hxxps://sites[.]google[.]com/deepen[.]ai/home

Resubmissions

30/07/2026, 18:40

260730-xa9fpsvgmc6

30/07/2026, 17:05

260730-vmcamawwdw6

Analysis

user interaction
yes
max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sites.google.com/deepen.ai/home
Sample260730-xa9fpsvgmc

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
63	drive.google.com
97	sites.google.com
9	sites.google.com
10	sites.google.com
17	sites.google.com
24	sites.google.com
56	drive.google.com
57	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299104364693290"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{939D7698-3C31-4E0E-897A-5F3D3D74C0A7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2520	2504	msedge.exe	86
PID 2504 wrote to memory of 2576	2504	msedge.exe	87
PID 2504 wrote to memory of 4684	2504	msedge.exe	88
PID 2504 wrote to memory of 4684	2504	msedge.exe	88
PID 2504 wrote to memory of 4684	2504	msedge.exe	88
PID 2504 wrote to memory of 4652	2504	msedge.exe	90
PID 2504 wrote to memory of 4652	2504	msedge.exe	90
PID 2504 wrote to memory of 4680	2504	msedge.exe	91
PID 2504 wrote to memory of 4780	2504	msedge.exe	92
PID 2504 wrote to memory of 4680	2504	msedge.exe	91
PID 2504 wrote to memory of 4680	2504	msedge.exe	91
PID 2504 wrote to memory of 4780	2504	msedge.exe	92
PID 2504 wrote to memory of 4780	2504	msedge.exe	92
PID 2504 wrote to memory of 2544	2504	msedge.exe	93
PID 2504 wrote to memory of 2544	2504	msedge.exe	93
PID 2504 wrote to memory of 2544	2504	msedge.exe	93
PID 2504 wrote to memory of 1120	2504	msedge.exe	94
PID 2504 wrote to memory of 1120	2504	msedge.exe	94
PID 2504 wrote to memory of 1120	2504	msedge.exe	94
PID 2504 wrote to memory of 3236	2504	msedge.exe	98
PID 2504 wrote to memory of 3236	2504	msedge.exe	98
PID 2504 wrote to memory of 3236	2504	msedge.exe	98
PID 2504 wrote to memory of 4280	2504	msedge.exe	99
PID 2504 wrote to memory of 4280	2504	msedge.exe	99
PID 2504 wrote to memory of 4664	2504	msedge.exe	100
PID 2504 wrote to memory of 4664	2504	msedge.exe	100
PID 2504 wrote to memory of 3492	2504	msedge.exe	102
PID 2504 wrote to memory of 2060	2504	msedge.exe	103
PID 2504 wrote to memory of 2060	2504	msedge.exe	103
PID 2504 wrote to memory of 2060	2504	msedge.exe	103
PID 2504 wrote to memory of 3288	2504	msedge.exe	117
PID 2504 wrote to memory of 4596	2504	msedge.exe	118
PID 2504 wrote to memory of 3872	2504	msedge.exe	119
PID 2504 wrote to memory of 1704	2504	msedge.exe	125
PID 2504 wrote to memory of 1704	2504	msedge.exe	125
PID 2504 wrote to memory of 1704	2504	msedge.exe	125
PID 2504 wrote to memory of 740	2504	msedge.exe	126
PID 2504 wrote to memory of 740	2504	msedge.exe	126
PID 2504 wrote to memory of 5856	2504	msedge.exe	130
PID 2504 wrote to memory of 5340	2504	msedge.exe	136
PID 2504 wrote to memory of 5340	2504	msedge.exe	136
PID 2504 wrote to memory of 4972	2504	msedge.exe	137
PID 2504 wrote to memory of 4972	2504	msedge.exe	137
PID 2504 wrote to memory of 4732	2504	msedge.exe	138
PID 2504 wrote to memory of 4732	2504	msedge.exe	138
PID 2504 wrote to memory of 5572	2504	msedge.exe	141
PID 2504 wrote to memory of 5572	2504	msedge.exe	141
PID 2504 wrote to memory of 5572	2504	msedge.exe	141
PID 2504 wrote to memory of 1672	2504	msedge.exe	142
PID 2504 wrote to memory of 1672	2504	msedge.exe	142
PID 2504 wrote to memory of 1672	2504	msedge.exe	142
PID 2504 wrote to memory of 5476	2504	msedge.exe	144
PID 2504 wrote to memory of 5476	2504	msedge.exe	144
PID 2504 wrote to memory of 5476	2504	msedge.exe	144
PID 2504 wrote to memory of 4336	2504	msedge.exe	145
PID 2504 wrote to memory of 4336	2504	msedge.exe	145
PID 2504 wrote to memory of 4336	2504	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/deepen.ai/home
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff84a22c188,0x7ff84a22c194,0x7ff84a22c1a0
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,18205309898229469746,10922785541306087376,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3066797329138961985,16581766227068131081,262144 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,15636456541400398316,11702177035672413445,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2033459898877328015,4882435915272862321,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,10398985001932910171,9603678924230657665,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,6798015180965039264,15452005852092141190,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,8934039972184209884,3861897967239208870,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3240,i,2747271033546609954,2611696959263069918,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5970404055448283991,15383252755348142740,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10353010877137967909,1548579859535161532,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,312627545237166533,4588408663046969864,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,312627545237166533,4588408663046969864,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,13308266712716838848,1155117987920793442,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,11549043314638794843,18378542804655404568,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,3314710982178147458,10786270826789193246,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,11988588201261582173,1677823302642030331,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5252,i,5328340883470776061,16163309045709044996,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,16062306796915845847,9485808439787329288,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=764,i,11991812240322061121,8157566310550369980,262144 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,6332603357486987638,15659961254197069105,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7466334027108397097,6554247013871181510,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9806266546678661235,5584779010789188165,524288 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5612,i,522025360389870895,11453694812970860591,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7140,i,5560683860116453230,9261570804368197946,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6168,i,11966989496647448047,10355809361463049203,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5932,i,1392266399386804417,14321511913438749032,2097152 --field-trial-handle=2240,i,10513470778715042901,6628949986763496281,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 6244362b361a607cab4d4f156be4b36d67835fb1ca14cf7ab55f45b6bd46ff46
MD5 ca7cdeb5274a4e4e986fe8172df1ed57
SHA1 dfb85e56dbcfe635e53db68b8455e1cf0a9e8d92
SHA512 85ee50815065506766cc45ed5041ca7362d043763e836a3fb7d240e88e1800a0168ec2548771b95225913b9a32a869e6a1be6408ed182317201fe027d1ee0212
TLSH
T19DE0D8669384C3AC9308E67A804863B4C1727147D5CDCE69320770B518C3A00C7953D0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c71938644109a1a98276d66e7142642caa5481deb35458cd71484c1532ec99d
MD5 ba9eecdc20261b48d2d0943f1d8c53e2
SHA1 3890bd1ec99f5610d90cd69e795da3b422ade072
SHA512 ea59f66e71ac1f7a8e302372348af1508f34223c9a76d027f31762cf086e6f041c714d4a2db2e2f4644b38b15ab914d9b9fa7f2ba207e63beea50ebe80f239a1
TLSH
T104818125B5C20046D7770E32D9C2E0353C7267AE36ABBFA09296753F15BA7EDC874814
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a735449f10f8c7021e96c9ad5643e234a15ab2956577dd405061acc3d7a4eb7
MD5 a2846b6a2ef397ee58c5981ec9b868a9
SHA1 468525f37742c9d8985c50242a5b7ef3351a5408
SHA512 84197b8b74ddcf0f935bb5d4f7a47c72cf69e588e1cd26f212a7ee82ca04907b43300f422bed104144dd236d09c1a11e09950e357a699608661d99a3ef014ee8
TLSH
T11D718028B5C20042D7770E32D9C2E0357C7267AE36A7BFA09296B43F11BA7ECC874804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e177aaadcb39490f65b25abe49b74b0d63c60970c942d68f8989f0184a0101e0
MD5 af165f3c81f903042292c0fd672091d2
SHA1 c22c07b5cb5be953cf8d62442de3b6f245ec10bd
SHA512 e9f0d3ff5bfd0084a60ff74202daa7bfdbee3d9116572aa91b07d023a3774a454292ba8ef13639a5c8a0a6fa17434c144e619386409adaa4e0d58a6f4d166cae
TLSH
T183819224B5C20042D7771E32D9C2E1353C7267AE3AA77FA1929AB53F15BA7ECC874805
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a042.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a042.TMP
Size 3KB
SHA256 5d1912d9866d55fe6a1f224e2577a6dc74b56844a00ac60b3e905ea1d9619b73
MD5 1501fd8e0b21d046c625ea1c5f83c9e6
SHA1 6517b9ae8138c43bed02a8666b1f0d7882cf4019
SHA512 92939132202933275e2093f2fa1d629a4927dabb166d283a6d6a502995cb85f604985100af549f48e04dc2f8d8765b6e0e1b58a8d5feea2ee7b6e57ab1bf21d9
TLSH
T1CA718F2875C20541D7371A32E9C0D0363C72A3AE3A6BBFA192D6B43F05B67EDC874804
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

016a3f95-2733-4e7a-95be-3b1e4988bbd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\016a3f95-2733-4e7a-95be-3b1e4988bbd1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 8156e5c6cecab1e500956f1e914c635f4a1b302b815ae62df13cfb09e47f865a
MD5 37b3447c55164ac34c3e78276c12199f
SHA1 c42cab051d87ec2ea3d2fa507d2b0b41c7a9a795
SHA512 63423695b41bd1be08e9152c5f80caa8a8fa67fa66179ee8fa13f569aecab95a189f6b1c677e0258249e3e3ac6fb46de25db494888ac41f0586986061d380376
SSDEEP 48:YALlNhOhlhohr1hkyt1hSAspzEsZkzs4/s6ptsp0sc9sQXs5csN/I70Esv7sBC7J:DDOPSLqWSzNeRpaQ/UR60jcGqFmwovb
TLSH
T180B15BF7C3E8C52D895156F49B25AF2FCE1E1A14432C3C66C8D8BE1BA3E2831E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5635d941223ca12119e9c36e112c3f53159cf315ccf408c027b32eb183ae9bb9
MD5 cd0cd94f1b1440eb92a94ce8ad71e563
SHA1 3c0adee86c9abd816baac1a8adb031a5ab8b7712
SHA512 7beb3a62a84fcba5716a852048b7634e9240749f64a06ea4223d0379c2551522e9082e52389f2f9b77371fe6df7d565d8184c5df04846d874e442c7760225604
SSDEEP 96:DDOPSLqWiuzNeRpaQ/UR60joqbUmwBtBMBiSTGb:DaPSLqWiuxeraQ/UR6moqbUmkr4iIGb
TLSH
T108C169F7C3E8852DC95156F49B25AF2FCE1D0A14432C3C6688D8BE1BA3E2471E11665F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 afc91192520083d859eb0ed13caecc138e1662b7bec47bfa6e2c7bafa92dfa99
MD5 846bc2726101b280f449220801443b5d
SHA1 d55d2a10a22e4a8dd251b5577ac44ec8297437e2
SHA512 02ad1d9402c6744a52a4c4517f28b00ea47912be24b8f571ad96f78ed669db6e175162c41726ae768e0982a8c54189125b9be7d140d9f44fb64469e34fc162b3
SSDEEP 192:sxZiRt0yM/jK1Ml8MW0/fgsYFQIdp7VHW6+WNKrI/YwbiSNIgrJ:sxZi8u0/fgscxRHbl/59
TLSH
T17042E8066A34A97BCCDBD209BA55BB53D6F54472E2940E44A9FCCA1C04F6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eaee1651ae3968e83990642fe08670327666d30bacb8186f0ce7845b78d4c2a6
MD5 69a3d7f9d80f2983c7e6c50b9eca41f2
SHA1 e05141163460bf95bdf270f394dcb72f1a050ea0
SHA512 a276eec3cf5fcf2785cf5edd33b9e67faa3a1bcdd5bdd8035a55f7a5bb914dbe643c0c8fd7fd3244ace552505a8e8cbf02ee74a03fd92d44bc4fe5ae3c474b3f
SSDEEP 192:sxZiRt0yM/jK1Ml8UQ+W0/fgsEdQIdpU1VHW6+WNc1uvgPXYwPXmYNIg5kJ:sxZi8qJ0/fgsQxqHbJgXjW
TLSH
T1CE52D856AA3459778CDBD20AB941BB53D6F504B2E2940E44A9FCCB1C04F6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6c3039894e9f3dfc2ea7cf0ede2b726c3b41f3ee544af974f202fcbd4682f971
MD5 d738de79e660630932e99a46347cd04b
SHA1 69bf700566d8a510efa60906f2c92e15c4ae36d2
SHA512 9a5a7dccffe6e2cc4799c43780973f7f9e58b9030307987475ee85384a5c7bad51beb3139b005da846b409e7eb752ddd3a502797ada4f97870c4bb58c5bcd5f5
SSDEEP 768:6D4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dprohscpa0:6D4jeXmWvmKLEu1jacPLZQdCRt
TLSH
T1BAD2093B284CCB7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 59598035ad9cde4c0046902500dde4fbd3b7555daac423b75bd9dd2e1e697d13
MD5 5245f29b92ff0237ec42e250ede37b12
SHA1 ca6c64f7c6d92c4fb7310cfffac3ba3b05355cdd
SHA512 830b2bd3e14c91539245228e730940ad3d247361a6e1a96cd0f44f46acfdcc48653e8e5a236744761865c45f539d241b70b36dd596d202ed96aed3340df6deb7
SSDEEP 24:KdqfdmXaMdg8Y4IU+LIjCYKi7ha0Y1ECISm2Mf8K1yXYOfhSTaAdUws4EQ+3IjWJ:KwjIhKE4svytjIlKsEowqI/K3KA7yt
TLSH
T14A912F12347B22013CBE29189590D62B5A9275733059BE7B7BB860B20FA7F650CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c27f5f99-ace9-4165-b872-278082229f67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c27f5f99-ace9-4165-b872-278082229f67.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0c3571a047d70310e4da638dba56dc4c50299114bc286b9ffb9708ff614631d4
MD5 0cce9ab8fd9af874db4b6763bb8c83ac
SHA1 b5dd89fa562771f7cc30202302927a306411e19f
SHA512 e06a939c558acf369f520eddd4bd0c57e79e92c9a08248afe7ef107b95ca96f37d8275e87267aa5e935a98a192d907a95bdea080b6d2b7a29d5d2a5410b24d44
SSDEEP 384:QZcIhsNbcmKXfDf+0d2YHRmUFD1OObjI9G6w7Eu:uhnThtZJ29M/
TLSH
T1DA928D316C786D335DE6A602F4C73A130EF4917BEBD82FC4A1EDAB1D04AA5BC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c20963e715ccafed6ee8e7454e757de0fc8f790b5ad85342f0dbdcbf68dcd8c
MD5 bfbb72527efdaad8836c12366c2dce1f
SHA1 5d7313327fd0d611da332631c6eda5cd04c3371b
SHA512 aa2dd815ef7ac37afefab031737f76739b2fd72d0347550f30fac92c4389dd9c68ca1741bf03df9246affff5d59ea4142503cb33eba02f15d39097821cd12a4e
SSDEEP 192:EONY6hZ0QmiUyPBpc/+jVx+Fd2YHC5wOZsnU6:EONY6oypu+0d2YH526U6
TLSH
T1DE02D935A8786C778EF2AE06F48737235FE5116BAE956F84D6E81B1C00D769C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5a29721ea3bbccc9bee246eca0fefe925b192cdbd2c04670c2f772e2a3d2f32e
MD5 96a5d7c85b033e3ab107c3fdf0db781c
SHA1 899b97469bfca6170742e38ff8afeb21b94707d3
SHA512 47b450f16c6dbfe89a92f33388d1e2ce6c00e1ff0ee4c1dfbaa40fd02464b7c801ee9efd3e9ae4a6b5e8940e6b370b823ffd74764eff26c0f8a19a4d78b1cfaa
SSDEEP 384:QZcIhsNbRmKXfDf+0d2YHRmUFD1OObjI9G6w7Eu:uhOThtZJ29M/
TLSH
T10E928D316C786D3259E6A606F4C73A134EF4917BEBDC2FC4A1EDAB1D04AA5BC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d32c619e1c7a10a8d707efe3b2f8f25396d5b7943e4afae20b1af1501b78dbe
MD5 bef220d22a5602d133fbad5a58b2cb3f
SHA1 b943530f3a2b55b8cf0682f3cf87f15f6a6e581a
SHA512 a2756740c710cbef31fa85f168f5eb94a35bafd79911212ec5d5c2e18f4c10a294b409c86a42285073176d270981b4083995fc551980d5eaf02f574dde575e6a
SSDEEP 192:gON+6hZBQmiUyZBRc/+jVx+Fd2YH8FEmP5cOqFqgL1U6:gON+6z2Ru+0d2YHRmi9D1U6
TLSH
T177120C326868AC374DD2A946F4C736134FE5516BEED97FC4D6EC1B1C00EE6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 31113d757cf5b81504bcf79e44d0f449b81c51306156314f3907492e05d13334
MD5 f7650eeb7d17d6d339c188e458fd8f6b
SHA1 c3d234b61621eb5e6bcd8ea8d98be99a95a232b8
SHA512 4b15e9a018c7f4f81726892bf62c9eb56fd55bcae9002a9e6355c0f8e912bc6df9fa3f2b0a92cea854eba1b6de3a5ae6caa3ca38e206f052bd514e6dc0fdcec1
SSDEEP 384:YiFiZcIIzsNl8TUNTUlIlRmKXL+o7k2f+0d2YHRmWFD1OObjI9G6w7Eu:jFQ0gwgD+o7kmhtdJ29M/
TLSH
T179D229F258D78936D9AE9B03B7BE2D124EFCC067B6946A84B398970CCC560BFC305814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cf5c8029f00336eead964bd09111f3c6cef7719d00a456adc1f13be4a619f492
MD5 b1ac769d8d30fc972e06a3574350edce
SHA1 e81d00cbf42d20301f181ebd7ef1213974c32a66
SHA512 fc7c858250ad6ddca88e281a40fe31863929f3ecbcca60855b791dc325b1e57c8a78cf413860815537ff8f6ca4fbab9e969b064ad3b2244e030c9f591b85de8b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d327b1b72aaa742a5faed1b27a94d01cd5f94436ea9d456f891f71493d22e433
MD5 75fe82ec0a56eff57af1db659a6efeab
SHA1 18adb0c4aa30f38400256f84fc9a607741954f42
SHA512 94ba94b2a8348f1a39cea6713ad7846260713513411e48d67c289083b283f392ae5b8dc261b23d866cc5678e3db164231e4474595b2a8644998f1cd403799cb6
TLSH
T146E00205D21000BFC029033059C3113232F1D05003B353464400527138123010F30AD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b9eec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b9eec.TMP
Size 392B
SHA256 f2ee912bcad67b5bcb5429ad3351b435eadaa914ef45552e03f9463743f2b37d
MD5 7a5f7f4834501a0e394635749c42fcc3
SHA1 8bb23c6e96b49e4055a222e4da0ed1255474946b
SHA512 6b06a7c829a13dca28a28e50aba41a1f5f2fa86392235099c48da9d883e296b882865210eedc9fdd21b1ad4cacaa5a71232392d699f08050d117f98b769847f5
MD5 SHA1 SHA512

Submit Download

36c3ba3c-8995-483a-9fe4-423b179cdf98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36c3ba3c-8995-483a-9fe4-423b179cdf98.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 89af016edaa1dd73fee2f1c9d48dc6f2c3a000adf7c411baf0265c6808eeccbe
MD5 df166763b2a17ce547a88fc25512d2f5
SHA1 466cb6311d8c58feebba507d4ff7f20b8a529b45
SHA512 2e89fefbcf6965536802e559f12cc156c1023c5f97b90608d9e4f3e92c5a1937f35af53d00426f7af974f3b9eb381709bbdbd033837f8112ca7325a5364154c7
TLSH
T17F41F95CAAFA1148B3B76F56AFF6A86D487B78672E06C49D00010D4F0A32F45CD62B33
MD5 SHA1 SHA512 TLSH

Submit Download