hxxps://docs[.]google[.]com/document/d/14WhcVQwhQXDCEjF8IWLbGFl_SNKjbhqijtK8Z8xsWM8/edit?usp=sharing

Resubmissions

03/08/2026, 00:06

260803-ad1xeahf763

02/08/2026, 22:41

260802-2mbgnagg633

02/08/2026, 22:22

260802-2aphraysaw3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
898s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/document/d/14WhcVQwhQXDCEjF8IWLbGFl_SNKjbhqijtK8Z8xsWM8/edit?usp=sharing
Sample260802-2mbgnagg63

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4448	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301868616019448"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{0EA8EF8A-5F0B-45C4-B4D1-14AF766F9F95}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2184	4116	msedge.exe	82
PID 4116 wrote to memory of 4448	4116	msedge.exe	83
PID 4116 wrote to memory of 2216	4116	msedge.exe	84
PID 4116 wrote to memory of 1776	4116	msedge.exe	85
PID 4116 wrote to memory of 2216	4116	msedge.exe	84
PID 4116 wrote to memory of 2216	4116	msedge.exe	84
PID 4116 wrote to memory of 1776	4116	msedge.exe	85
PID 4116 wrote to memory of 4392	4116	msedge.exe	88
PID 4116 wrote to memory of 4392	4116	msedge.exe	88
PID 4116 wrote to memory of 3644	4116	msedge.exe	87
PID 4116 wrote to memory of 4392	4116	msedge.exe	88
PID 4116 wrote to memory of 3644	4116	msedge.exe	87
PID 4116 wrote to memory of 3644	4116	msedge.exe	87
PID 4116 wrote to memory of 3428	4116	msedge.exe	89
PID 4116 wrote to memory of 3428	4116	msedge.exe	89
PID 4116 wrote to memory of 3428	4116	msedge.exe	89
PID 4116 wrote to memory of 3552	4116	msedge.exe	90
PID 4116 wrote to memory of 3552	4116	msedge.exe	90
PID 4116 wrote to memory of 3552	4116	msedge.exe	90
PID 4116 wrote to memory of 4568	4116	msedge.exe	95
PID 4116 wrote to memory of 4568	4116	msedge.exe	95
PID 4116 wrote to memory of 3244	4116	msedge.exe	96
PID 4116 wrote to memory of 3244	4116	msedge.exe	96
PID 4116 wrote to memory of 5068	4116	msedge.exe	101
PID 4116 wrote to memory of 4280	4116	msedge.exe	111
PID 4116 wrote to memory of 2352	4116	msedge.exe	112
PID 4116 wrote to memory of 4712	4116	msedge.exe	113
PID 4116 wrote to memory of 5300	4116	msedge.exe	117
PID 4116 wrote to memory of 5300	4116	msedge.exe	117
PID 4116 wrote to memory of 5536	4116	msedge.exe	119
PID 4116 wrote to memory of 5628	4116	msedge.exe	120
PID 4116 wrote to memory of 1304	4116	msedge.exe	121
PID 4116 wrote to memory of 5628	4116	msedge.exe	120
PID 4116 wrote to memory of 1304	4116	msedge.exe	121
PID 4116 wrote to memory of 4188	4116	msedge.exe	122
PID 4116 wrote to memory of 4188	4116	msedge.exe	122
PID 4116 wrote to memory of 5288	4116	msedge.exe	125
PID 4116 wrote to memory of 5288	4116	msedge.exe	125
PID 4116 wrote to memory of 1968	4116	msedge.exe	126
PID 4116 wrote to memory of 1968	4116	msedge.exe	126
PID 4116 wrote to memory of 4500	4116	msedge.exe	127
PID 4116 wrote to memory of 4500	4116	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/document/d/14WhcVQwhQXDCEjF8IWLbGFl_SNKjbhqijtK8Z8xsWM8/edit?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbda2ec188,0x7ffbda2ec194,0x7ffbda2ec1a0
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1586579392504079268,16913299175527843681,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,4097440938386502632,15877129113921352766,262144 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,12078889204072496491,2107215838696964364,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,12011702136661755018,15618149927746241990,2097152 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16208056541594357846,16086508752994370114,2097152 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,9795016905004072161,3701097441529770326,2097152 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,13654352040208111055,12181945603805609341,2097152 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,9675402653382956409,3266497530659384951,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10537893670034565312,6173477795000815400,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4426347814138528238,13947257803299240484,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4426347814138528238,13947257803299240484,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,7859091128806020694,8272552938204041462,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10227871781250027418,480042749404460804,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2058734061438465277,18427850736223139483,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,1472759888347799241,16126851348255460913,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5176,i,12320902351506910417,11184438518327985181,262144 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,14718839676633288825,7102029952905188114,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,7510624228857264324,6788903631886255372,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,4138914527307028258,13529965592746893600,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3252,i,8633998237597172596,4905610756297836318,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,13502341934678136265,10128975259660849992,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,17713885335755611872,4791639509692757902,524288 --field-trial-handle=2500,i,15148141579495278456,17006344323336189398,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 534bcd3a13dd6309b928ffd9d2133ab7342efe0d92939c9cdebe4354dbb731ff
MD5 232d7f03f5dfaacbb4716269dad84daf
SHA1 2971a6cbc96f2a257ab2a17347288ff557d3eb9a
SHA512 481356cbbf1502908e91a949fb19c63a37d3d6a63aede17da5a986c5efba69f027a37ade8852315107182a31b3960c7f0280dfeec042694f1155873346f836ce
TLSH
T18AE026DA45C8C32EA6477847527C930CC2C03A0FAAC8EE0E1B0484AD7007048B2C2BF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 295fe3c9c4395176d3922164c292f6140fc79690ea1b5c7c272eaaa339685e53
MD5 747d5adddd50bcbfaad8be3deda54775
SHA1 a9e85d3718791e7e59d90d2c872bbd9df1fc9557
SHA512 4c5bea302216894124f1cadf08ed4853a72655d24db753ec7e523c7fe2320429ea878c2f778d2232b008993aea16b39b14f6da909b3b78194ad6d612a4995fbf
TLSH
T139E078CC19C9C22F97167487527C534C92C0370AD6C4E9CD17049844F847041F7C6B71
MD5 SHA1 SHA512 TLSH

Submit Download

f_0001c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001c4
Size 1.1MB
SHA256 6fc1f67509091377fe2194068270dc02e4fd15c7d38b756ca4e529461fdb97fa
MD5 d62772384270df06bd792f2c577d6d02
SHA1 16c8a44e4c2a64b376c44a739a80e879cdc8d033
SHA512 bae20a3bd242fa0c8a25dba83ba3f9be6386903c2a6ab72538bdaecff3e722d1d90f31685879f099da013db60e43246389b101b6eafbe3b20c519a3f9b29b6b5
SSDEEP 24576:+ejEfxbBXOCzL+OUqGOj8E8kNY51JcpwfmxuC5t7wDPkW:+ejuxbBXpL+OUqGOKkNY1JxfCuC9wjp
TLSH
T1B545231358BA53FBE41B90A700974956F79D0714E7A43B9B81B4F17E2B90BB1EE38E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00023d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00023d
Size 1.0MB
SHA256 e42b3dc98f50203370095b3c239f7fd1dfafaeb275ed52d7d5a7011eaf272922
MD5 815672ca15ae6be823063802c3335ffd
SHA1 daa11a6e5b6b6a5d2096a491c229cae3de76187b
SHA512 41933aa8b2fb71f5fd445dc50f3ec8653a693c391117b87b30217b518dbd8538642cacfbe547e5124439636ef88db88fb859829e68fd845c087bec8e547da3d0
SSDEEP 24576:2qcsKnZ0EkdFfet1Mxe9qTD6tWVo3D5MKCdzP:2aKnZ0Ekqt1MU9+9e3NczP
TLSH
T1A73523C3929868B7CB45D7521AE60C8D98DF30BEB96F48241F0736D1F6E9F8C142D64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f85bd8ba8f522d907711b6bcb43eba38d33defc155fe948b766080427756663e
MD5 da0dcee81d1a7dd47a7d34284ee15b29
SHA1 49eedb4676142ffdeae0f70309fd95c81a24ce32
SHA512 8feb4c7c5636d3b1e97067a7d96ca670313f8ca8b885517eea57b379a4468d2c53584b1448a517bb485b82730359df7810e4ebc7b2a2df75c32f644f4f1e0857
TLSH
T1BF819E3810064D93E7C55033E4FFCA10717584EAFBA2EE268177ACBC660E728444E9C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59debe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59debe.TMP
Size 3KB
SHA256 14f9156e1b2bbd8967fd21688c810a8c4845e070c54a7ec95ab7a2a0adb3c87a
MD5 58c22392bc165eaefd56e612573e2e48
SHA1 12da34babc2d4baf7797feb7a5c91aeae0740393
SHA512 c950422e22c2196c12f55926416d6adae055ba3bf3ff419c18f2e5ce092855037c202e170bd062d109d16aa2d1ed891edcc2568e42d00f6d839158a68a345237
TLSH
T144612D3800454C53E7C52133D4FFCA5474B985DAFBA3DE2691376CBD660E725814DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 28e2684437e43fccf959916d71773a4b9f3aa56edf2bcd37d95c19356eed6d4d
MD5 9df612f4ac455c4dd19f789a80ff762d
SHA1 6094c5cc4870022fd6f223433c16295fab66b7ed
SHA512 630faae649b2f93adb60b580def9e112cb743a351f6e39203bcb179c7d28d159320576858e575dc44b185a5e081a9833d5c08cff9a4fcad6df3bbc218af7874b
SSDEEP 192:DjiwalxEqFxS5CcVA91DC8PqAdEsh3eq8S6Luj:DjiwalxEqFxS5CcK91DC8PqAdEsh3eqT
TLSH
T153E17AF7C7D9862DC85116F8D715AF1FCE1E061843283D2A88D8BE5B93E2431D21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0cf7028322117655b33189cb905d1b414f375922afed002d9781c6b200066d04
MD5 bc828773163bdab3c7bcd2e8d570e496
SHA1 e147c3dc2cfceb82a1acdf30209ca80a516f3444
SHA512 29adf8d073dad7f467712768ec46a80167c162d7290c4ac532b8e5d9161104194486db0148c759cadc38f7f1bbd83e53e45b82a35e4f749968bfce180ce665f6
SSDEEP 96:D/OlEqM5Otia2Aj5zNzB0BzNqdZhPdRSrumGj4/TerwQ:DWlEqM5Otia2Aj5zN1QzNqdZhPdRSrul
TLSH
T1FFB145F783A5822DD91156F49705EF2FCE291618431C387A88D4BE67D3E2432E12A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 383ed93a38f94196ff0c25cec27050cb9170bee08725ebb680aa9728776ff55d
MD5 a1a11477f030da6f9d07eda910b19f7a
SHA1 cfd5e863836e220849dd23ad9699d12acdb2bd70
SHA512 00b5975a111d02b11e67c64f7ac075986be3104ee9f3ef8b21db4c77620015fb9f7e96bbccb4c7439c0f26cd78a64b53c8119e2f502371dc492dbdeb11aebb6f
SSDEEP 96:D/OYl+EqM5Otia2AjLzB0BzNqdZhPdRSruwBmgGKj4/C:DWYl+EqM5Otia2AjL1QzNqdZhPdRSruE
TLSH
T1B8B156FB83A5812DD91156F49705EF2FCF291214431C387A88D4BE67D3E2432E12A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a186c17d1b0d7554effe950bf2ed9273f743ca44446af38b69dc55bf6635b711
MD5 d0552651f8e934fa412c5cd0ea6cd40f
SHA1 045345cb6439402796bf8cb1d2a6bf2edb672560
SHA512 521750b4ffec50ad8af88e5b9c68245b7709002a68564bbdbff49dc48d61533d8cd831a477f659e785bc4dffc7f63d885281f75fe535384309d4588f5d8d5b5b
SSDEEP 96:D/OYlEqM5Otia2AjXHzB0BzNqdZhPdRSruwBFGj4/KY9:DWYlEqM5Otia2AjXH1QzNqdZhPdRSrug
TLSH
T113B167F783A5822DC91156F49705EF2FCF291618431C387A88D4BE67D3E2432E12A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 531ad450df3d10db583acf62dfa35291eeafb91a1a53a048930d4602434c7011
MD5 d28af316bdc0b36dc24b044be7279a99
SHA1 1e2b240916603ee5105ec762a473eaa6176d94f6
SHA512 ae45c4c6c1516c1477a2b675913fd50a65d0ad56148b62da4d00fa7e46b44c4cf6742c50ee5849380e064c2c93a40b197dacca65fea6ea694da07ecdeb400b91
SSDEEP 192:sxZ49RMVkR/fZsR3SnEdp7uHW6+WNfVh/Y9IRNHgIgrJ:sxZ49KeR/fZsR3FqHbn/c9
TLSH
T1BA22C7526E38A9374CC7D309BA19BF13E6F90032A1951E58EBFCD61C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 2fbc85c1b714493b66993824daa263b2c1033507d77723acaf2d744ad2c7ee80
MD5 dd64a07f37a22984d0fbc5c92555e3d5
SHA1 a7d4e87927ac0035ddae1767d5acf421e7f56733
SHA512 61f957ab8a3dc66bdc349dd7edad2b89376b008eb4b55e2d719a9282a0e11f95c10774b161a403189535597c6a1cf8b09aeb95a0b5d3fee9fa80eeaad25960fa
SSDEEP 384:sxZ49KeR/fZsrn66s8qMpRiYnazAW8pZS15posJWeT+E7MHb7xoV:sQKeR/f+n4Mnc7WeT+EoHbFQ
TLSH
T16AC2F705A924C8379EC35D1C653D7E33EAEC506222C5CEDA5AECCA1C019E1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 daadc814d68edb13899e406af7b0cb4f6939430165f69150a62a121a0d68eb9b
MD5 296927566127719adb8580f8632fbc98
SHA1 ce4d9d42f75e7771414422bbfb244f432c34bf47
SHA512 551377df841d6c6a265c549a1f28035f0c10ac8e2a9d15ddbeb9dc9cd9113754acc18c180b5d0aaa323cb447920836e1d721a534336cfe50a9a826576bfb9f8f
SSDEEP 192:sxZ49RMVkR/fZsr3SnIdp7uHW6+WNfTnXY9IPNHgIg5vJ:sxZ49KeR/fZsr37qHbTXKj
TLSH
T11322B7126E38A9774CC7D20DBB19BF13E6F9103291951E58E6FC961C05E7AED220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b762eff4d12ef104288a50580ef67acaec3cba9d67e388d74da5a1ef5ec295a7
MD5 bd0716bb03cea3c4f306758f481c486d
SHA1 0dfe5040f58353940ebad80180ae7ab39cc26b23
SHA512 739157e5667a61ad36fe5128ed83ea80a60839bc77b0d4c0b8caee8d29e8a5812a3b70e2c26ac5e47a219f6475471364c911dc51232cdbb77c156377108f6961
SSDEEP 192:sxZ49RMVkR/fZsrDSnIdp7uHW6+WNffDdY9IDrHgIg5NJ:sxZ49KeR/fZsrD7qHbTdEV
TLSH
T1AE32C7126E28A9778CC7E20DBB19BF13E6F9503291951E58EBFCD61C05E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6d92b36323b473022da7ac21c0d2579c95df3c56a3bddd517be2eee6a26af4ac
MD5 65c6e7cc59aa0a2f167955ef80c40158
SHA1 dca80d174216aefb31e0fbd2dd98c31eaef5075e
SHA512 9c0f6bb6a7e0febf4a00bacae9110d7de6423e2de9951f61f1a149fc543938d32afbd125cb1800a7bb5bc322d921f6722455d7cdcc3c1d8943bcae49e46e04aa
SSDEEP 768:nFyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7YroLbqQ:nFyvIZwWvu+Q+u1jamFLeR7jL5
TLSH
T1C6C2EA2B240CCB7E5F801E9DDD5A6F9B3EA802C757588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9f8caa0f-7232-4235-8ea8-e8a7ef259fbc\index-dir\the-real-index
Size 360B
SHA256 f11458d0737bb53b05a8ee3c8e4b63ad753f94815e79341bfd6c4ce3792b6556
MD5 94498d54fa792ea1c70733de03f0c57e
SHA1 09cd22c1e14e69706742cc1457b0559b5d3fef1a
SHA512 371c9076c6aeb45031c0042d311de60694cf49142aa2085f73d36bdcc0781117933a092e8b1e64eb5c4c59fbfa33350f0466a3e76af9a8973de5faa7aa6f763e
TLSH
T108E02B150E51182AD9600EB224330199B3B18CECB711984B247DAA7B2C56348655A2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1d20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9f8caa0f-7232-4235-8ea8-e8a7ef259fbc\index-dir\the-real-index~RFe5d1d20.TMP
Size 360B
SHA256 af63a05f21181591998878043c3866418b5c785cc287a663723ca46c649cb2bc
MD5 9222f0a1148c2593e4a7fc1214a49b7f
SHA1 43f4eb8ee8369dceafbe7dde7220527fb566fb1c
SHA512 88e2efe3f40d703a5430b603d69f9a137a47cbcdead27be110f9a349f522667ea11637d534ffd1f661a01e1e7c784db6d0195ffa012897fdbe33c408deb77256
TLSH
T112E0956487434572DD200677152344EAF3B4CDA0B571F98A347C693E1C2574CD5522CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4b3fd6d9e3a85716d9d8def2456c0e963eab999e119586e518597e3fb1fb8115
MD5 38407514ab07b37f9eb46aa0e350943a
SHA1 3a5a58aad68d6f2fede4a80873c2c4952ffdbefb
SHA512 85cd34f68cbfcb89c7f740630ca3d0ee3a327191da0cd038db67f77586bd43e6aa9d9eac9567d4363bebe2761748f598dc3475ad6fda05cb50d6b6b1aa7998ec
TLSH
T1B7E020776DE75414FC6F53D1147154E40541BD58C906AC4F642DF18791713BC385AC65
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597cb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597cb8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 76fb632f5be67318cd6b00deba69eac515f05ab4c1914eb0d23c1410f6b2b7d6
MD5 6af07c5da96991eccd150399ec15e14a
SHA1 589e3850cda3b9c596d5a67f5b2a8698be4dd13a
SHA512 76d02c7c2a74fcd61c9bc91d6d96dec380a81b49d01f26b2b3bb23f283187aca5331c3954026f383fc8ea56a4e8726bd0652590fe68e11e49d2cb0715467e3ec
SSDEEP 384:sZcIhsN3BPvIP4ziJP4e+CeODejhCFXK9Li6Uq58bhP+wXPBuYT:6hiUL2OijhCFwLwj/BuYT
TLSH
T11A928D7569356CB65EF6E245F8073617CEF88173D6853E80D5EC6F0D02EE5AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a94bea8bb6e9574629145e927d6ab16e34b19a5b0fcbcd820962e9b807f820f8
MD5 3d51c217c6b1d1517d31a45af5b74a45
SHA1 0ad4d1d7ce12b00b315d4713c778206f7d5f3b38
SHA512 0f73f04ca1b1816efdb5b7b7e7deb206c0d5ecc010cff0c35757469e498599ece0d224444b6839347ee853918245eed3641d2799559c5603ed6bc27bf9af7f9d
SSDEEP 192:JONj6v+YLNQmiUy7GZh+CGLOD9oqus/ZU6:JONj6vz/jZh+CeODeMhU6
TLSH
T10602F9357D281C7B9FF2AE45F98736139FA91177E5952F80D9E82B0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 160d2d4abd1aa34ec27e43303f09ab9dbe38d160478956a7dde64ab3de65d301
MD5 a4d392d6f9975ba1933b52a3c1c663e5
SHA1 48d6e98e70bfa2e9f96ec984d0154b2932848423
SHA512 b9f389342da35d125b6a7e173e2d5984ec380fd400cc3570322a3b04551eeee9236fe24433488a755dfe872e9dde8757b3042827461d1033e046c64963334afe
SSDEEP 384:oZcIhsN3kPvIP4ziJP4e+CeODejhcFXK9Li6Uq58bhP+wXPBuYT:WhNUL2OijhcFwLwj/BuYT
TLSH
T18F928E7569356CB65EFAE245F8073617CEF89133D6853E80D5EC6F0D02EE5AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8591d3ecd6f8c352eb87bdf54bc5a4cab443dbc48955c3e25fbdfddd85c48292
MD5 3f6060064b22385cbe621ca4c0a4971d
SHA1 e63bd0a3fb89d6f2bf3698834435fbc166ebf4e2
SHA512 756f5c601cff0fded6c9dd73650adaf603e2cd4b764e4fb1a26a391c77939a5129f60fa93131f0b77862c3fdc2ebd5a86741399a7aca498880af8e7570ca005e
SSDEEP 384:oiFiZcI1zsNJ8TUNTUlIlkPvIP4ziJP4e+CeODejhJFXK9Li6Uq58bhP+wXPBuYT:zFQNIwg6UL2OijhJFwLwj/BuYT
TLSH
T105A28E7659249C7BAEFAAB45F90A3217CEF84173C585BE90E6DC5E0D01DB1EC130AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9829c6a51c1b0e4b2cc42a271f8cb3daeec51cc01af1a412129dee86ac951192
MD5 803a7c7271c14c9bc0407ee919306ce7
SHA1 25e5177656d912a28cf0820e98f2dbbab757e96a
SHA512 19f9ea6ff2d2f4ede041ddca72f3a4ecae9187fca585e0dc1b98c88a67aa213633f3d46517988256c9a7cffaae78c1d2737c5ac50926b1bfeb0c923ab55f2462
SSDEEP 192:YONS6v+YLVQmiUyNGIh+CGLOD9ojhQCH4qXU6:YONS6vzv3Ih+CeODejhxFU6
TLSH
T130123A35B9385C67AEE26585F48735139EA94137EA8A3F80D5DC3E0C01EF69C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d897c79-a358-42b3-bf5f-b5ea27999b0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6d897c79-a358-42b3-bf5f-b5ea27999b0a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc42429e86f4f68554a1013d1f285af3fa53f51db87fb05cf2634210422ba8d9
MD5 a55d9f9550e3a88914b3b3c2098a0af2
SHA1 ac6a2eea4959ed327be8b3c3efa5504d97552d14
SHA512 0708987760b78fb468fcd7f1ea31e36aa4f3931f54fc18d647b21622f2c1d1758e2392015127c9489313e62f5312de436c40d74bb0d4d6c181b4933b65818eda
TLSH
T19441E958A6E9114CF3B72E56ABF6656D487AB8762F06D06D10010E4F0A63A40CDA1777
MD5 SHA1 SHA512 TLSH

Submit Download