d532644b2a7d886484294e12a
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLikq:KYbaKYIKOfuKQY+S2gKnKf
TLSH
T18D914A15757E0242783D2894B3A6DA374F4532A37018A4EF3FB950A24E66E120DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59355e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59355e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a8f8baa36da4508966886cc15e0ddcd1fb61d6bece4621e6a4d6efbc2cb8885e
MD5 83192cc1df1487d631b42046e6c3b020
SHA1 eb5613ececb29e2307fef6a4dccaa93047a98c16
SHA512 5554dac98e3b95c04c33c3b590cec8e02f83e0f7ecbae0e3c5ac4c9e3732268bc05f8cebf063ee43cfd9a05df47a5ac18d0a63c2bb3cf33567137b27327570da
SSDEEP 384:r7ZcI8sNAAaPibybeS2VRNT6bq+lOObjI9G6w74z:n8NKSUHTlc29Ma
TLSH
T1C7928E32AC385D3B9DE2A911B4CA32131EF4917BE7C95F40D5EDAF0E05D79AC130A52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1653805c36eeed38d80b9c3d4516567faa0b31c623eb8c6235ed0e412b26ed20
MD5 b508680fc6daa923ce8f2f48e91edafc
SHA1 5f00712b4e8fc9020fb9f3b926a109dcf13a69dc
SHA512 885019a0a2bf307fe9478e74d4607a6992172d95d666e45d6e4cdf6e9dce9d93d09856572a06046b62955be4afb262ea0fd22b4ae12eeb2d98439866b0927c2c
SSDEEP 384:cUxiFiZcIDvysNA8TUNTUlIlAaPiby9WeS2VRNT6bH+lOObjI9G6w74z:AFQWVwg33SUHTmc29Ma
TLSH
T196D229F258E7483AD9AE5B03B7BE2D024EFCD167B6845A40B3D85A0DCD960BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 658a66d10d5d4c48b1cc0c794246db5fb7f7279886ce0877eefa58d45ea34baf
MD5 e7be3ddb88ba1a11f27e96372b905eb9
SHA1 7330ef87dcbcba20229ae1f592349324a0b3a4a4
SHA512 b77f0108a850c4692e538bb9b20585c7bad047c20259c575b27d56526bb583f30a5be5a3986687b9936d16378391780d812e3b3d6be28f93effe7a9283e09562
SSDEEP 384:OZcI8sNAAaPibyheS2VRNT6bl+lOObjI9G6w74z:s8NcSUHT0c29Ma
TLSH
T180928E32AC385C3B9EE2A911F4C636131EF4917BE7C95F4095EDAF0E05D79AC030652A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 da42f8481591d798b453fd8b379797f551e6efce1b4a1122225a1fe1b053f638
MD5 0d65a216ac16d778d22266fc894fb5c6
SHA1 a3b100c028d8b9d93b166f270d5113f537c8a8f2
SHA512 4a782423402fb3dabe90aa467f6c987faa68c041f2f51548028fa9e3f72ec8815c8e6366b9deff3c5deb8339df33130e8106b83697e93bb87e7dca2e94e92935
SSDEEP 384:+ZcIhsNAdaPibYseJVRNT6bl+lOObjI9G6w74z:8h0ZvHT0c29Ma
TLSH
T1FB928E32AC385C7B9EE2A911F4CB36131EF4917BE7C95B4095DDAB0D06DB5AC030A52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51a087a2fe18638f5bb625ec543e4e70b8fe2101d19d536502bdf6763ddf0fc1
MD5 8f7945db6023d63a760d9a0df5175a00
SHA1 3e19a61dea61cb27e307621575d94b7fa1c2bd51
SHA512 d4186d398e7189d838282b1a0c7e1c12026ae7b3f5f1fb98831f8572b2b3c9a5f2ebe9698f1a24610c6448fe40944f6eefa3afbceb8966c4e1ae2564e729408e
SSDEEP 192:tONb6JkRtQmiUyl5W+RNKFCk5dZDh3+REU6:tONb6UrMW+RNT6bVdU6
TLSH
T1AD020A35AC382C7B9EF26D05B48737271FE4116BFA952F40DAE81A1C00D769C234693A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 50ef4512eb4facefe5feb571f39dc85b3e8df0a617901c9f02d1e72729de54fb
MD5 22511bda75875d608d6d057408f20c3d
SHA1 228d15da7efbcc7d6fc7f588b0e6bd9d2acb9aa0
SHA512 91d53c794a804a7bf5db4d226da42a77e71e4ac9653e4dfec6230ede7aed734d52f148c90ca7c969856f976a80c6755a6bc06ce8123c7616952313ee3a2f5b5e
SSDEEP 384:7ZcI8sNAdaPibyheS2VRNT6bl+lOObjI9G6w74z:j80cSUHT0c29Ma
TLSH
T12C928E32AC385C7B9EE2A911F4C636131EF4917BE7C96F4095DDAF0E06D75AC030652A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d20978d228d2e08bfc33e49f367d6ce2466c40d6a7245dda0555b20bc498d0a
MD5 3cb26c6680f4af7e14faa9f132021027
SHA1 6fd4ce9c838508ebf1824dc217868db833a92aa4
SHA512 8e91b01a8b9ca37646677bf2a3f3949f99643ce61df3dbc8575aba2bd96998f89f881404b75f2a08d4b807e1c89867362a4fafffe5ce9d9170973e9f3e322181
SSDEEP 192:jONB6JkRwQmiUyZ5r+RNKFCk5dZc0vBVctqn8qU6:jONB6Uw2r+RNT6b4+lU6
TLSH
T11F120B36B8385C7F9EE2A815B4C732131FF5522BEA897F40D5DC2A1C01EF59C134A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 06f4a45fd6f42893c355a15dfa1fa28c5d63a1363d8c1ee15b6f37aca640bd8b
MD5 5b6ffa4e7420b8249a7b2f2d66556af1
SHA1 c4f4778cdba232cb43a428bb792a33111476a3dd
SHA512 ad6d4cc10138823d0757219856b6f766c8fee9ef73cbf82b9f2d03a93af8c51ea29f34925cb3a14f8322047cf3f9bab0563dbf1acbabaf9a57095a632c9b913b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58adbf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58adbf.TMP
Size 392B
SHA256 0e1da5fe4abf2e00dd12ec6b85706d213d81f9a7d180a5f381f4442e9cb82b67
MD5 986b98457986f502e94af3b5ecb082e5
SHA1 9ce3bb47db903a1572e4d7c8a75b1de888738534
SHA512 9c437cb75ec32cdce075df1eeba6c858de6df239c0c9be82a1c52b3516de3a223b70c4e878e2c700f06ad89c0e43ea811b14e09d6b489ca95769a79127f1fb88
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ac81b5a658290c1ecd35a23beed652c0c65cc350fe0a538b3c482bcebe06b780
MD5 0fd6fda0eae54d49e505a9d8b3dff061
SHA1 6ebbf5dec68bbdbfb0f4dac76e95831c686abbeb
SHA512 54a2426c0e290a54f38ae19399616c362602301b768333636da078133bbc1f3f6bc1209b60acdcef8312d5ad0ebd8fe94686b72a638c399da65b5dda22f1491a
TLSH
T1E6412658BAE91148B3B77E4AABF6A96E547EBC772E07D45D00110E4F0A22B00C971737
MD5 SHA1 SHA512 TLSH

Submit Download

VCS-AP-LMM-TE-TL-Whitepaper_ACCESSIBLE_Mar26.pdf.crdownload

Path C:\Users\Admin\Downloads\VCS-AP-LMM-TE-TL-Whitepaper_ACCESSIBLE_Mar26.pdf.crdownload
Size 5.3MB
SHA256 f1e92f9bd843bf594e1e9ab3ce84d349fe77817d107f508ed0673951bf26a3e0
MD5 c2914d4e20223d65e5a867eb6c9db76c
SHA1 8c1866184fbd8f31babc753c34972a286420357a
SHA512 78cc248c686618f1d18f888223f29049e1791782ca666bae4ad6d5838aa29e7a4aaaf1f616f8042d046f3e7c474babafcc3b7ad01e06fbb9f18bcf54f2fbb700
SSDEEP 98304:ooEErtD9YefdfyImR+dERQCfegkuwQaKuHqVy7gpv3Jqhi:o7E3ZOgdm2g95aK6qcMZ3JOi
TLSH
T1A946230852258E91C0CCD13055FF19037B3BA597FE842982BFDE8B356B522EDD8E71A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download