hxxps://docs[.]google[.]com/document/d/14WhcVQwhQXDCEjF8IWLbGFl_SNKjbhqijtK8Z8xsWM8/edit?usp=sharing

Resubmissions

03/08/2026, 00:06

260803-ad1xeahf763

02/08/2026, 22:41

260802-2mbgnagg633

02/08/2026, 22:22

260802-2aphraysaw3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
899s
max time network
892s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/document/d/14WhcVQwhQXDCEjF8IWLbGFl_SNKjbhqijtK8Z8xsWM8/edit?usp=sharing
Sample260803-ad1xeahf76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301901016285560"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{F4FAE355-8E08-47ED-9D3D-4CA58C136F81}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1844	5088	msedge.exe	85
PID 5088 wrote to memory of 2636	5088	msedge.exe	86
PID 5088 wrote to memory of 3340	5088	msedge.exe	87
PID 5088 wrote to memory of 3340	5088	msedge.exe	87
PID 5088 wrote to memory of 3340	5088	msedge.exe	87
PID 5088 wrote to memory of 3112	5088	msedge.exe	88
PID 5088 wrote to memory of 3112	5088	msedge.exe	88
PID 5088 wrote to memory of 3964	5088	msedge.exe	90
PID 5088 wrote to memory of 4916	5088	msedge.exe	91
PID 5088 wrote to memory of 3964	5088	msedge.exe	90
PID 5088 wrote to memory of 3964	5088	msedge.exe	90
PID 5088 wrote to memory of 4916	5088	msedge.exe	91
PID 5088 wrote to memory of 4916	5088	msedge.exe	91
PID 5088 wrote to memory of 4696	5088	msedge.exe	92
PID 5088 wrote to memory of 4696	5088	msedge.exe	92
PID 5088 wrote to memory of 4696	5088	msedge.exe	92
PID 5088 wrote to memory of 3892	5088	msedge.exe	106
PID 5088 wrote to memory of 3892	5088	msedge.exe	106
PID 5088 wrote to memory of 3892	5088	msedge.exe	106
PID 5088 wrote to memory of 2288	5088	msedge.exe	97
PID 5088 wrote to memory of 2216	5088	msedge.exe	98
PID 5088 wrote to memory of 2288	5088	msedge.exe	97
PID 5088 wrote to memory of 2216	5088	msedge.exe	98
PID 5088 wrote to memory of 888	5088	msedge.exe	100
PID 5088 wrote to memory of 4892	5088	msedge.exe	109
PID 5088 wrote to memory of 4656	5088	msedge.exe	110
PID 5088 wrote to memory of 2376	5088	msedge.exe	111
PID 5088 wrote to memory of 3868	5088	msedge.exe	113
PID 5088 wrote to memory of 3868	5088	msedge.exe	113
PID 5088 wrote to memory of 2936	5088	msedge.exe	114
PID 5088 wrote to memory of 2936	5088	msedge.exe	114
PID 5088 wrote to memory of 2436	5088	msedge.exe	115
PID 5088 wrote to memory of 964	5088	msedge.exe	116
PID 5088 wrote to memory of 1784	5088	msedge.exe	117
PID 5088 wrote to memory of 964	5088	msedge.exe	116
PID 5088 wrote to memory of 1784	5088	msedge.exe	117
PID 5088 wrote to memory of 4656	5088	msedge.exe	118
PID 5088 wrote to memory of 4656	5088	msedge.exe	118
PID 5088 wrote to memory of 2996	5088	msedge.exe	119
PID 5088 wrote to memory of 2996	5088	msedge.exe	119
PID 5088 wrote to memory of 2160	5088	msedge.exe	120
PID 5088 wrote to memory of 2160	5088	msedge.exe	120
PID 5088 wrote to memory of 4488	5088	msedge.exe	121
PID 5088 wrote to memory of 4488	5088	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/document/d/14WhcVQwhQXDCEjF8IWLbGFl_SNKjbhqijtK8Z8xsWM8/edit?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd6931c188,0x7ffd6931c194,0x7ffd6931c1a0
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,17728662834711504349,4961278383325039436,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8494909009152607025,14221329601998226675,262144 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,185345386688093896,9538155799375981244,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,10466244938603968357,8925355572911355689,2097152 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,18038654188210388471,18029093381066311415,2097152 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,17891492971986619104,16322403736890828074,2097152 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,1076996365900049082,17904733089789940874,2097152 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12791283500722945047,5912826038703842527,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9482054624073929741,5189810709742483374,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14591955229916599963,12295826083626568749,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14591955229916599963,12295826083626568749,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3935708295582919852,12686249885269612086,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8581562806539323172,5147900533225657393,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14737738545761376733,767618980020949035,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,3593883860179015321,9882445785404753246,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4743652017422806398,9891210530859496606,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6296,i,7160383013451430570,12735292108883587256,262144 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,4043891368224670510,2401303018999613980,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,4380434020870538972,1528995583364000662,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3036,i,466797384974382228,17964526094191389353,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12229215528996922144,12034692328907246978,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7018784092390529645,8552135863013594184,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3248,i,1549196463222067148,6609617993732951333,524288 --field-trial-handle=2232,i,17829567752826702577,15480576759673373936,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4f9d883d6d8374ad1d294a284948cce74e7284fac1a9f2dd1ebabac07306e868
MD5 118b54a60d4e9e5778d7f8dcdd228311
SHA1 4364b0c685c61ef37fb49909401205a07e4ac6bf
SHA512 05afeb7b62acdd617a4be34aed8707b53ca821230da99985b92470e32a09fe5d4c834542f7bcdfa21b8921265c16047c454aee1290fbbc833e75d80472c6ff70
TLSH
T1F1E020C404E4C37F9912645B615C470CC1D03B0BEFC8A94D170088C5B546240E6D9DF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 5fd0ace9c44597bff1b6dce67a4b47a4cfa15ff5150750e9eb509dd25404111a
MD5 50d8b063f194211f2a63cb7c43e1df06
SHA1 262eba864c21edaf5234479ab02edad9e6676764
SHA512 7ba66404f088b5b85cd0f2575fa6a85b72ae72a798642208abc4923b71b0097a198e898d151008a6dba96f066ad81e7a18a8f7d0ea59cc49d57615c8f91b16f9
TLSH
T1E3F02B5952E8C37E9E4391BBD98C425C84D2730BFECCD8DA63086485E506041B2E9DF9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e73efcfddb7c8ac78b3f60bf07262649574c4bfbb8fa3214509de7a0b9f3fe7c
MD5 06f8f945f84f019fd6687131bd49e0ca
SHA1 d7d90d0afc56d8bbd9e6d69106987dcf174817e1
SHA512 e8a46ae32288f99c5f8a86ee23433d62c8d9a97322616c5e3c9f46c0023e6a6741def276a0656e178e225529d47b7dc28a5b14cdb8a1fe2c303367dfdb7e04e5
TLSH
T110E0789456C5C33D99426897517C534C83C0371EE6DCF9C517048DC578465406BCDFB4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00022a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00022a
Size 1.1MB
SHA256 6fc1f67509091377fe2194068270dc02e4fd15c7d38b756ca4e529461fdb97fa
MD5 d62772384270df06bd792f2c577d6d02
SHA1 16c8a44e4c2a64b376c44a739a80e879cdc8d033
SHA512 bae20a3bd242fa0c8a25dba83ba3f9be6386903c2a6ab72538bdaecff3e722d1d90f31685879f099da013db60e43246389b101b6eafbe3b20c519a3f9b29b6b5
SSDEEP 24576:+ejEfxbBXOCzL+OUqGOj8E8kNY51JcpwfmxuC5t7wDPkW:+ejuxbBXpL+OUqGOKkNY1JxfCuC9wjp
TLSH
T1B545231358BA53FBE41B90A700974956F79D0714E7A43B9B81B4F17E2B90BB1EE38E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0002a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0002a5
Size 1.0MB
SHA256 e42b3dc98f50203370095b3c239f7fd1dfafaeb275ed52d7d5a7011eaf272922
MD5 815672ca15ae6be823063802c3335ffd
SHA1 daa11a6e5b6b6a5d2096a491c229cae3de76187b
SHA512 41933aa8b2fb71f5fd445dc50f3ec8653a693c391117b87b30217b518dbd8538642cacfbe547e5124439636ef88db88fb859829e68fd845c087bec8e547da3d0
SSDEEP 24576:2qcsKnZ0EkdFfet1Mxe9qTD6tWVo3D5MKCdzP:2aKnZ0Ekqt1MU9+9e3NczP
TLSH
T1A73523C3929868B7CB45D7521AE60C8D98DF30BEB96F48241F0736D1F6E9F8C142D64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8510579a67af2b9386f71dc7c91580b8b7bd6736a85fae79c8cf58bbaf921cd0
MD5 5c9b42e4b175dad1735c1d71af4b803a
SHA1 2c286614a22999bc230c508afd43ad7bebf9bf71
SHA512 fe6a88ee5421edff688a11a260273b542b6de0a326ce013c33cd7118bec0dfabc58377ba29190bc7c18cc81cfcf5c2bc1ba592578cc072fae95298218bd9bdf7
TLSH
T13481C85E1E46C063EF203635D1E1A5F176720C369E13BE46D098DC7C680E7EB42DAA88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4007181faa9d004120fda4299fa57daffb2b61010c7db45c6cad877deac5a667
MD5 994294991a56052337a0ecf877d43901
SHA1 3ffb5ea4302188a21e95fe2298f373c9539f158f
SHA512 522aa68abafc9e7bdb3b7842db530234f90fa53fd49fa6d466e0066749f028746b5fd8dee039fafc24dc931980687e942b6293af7e73cdaad85a7dc6d6265ee7
TLSH
T1E081FB5E1E46C063EF203231D1F1A4F576720C368E53BE06D088EC7C681E7E742D9A88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58adcf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58adcf.TMP
Size 3KB
SHA256 1e982ed0c329308c2bb5ad7f6b2bf1aaff79f03d238466b41133a9f45a39a17b
MD5 f1bd34f60ef4ea968499b68a90fd2e02
SHA1 5e63e7449cae519dc361d6a344e444a3fcd19cde
SHA512 bdf78e7f256509e5cb0379e3e956b5fbb1ad64ff49b0d07cc1dc874fa27021a287037aab83dff3f3cfedb4823b804dc4fd8bdddb5634f3747a35134cbbae9f2b
TLSH
T1FB61B75D1E46C063EF213230D1D261F574724D7A8E13BE0AD0C8DCBD580D7E7469AB18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 53ea519c0ff85a3ff7d629f052ba16154eb77de838ec08e25a9135617b344fa0
MD5 5df2edeb48eaf9163fb501a242f38840
SHA1 d19c449e50418c8668acab6701f188a84bf58d24
SHA512 7dca591b8c6e662b6d926a6414c6c0092f6e22bdb8597e58bc4c1263c0434096dcc5a53d61755b0eb0ac7d90ba6e3f9fa62e3bf038a44431a20a41fedf575f5e
SSDEEP 192:DudnXeKBohG1OuAnpk1sfOvSPUK6USuPd+1mR:DudnXeKBohG1O/npk1sfOvSPUK6ULPdj
TLSH
T15DE1B9F7C7D9C12D891166F4D712AF1FCE2E0A18432D3C2A88D8BE5B93E2431D21925E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9b817dbd67b0a138c0b3a4bc2035ef3fe9021db75cfa7ad5f9570319f14265c1
MD5 475fbc2158afd30f1501e44b3b20b8e0
SHA1 1b4e8f58185f1a9fb6ef983a0aa052143bbf0d07
SHA512 da13b8be31ccf2af654485a3841cbc80e8250c8a4aa33136f1a3430ef0b28202b7b721565d56fdd4f742947efdc6de9a1f1edb2458772d9b6ce1e0dbfb042b21
SSDEEP 96:D/OcqYt5MOlU2AjJoQzVk0BqzIdNPPudRwCjGj4/1fM9:DWcqYt5MOlU2AjJoQpkQqzIdNPPudRL4
TLSH
T177C146F783E5822D891156F4DB15AF1FCE2A1618432C3C7A88D4BE67D3E2431E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0ee01123591b03784886623842d8de8bb991f260a7669597908a5f5a17faab0c
MD5 15f9c0f9494b679257a44efb3e5ed327
SHA1 a2c7cde33736f5cece0f28adff1c5b23b819ddb4
SHA512 616e08bb0d1e32a3f0efd043f709084232f87c835e029a601dc2f76aa2a77a84b344fd17cd3869f1eb206f7f6f5e49e1eff598069fbf2fc5d9b6fa911ce22f88
SSDEEP 96:D/Ocq+YVt5MOlU2AjRzVk0BqzIdNPPudRwCtZGj4/huR:DWcq+YVt5MOlU2AjRpkQqzIdNPPudRLa
TLSH
T166C157F783A5822D891156F4DB15EF1FCF291618432C387A88D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a868591e3ed50c4db181dbcb4b54fdddef287cb6000a4adc4a84ee784275d59e
MD5 a88e405cb15f97959c6e0a19695dffa2
SHA1 54590b49329a3849e1473bd25c77cebd69c271e5
SHA512 e1ccdc2e9a9ca599fe5e2569c9158400bfd1c78b399f710149665f27310ee44f320bbe99534fb0f071c96a1322156a3a0b0d2da8daac946064f17edd00600797
SSDEEP 192:DudnXeKBohG1OuAnpkDXsfOvSPUK6G13Suotm:DudnXeKBohG1O/npkDXsfOvSPUK623L9
TLSH
T106E1AAF7C7D9C12D885166F4D716AF1FCE2E1A18432D3C2A88D8BE5B93E2431D21925E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 44258d34fd9f70cfe0e5f759e406d164b7bfde8286ef29095dfb15f296242ec9
MD5 51b9fda7f7af0a970e79c5fda947d9f9
SHA1 e186e56e54eaa04772246618cce24b40e19f2b0d
SHA512 316f981510f406c3c480e29ad3355e724be73951dd5e8071e9946689236fa6af4c07d8322880eb0c6e6eeb6b933427ea274980ea00a9aed055e78b142e9954ff
SSDEEP 96:D/OqYt5MOlU2AjJokUzVk0BqzIdNPPudRwCjGj4/Eqc9:DWqYt5MOlU2AjJokUpkQqzIdNPPudRLC
TLSH
T1D7C146F783E5822D891156F4D715AF1FCE291618432C3C7A88D4BE6BD3E2431E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4554040eed1d44d73cc0c5bb17c085b5970e0fc5287e68051cb59bb40f650774
MD5 8290437f2c09e3ef8f9827919798c9e1
SHA1 c36949599c1f5b1ff0f7c2cceaac0aee8f58a3a7
SHA512 5dd07551db02041b9500ffa530adbe8b63dffd32fde8a706fe49ed7dc0ea32decd12b580b7833984d1fa915bc5e73c79252ff7e6a5f915fdb28c73299cf9a9f3
SSDEEP 192:sxZbRRyM/jK1Ml8MkTJ/fBsRplEdp7AHW6+WNfkM/YHlQsKIgrJ:sxZbNMTJ/fBsRpOMHbP/B9
TLSH
T1DB42E7126A34A97BCCCFD209F955BB53D6F54462E2900E44AAFCDA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 12d61409b02d0b07efaede162f7ce28f0288a9dd63718a0827b180a2c25f8432
MD5 548a033affd88ba9758376d86e803101
SHA1 1eec7fb58cf8b0f11682ca92fb76f2463d06ee4f
SHA512 fcbb0c356e6b87dbfdcff54451bb2db6b731b94917a37b75a708f2136f62241f703ef9b1a6a70a5de2ec773acebf94da5ee2e796d7468ba18ab19c92094f29cc
SSDEEP 192:sxZbRRyM/jK1Ml8UQ+kTJ/fBsHGlIdppAHW6+WNfkM/YHO3n+KIg5TJ:sxZbvqVTJ/fBsHGWaHbP/BBD
TLSH
T11652E8166A34997BCCDBD209F945BB53D6F54472E2900E44AAFCDE1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c314d14cdfc35a44e65521c3c0e359c5b772405386e0659fa44606bd10b8ee12
MD5 bbd387da4896c1a320cef561f5288047
SHA1 99b45438aba5b0537a047fbf663344db228487dd
SHA512 e630cfec4a81b19af0afd322ff586fca15429b3db0d351f0010bc4be1bc91411a08896a802ace6b3712c64b8e2a484603e1890d30944d85c9dfb7a360f72a4b0
SSDEEP 192:sxZbRRyM/jK1Ml8MkTJ/fBsHplIdp7AHW6+WNfkM/YHlQYKIg5pJ:sxZbvMTJ/fBsHpWMHbP/lN
TLSH
T14252D8166A34A97BCCCBD209F945BB53D6F54472E2900E44AAFCDE1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1dd7f408e089cc584c1af5bd6d6c603adb70448ecb141dc559ac42d56c0b3faf
MD5 7a20bf984f93ed74ae0e73ae82a40d52
SHA1 6bce8b9207f93e58897e354b7c999990cce179c9
SHA512 886ae88054cd12c5651f1ab498deb5adab1e636dc64d56c1cd07f93e1d31356b68fc45b5924d48ae65f92e5dba6cea94ea8aedbfd3547d8bfc0fff537b45f801
SSDEEP 768:xAUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RiroVZ0h:xAUZYTMWvg0Pou1ja7eLZmR50h
TLSH
T193D20B2F280CCB7E4F844E9DEC266F963ED801CB9A584D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 62fb2476fc57ab09b644eb5914ff71aba0fe4364ca792720fdbf8edf9089f753
MD5 6cdb37386baed18a25da221c5c28811e
SHA1 20c5cb26792f32ae29cc1b9627c6a1b9aed5fad4
SHA512 b1a699b19dfe74baf65d5d8fbe7442c3ca0360b15f13fc618b255429e655e9068d535913d05739466a6a9f9c69d8bc4128c8b214c3a82911ff13a0231fef73ba
TLSH
T198212D895EA0894FF8A041B61176E5A4B370D8DC4B26E3136C2C32326F263593A5B6C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cae68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5cae68.TMP
Size 1KB
SHA256 77464896a61a7dceb681012bcfae02f522cd9cb4a2244e9049381029ed15244d
MD5 6bdfee69de78367fcd54c4e13a716a05
SHA1 6b44e21addf0fabba88bb419fb5ddb43f2749c56
SHA512 cc4ed3b91fc5868fae75690889656ed65b21637f423c193f575bf9c50a4889374943f3ffa21139a666bfbe7860297ba15ee3ba20222d4320ab62d11aa01debf3
TLSH
T18E21D08646D5490BF984517B1967B8F8B3318D005326F393A93D22794E25B8E5E4B0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 367f3be476bab3cafa70fd771535aca9ad85d3e3b5fd56232ff99232d67c9fbe
MD5 2f52725da595cb15dfe3d4d96d9cc05c
SHA1 a95a323c35970ac200f1d8d3a7e2aac7f12e43b0
SHA512 f3188dd18cdceef9390638d631784084e235b00ab6b47d537c98e381f3442597e9322b24b285e0e8ffd2e84b80b63c8b73e1db550e9a81d611d47739b94eed2e
TLSH
T1C4E0C0F73DFB1810AD7FC3D75471A4A405123CB8C64CAD8E00AAB2A310B23102806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 37a88f03481778716558a6ff43378b6ce7a35811da50f41a4f4c74c05503f704
MD5 ab25f10eac2473c3c74748af02599897
SHA1 db6751062f0e090567a5e69d1ec7ca59d527ab01
SHA512 03cf1fdfd07178118b5d25f0e6c05242ed7563f83a6c134813a47de39644a5da365e42be3181a7110cd22a9afa77ddcfd2767cb2bd96a1e0c123bd8e5d158314
SSDEEP 96:KA1eK2AozWKco+GjaKAQAx4fjxvPxWDGsA7xKI4ARxUJhe7PSiIgKNOmmoKTyGg:E0F9TbzCbg
TLSH
T183F1151271BB52033C3E2908A39AD7260F45B1D33458A56B7BA904B25E6BE345CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590fb6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590fb6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4298c2ab19cce922f1ca15dc92a1500d0ff57c345d975dc96ac76398abaf44e4
MD5 9f6329c2fed9bb8f1d3dbc56dece621a
SHA1 d3f7d97c66b423a7a6a73e3d52aa7586349af030
SHA512 34b9f8683e6a7236c2ec6c06cd36948e66b2c169d7925ceb7f233ae1dae5563b13c3de747f62a617f9dd25bccd6438a3b4e752ab6a6db62068fdeaa55a5f8585
SSDEEP 384:OZcIhsNnQFVmwzX5od+H8ykXHRXK9Li6Uq58bhP+wtPzNIBux:shK4ONHRwLwjtrNIBux
TLSH
T14E927C7568256C7B5DE7F185B80B33278EF89067E6C86B8096EC5F1D01EE5A8130AC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f627f028cf8cb8f0cf3606fee2c3dc1d732838c41b43d009908dd10d6149160
MD5 b205f159ea707ea147f2c78cb5e66161
SHA1 ba07fe80fe2107c6600f8368dc10acd822a9542a
SHA512 1d938ef5957453177f347ed8cb4ad76431bb6be29529ebf060ecf003a0774ae00588b99c4af03bc17c203c9a53615042dbd196b312fb78ceeb44a9c275d649f9
SSDEEP 192:yONa61VWQmiUyZ2gGX5Obd+jTjzoryu/ay3j+U6:yONa6WtgGX5od+H8y9q+U6
TLSH
T10602D835A9686CBB8EE2BE49B48737135FE42067EA546B80D6EC1B1C00D765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d3bca9a406972f89c030c57ece46b2ab3de4f0d800a106e59fca18160bee7576
MD5 3d044a45de3608acf3c8ad3fcd1a2eaa
SHA1 0d431f4dc1e134ea9cfcd6cc4e56e485b6296d61
SHA512 30f2783d9a2301842934c7337d98deee59524b69d885920810f1758793ea84fbb74535ef46291361ca0803317389132c6bfd8ddf561d3eae3a9087726cd0a90f
SSDEEP 384:+iFiZcI6zsN58TUNTUlIlRFVkwzX5od+H8ykX1RXK9Li6Uq58bhP+wtPzNIBux:VFQScwg84ON1RwLwjtrNIBux
TLSH
T145D23BF254D7543AD9AEA747A73E3E128EBCC063F5849A40B7985A1CCC5A1BFD309C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8cb2fffb937227a05bec54651fbe2859fb8e29f27cb6d38e41dc8c7ac911f69a
MD5 22e661317359c9ae455832bf073ff561
SHA1 3f34862a37123b7e5125deaac4e70b696c26c988
SHA512 1471784c8645f412cb958263002ed32e5095ebfe76e3c213ddf1a45179070e0ab9b0076af2b18925320bcf95d750cc26f31cb45bc0d8ec45371e7dafaa5d5f64
SSDEEP 384:7ZcIhsNnRFVmwzX5od+H8ykXHRXK9Li6Uq58bhP+wtPzNIBux:jhV4ONHRwLwjtrNIBux
TLSH
T1C1926C7568256C7B5DE7F185B40B33278EF89067E6C86F8096EC5F1D01EE5A8130AD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8d584926d17803c48cacef29827228af820d3e582c84254b5dfdd419f4ea6422
MD5 237ae6b88dca4c4367e93f230f528b6e
SHA1 a472756ef4404d51bf32a6acd20c9352464a2ea0
SHA512 7664f983c6050fe1d3d890aa8b8c013eaba9dfea2ad65c3afc95387ce6311c1a4cea3d906bfbd11904910e7d5a9dfe04ddb9d90e43f4c198ab939b355959f70a
SSDEEP 192:/ONC61SWQmiUyM2wGX5Obd+jTjzorykX34jJqqpU6:/ONC6vywGX5od+H8ykXgRU6
TLSH
T19F120A32B968BC6B4DD2B595B44B32139EA55167EB847F80D6EC2F2C01DF65C230AC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c115beed-b61e-4b99-a427-3efcbf436601.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c115beed-b61e-4b99-a427-3efcbf436601.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d1f1c1a2b3638cfc06e74901282bde1c7a0c47320ec88336aee1f500cdd7c21
MD5 d0dc8c90571ab13fe5817b2179d81068
SHA1 eee5e0fe12ac18cbf3762ee3a25e87e0391e6f34
SHA512 b9245868d97165d0e721affbc1104a691203e9f89fed8d39007ff0009be6742c808cdc3d7efd81012af6044959f759e93e74164d40710adfd8124940bc635420
TLSH
T154415A58A7F91144B3B76F5AAFF3A5AE487B7C332E06D06D10110E4E0A62B40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download