hxxp://29818[.]ru | Triage™

Resubmissions

04/08/2026, 05:25

260804-f4fbaagm5z8

04/08/2026, 04:30

260804-e4zjgsfq3t8

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
858s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://29818.ru
Sample260804-e4zjgsfq3t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302914488161912"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B0DFB451-E0DB-4200-8125-FA01A345068C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1636	3444	msedge.exe	86
PID 3444 wrote to memory of 1360	3444	msedge.exe	87
PID 3444 wrote to memory of 3960	3444	msedge.exe	89
PID 3444 wrote to memory of 3960	3444	msedge.exe	89
PID 3444 wrote to memory of 4884	3444	msedge.exe	88
PID 3444 wrote to memory of 4884	3444	msedge.exe	88
PID 3444 wrote to memory of 4884	3444	msedge.exe	88
PID 3444 wrote to memory of 4444	3444	msedge.exe	91
PID 3444 wrote to memory of 4444	3444	msedge.exe	91
PID 3444 wrote to memory of 4444	3444	msedge.exe	91
PID 3444 wrote to memory of 764	3444	msedge.exe	92
PID 3444 wrote to memory of 764	3444	msedge.exe	92
PID 3444 wrote to memory of 764	3444	msedge.exe	92
PID 3444 wrote to memory of 2764	3444	msedge.exe	93
PID 3444 wrote to memory of 2764	3444	msedge.exe	93
PID 3444 wrote to memory of 2764	3444	msedge.exe	93
PID 3444 wrote to memory of 2476	3444	msedge.exe	94
PID 3444 wrote to memory of 2476	3444	msedge.exe	94
PID 3444 wrote to memory of 2476	3444	msedge.exe	94
PID 3444 wrote to memory of 4608	3444	msedge.exe	100
PID 3444 wrote to memory of 4508	3444	msedge.exe	101
PID 3444 wrote to memory of 4608	3444	msedge.exe	100
PID 3444 wrote to memory of 4508	3444	msedge.exe	101
PID 3444 wrote to memory of 2368	3444	msedge.exe	103
PID 3444 wrote to memory of 536	3444	msedge.exe	114
PID 3444 wrote to memory of 4320	3444	msedge.exe	115
PID 3444 wrote to memory of 4272	3444	msedge.exe	116
PID 3444 wrote to memory of 1644	3444	msedge.exe	118
PID 3444 wrote to memory of 1644	3444	msedge.exe	118
PID 3444 wrote to memory of 1644	3444	msedge.exe	118
PID 3444 wrote to memory of 3340	3444	msedge.exe	119
PID 3444 wrote to memory of 3340	3444	msedge.exe	119
PID 3444 wrote to memory of 3340	3444	msedge.exe	119
PID 3444 wrote to memory of 3016	3444	msedge.exe	120
PID 3444 wrote to memory of 3016	3444	msedge.exe	120
PID 3444 wrote to memory of 1500	3444	msedge.exe	122
PID 3444 wrote to memory of 1500	3444	msedge.exe	122
PID 3444 wrote to memory of 1500	3444	msedge.exe	122
PID 3444 wrote to memory of 2752	3444	msedge.exe	123
PID 3444 wrote to memory of 2352	3444	msedge.exe	124
PID 3444 wrote to memory of 2352	3444	msedge.exe	124
PID 3444 wrote to memory of 2352	3444	msedge.exe	124
PID 3444 wrote to memory of 3980	3444	msedge.exe	125
PID 3444 wrote to memory of 3980	3444	msedge.exe	125
PID 3444 wrote to memory of 4684	3444	msedge.exe	126
PID 3444 wrote to memory of 4684	3444	msedge.exe	126
PID 3444 wrote to memory of 1580	3444	msedge.exe	127
PID 3444 wrote to memory of 1580	3444	msedge.exe	127
PID 3444 wrote to memory of 1568	3444	msedge.exe	131
PID 3444 wrote to memory of 1568	3444	msedge.exe	131
PID 3444 wrote to memory of 1568	3444	msedge.exe	131
PID 3444 wrote to memory of 1468	3444	msedge.exe	132
PID 3444 wrote to memory of 1468	3444	msedge.exe	132
PID 3444 wrote to memory of 4768	3444	msedge.exe	133
PID 3444 wrote to memory of 4768	3444	msedge.exe	133
PID 3444 wrote to memory of 2856	3444	msedge.exe	134
PID 3444 wrote to memory of 2856	3444	msedge.exe	134
PID 3444 wrote to memory of 2856	3444	msedge.exe	134
PID 3444 wrote to memory of 4272	3444	msedge.exe	135
PID 3444 wrote to memory of 4272	3444	msedge.exe	135
PID 3444 wrote to memory of 4272	3444	msedge.exe	135
PID 3444 wrote to memory of 1736	3444	msedge.exe	136
PID 3444 wrote to memory of 1736	3444	msedge.exe	136
PID 3444 wrote to memory of 1736	3444	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://29818.ru
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffef85fc188,0x7ffef85fc194,0x7ffef85fc1a0
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,15429201028189585485,257670175856936178,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,12412521478845277598,2162136877499224892,262144 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,7439089201590187142,2973388610297718196,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15469535715808212359,7095808423732270338,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8398872041607611562,9634417588500253510,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,10370407993171253557,6160133406647983145,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,18316456359260114541,17024245710600838887,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,9411891387846718880,3581055606445213921,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8724008253767837912,14419150050166311619,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17903329583911899098,9053652740802309442,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17903329583911899098,9053652740802309442,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,16587679630294015288,308248071809994308,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=660 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,1778254551760734694,1072141805340225198,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16754145910986145595,100879147972477319,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2624,i,14913083719994357244,11362783806925632896,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5108,i,6078653726345136054,5025551855852945393,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,13857708076794778119,8455852051698607969,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5168,i,5042752174582954885,6072877175668920865,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6272,i,13531106351270566206,12673971553583017068,262144 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4792,i,12510777752304379153,8938124857745506911,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,3146729791885725967,3294001465123606577,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1172271012205712691,3631131555403723597,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,15570777302123123921,7495917945694381514,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6252,i,10058892996555677884,1809230374727669383,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,13010081051699375073,10832928196715301670,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,9561820026581332443,8890700724095839728,524288 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5200,i,3831397735371120003,3914673762454490098,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5332,i,15510043349138158470,17827839540242489424,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=1504 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5168,i,13459469159466815021,4484391446002345599,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5200,i,451806576804297363,10432926082540607289,2097152 --field-trial-handle=2308,i,12621211929569589759,3737681162567442724,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 bd0ae95f256eb57715b02cbdb06dad3c4441bd8872385bdd368d59d1c61d5635
MD5 e6b6eed10fba8fd6aca4d5017c8d16b4
SHA1 549872934f9b3b8ce7910de9a0ad5eef30a19fa3
SHA512 0ec0e7f7966f69059ed353d199ff903ea6a43c8f8d5d505ae672ceebb6de849145864a8ba40bb8a1f40548259b007245ef0e4f9e9bd62512d06e9de2391732f2
TLSH
T1CBE07DC844D8C2AE9609A54B62E87B0C82C8370EDEC8FA8B773485C874015C0B7E2DB8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 2f1c68a9047d661587ea71f304b3242dd0284257a3c4d87ec31a62a804bd3e6e
MD5 510f1d2d8627b6a728d2c384f2b27ce7
SHA1 6c78da4409fd0587ad7b7ed8c332c03bd521930c
SHA512 d0d6380ba221dc9cf8de7cbc402ca857d8b5cfc14f697c42f7805651108850aa54ca7152d5ebefbf1e62944e0e3bb4148f6d18982332307d16da15aeb9a1c6b2
TLSH
T155E0D8171AF4E1AE4503D747F06976945092F30DFD8CCCDE3A3875CC24400014369CA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9e98fdf9e95a00413632d4dcf92b802faa93dd2122cfb983974e5a474adafe01
MD5 efcdddad32c0cc6567359f8aa160e74e
SHA1 33b121bbf5896cb8c088e8ab211bcd743a4f6f17
SHA512 babf848d4cf0849f5ffa13d45bb977e73049223e2f91ec4c6f47e0908d0429dc5c4cd0e326827b132bce3833c35c546db14b85f235467e5fca764aaf162ab70f
TLSH
T120E026C406CCC3EE9601A547616B530EC2C0370E9EC8E98A6724849C3202440A3C2DAA
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a09d2d7eb1e84592a03dfcf481abfcd93d92494712f3eead421cad52436ea3b
MD5 a1ae6243998338758bee7d1268c7c96f
SHA1 ba06e7ae50fdbf73d8d04aae9d4414c11d08c1cd
SHA512 84b8d1d09217110bd7944bed61d0d9b0593020b516c8356e5e3558b835fa62e3c284af9d4c2e7a6a9a3f4a934cfad13a787e1afc6f26bcfcaf82999dc0e19da7
TLSH
T14A712939C10E48A5E7D1133291E20157B87D82DBF803FE8552A0BBB757E4713829EC87
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a5c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a5c1.TMP
Size 3KB
SHA256 2e5331f36dabd899f911d7ca1c8a43b6f51596bbd88a85c881ae475585e1ae60
MD5 859e8886222be9f8b47e67849d25dedd
SHA1 659af16dafbb87cc5be9e543f999b3be2ebdf3bd
SHA512 5ae30afff57a325096fa5491b148cdaa02810c5e4dbac8c9103894157092f4f7ada8686a4d7812d9e0f12c1615224ea174dce442dbb64fad53c3609212471b66
TLSH
T1DF713A39C60E88A5E7D1133291E10157B83D82CBF803FE8552A0BBB717E4713868EC87
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0fb915ae9a2dae8e01f80290b33a46d580f76206a446ab8c40f92a35a08655f9
MD5 e3e607f517bbd6b1714cad9205482e1a
SHA1 f596e5b098a786b48936deae1c2a32f7947ee2b1
SHA512 79585f20037f243ecce0d5e169de3729549a38a4e369445861cb206196f4f2769da4723a3251ffe99bfd8b2b7a5ce050608f4c44e5561aa7476fc28379bc705f
TLSH
T1D6113DF3C7D595AE891116F05A28AE2BDE2D0606431C7C1A85D4FF27D3E3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 4ef7e05db9b43b7e375620365baf74fabf4e58e9ccebc93f34b482f751d45b5b
MD5 351614a055346ea6847fadfc5c5cebdd
SHA1 ae5ed854ff87b9bbc35833c09ca9264efc54405c
SHA512 fd98bb62a2aa39cc383418c754073ac606ece0b5d138271bec5a51d457ec6694259fcb80a16659b7bd18790305d287c64bf4ddc74f8d526b2d3b109fd9994c00
TLSH
T18E119BF387E1855EC91116F05A28EE2BCE2D0602831C7C2985D4FF27D3E3035E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5bbcf00a77af6d7cb961f155a5c99d7b567dc0d18ea9b36a9d0f5cec62d7829c
MD5 9ede5211597bc45b5e03388e9205930f
SHA1 0e451c6b93703d9387611650f5e8c8b6a418f07f
SHA512 b4ac05fe6290fc64a0d479e15a9b52fa088bbf3ffa2b1584d218c5b7559550780a73a0aea26a537896b430259fe04697ce2c5b5ab99b285f94fc9aead71ea7e7
SSDEEP 192:sxZXRGyM/jK1Ml8Mkn/fHsJ3bRyIdpJH5K6+WNGYzc6/YIgrJ:sxZXsMn/fHsJrtJHFGn9
TLSH
T1D742E7116A34A977CCCBD20DFA45BF53D6F90573A2940E44A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 18cb78b2fd2bddedb11e512f7d1a30cf8eaa055dade95cdc704bc0ac0b4e109a
MD5 0c6dbc690a9da5c74e62d12a93fd6953
SHA1 bdfc58e347eb5bf90b95f67bfebc05e0527b49bb
SHA512 daa831bc5d0d00d14e6177f6b344dbcba09c73b747913709e86506eab74135f8531a46f1f140e644457e30f07033ba29185e1f45a825b7c5c1bb836ddf211b6c
SSDEEP 192:sxZXRGyM/jK1Ml8UQEkn/fHsy3emyIdptAH566+WNGYzAJ/YIg5tJ:sxZXsqfn/fHsyu+uHlGyx
TLSH
T1EF52D651AA346977CCDBD20DFA41BB53D6F5447392940E44AAFCDA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f452ec01aed8291e7d7d20bf71d1d64878408a8171ced438aeb04506c07d2de6
MD5 cfd9e31660a4ec5b7b62deba6fe33847
SHA1 d95982ff417546b191b1706473cb17e2a3ca55dc
SHA512 ac62402a6e2fff523d021c38fba614a5a370584cfbdcc8588af68f6635b23b6523434dae698e16f800efd875f6ed7985919cb87ffa3bceb8809cf4fd7eeba14e
SSDEEP 768:n+W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjAroIQiSYG:n+W7kf0Wvqidau1jaa5LA3jL4G
TLSH
T1E2D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d1f2a83c6cd3bbe9330e3d8b2513bf879bd6476ec23009a1a0dcf42c5eb5bf32
MD5 740e6e7debadcbf86dfa5245f59bf834
SHA1 94e5d9fb56dc5a0fdc2d4df3681856da3255f993
SHA512 86654d995ab3971e3fbe6f065b7835ce7e78c7d2204d6fab2c01acfcb2d25049733492dc9bd8984ff0135054506246a1ce10133519130d47b08a475aca72617c
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTWVce7I1KcEI7y1BItKC4ALFGFNFyFWFMFQFUFkEFQFh:KIbCKcWVce7KKcE2WBiKC45tKKJ
TLSH
T1C291851AB13A1201387E6C5CA26B86775F4372933114A4AF7FB854A70D66E124EFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5944df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5944df.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 63f024d8cc7760f8305652eae3d60655f466edd60922678daca07d7162597458
MD5 7d596b987531a7f59ffa7da37425297a
SHA1 2a73b99523731d652b0329397650e243966b44d7
SHA512 b7eff6e6cd733cbeeeb0e31fcb722ed904216ab7077322a01979ab2da530fdb6f758eff5cf79b36a788936247aca91597cef48a163864ddd0cc4ee579fdf02d5
SSDEEP 384:2iFiZcIJAzsN38TUNTUlIlUmjWbSCUzd5L+21rHn/XEKqfPbQEiJflBp+q+OBus:dFQSuwgPjW5mrl1zn/XERPbQEixlj+ql
TLSH
T17AA27C335C74D93BAEA6A646F44A32138FF881B7D6C4EA50E6DCEE0D019B59C1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f9977f35af6f66b7c8e44006bde2259cdcd646e2c081c71bdc340151afb27b0
MD5 b08fcf0c1656f785578450fda1286f7c
SHA1 7b7b49398b507fd5ba4828385f8b136fa008d98b
SHA512 2a35491fb296c2a587da2c82a5ab8bf3ef86ec31fdb613ef1d81aa0a688ff170e6c2b34fd86f7c8aab90e54db637b0ae1b1313c391228c062fe2961f012bffc7
SSDEEP 192:MONT64BAQmiUy317W5GBPKRV+FdGy5LaDrHjvPSU6:MONT6eAINWcd56rHzSU6
TLSH
T1650209356C797C6B9EB2AE45F48737175FA8117BE6905B44EAE86F0C00D768C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 51e5c084f975cd59ee3bbd9566eb69a96f4c780f7ab43908f70dafebf056bd35
MD5 b55a1579f7074e206931be46ff52637d
SHA1 1a9ee882bfa02777d87dea5928ac2a02985c51ee
SHA512 a2c7939772de0fe4b42a9291554531948d95b309f9353b69d835bc98465e0dc6cf7e6f10719d3a464a906e7590c2caecd4e4af30a25213b975baa9d5158d2bfb
SSDEEP 384:CZcIhsNtnmjWbSCUzd5L+2GrHn/XEKqfPbQEiJflBp+q+OBus:whljW5mrlGzn/XERPbQEixlj+qNBus
TLSH
T1A6928E325C35AC679DA6B146F08B76175FB881B7A3C49B40E9ECFF0D01DEA9C1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 924187f302dd555a30a15f8ef6251ff1b2ce01ce39e95321c115e9ba825cd63f
MD5 6095103bb075812564fa1f2e55d508f6
SHA1 9058bd104315b9242855530dcbb486a9937bbf5b
SHA512 99c25786e78439361dc2512bfa049606c6d6aaac218392a794bdc08a2b74fa6deb91b1732ef9e6fbd4c3e330c30a92341514b91e8e1254f36dcb7091626173d0
SSDEEP 384:9ZcIhsNtUmjWbSCUzd5L+2GrHn/XEKqfPbQEiJflBp+q+OBus:lhcjW5mrlGzn/XERPbQEixlj+qNBus
TLSH
T1DD928E325C35AC279DA6B146F08B76175FB881B7A3C89B40E9ECFF0D01DEA9C1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53b3287c0da575545ed371c9c7896efbc47fcd8a0136a8aff36883a9b1c1d949
MD5 26deaae43a9380f14cd0dfa02fc30242
SHA1 511b58a8c28d5c26b45ae7ea122e794792e222c7
SHA512 e7a02dbd7b5f9c44e2b50725c520e3fb00702e851fd07bbf2eef73f8a7e90d3596ced0c212dd748bbb3444f0d566e61e7bdb9feb566260aaaca1f1c11c3c74e5
SSDEEP 192:bONo64BjQmiUy8705GBPKRV+FdGy5gk+2WWwrHFqmU6:bONo6eVB0cd5L+20rHnU6
TLSH
T112123C355CB4AC2B5EA2B545F08736135FA8522BEAC5AB50F6ECBF1C01DF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

251d11c8-cd6b-4121-9fe9-825fd6d28fb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\251d11c8-cd6b-4121-9fe9-825fd6d28fb7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e9a7afd33eedc79a9636bfc9318b8f312594c8078a6091d55e2023908084076c
MD5 bcd8e77891512564092ba08055362706
SHA1 8ab12bc21174b8d21c27832af9ab2942f06ee171
SHA512 1215b6b367461be857a9c9bb9c1fc177c312f72fe6ffa8c6daf4e81ca11ea0ce195c34a1efd411512040f00a5a1ce1fdf8ce14df70abbfbcf87c975f69e2a9c0
TLSH
T1C5412A98BAF91154B3B77E5AABF6686D487F79732F06D46D00010E4F0A62F40C961737
MD5 SHA1 SHA512 TLSH

Submit Download