hxxp://tse1[.]explicit[.]bing[.]net

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tse1.explicit.bing.net
Sample260806-rphnmsshqg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
372	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304997291422089"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{E5BE257D-9044-48B4-9A1C-4D148FB3631C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1700	4508	msedge.exe	85
PID 4508 wrote to memory of 372	4508	msedge.exe	86
PID 4508 wrote to memory of 4876	4508	msedge.exe	87
PID 4508 wrote to memory of 4876	4508	msedge.exe	87
PID 4508 wrote to memory of 4876	4508	msedge.exe	87
PID 4508 wrote to memory of 3228	4508	msedge.exe	88
PID 4508 wrote to memory of 3228	4508	msedge.exe	88
PID 4508 wrote to memory of 4740	4508	msedge.exe	89
PID 4508 wrote to memory of 5032	4508	msedge.exe	90
PID 4508 wrote to memory of 4740	4508	msedge.exe	89
PID 4508 wrote to memory of 4740	4508	msedge.exe	89
PID 4508 wrote to memory of 5032	4508	msedge.exe	90
PID 4508 wrote to memory of 5032	4508	msedge.exe	90
PID 4508 wrote to memory of 4716	4508	msedge.exe	91
PID 4508 wrote to memory of 4716	4508	msedge.exe	91
PID 4508 wrote to memory of 4716	4508	msedge.exe	91
PID 4508 wrote to memory of 1244	4508	msedge.exe	92
PID 4508 wrote to memory of 1244	4508	msedge.exe	92
PID 4508 wrote to memory of 1244	4508	msedge.exe	92
PID 4508 wrote to memory of 3812	4508	msedge.exe	96
PID 4508 wrote to memory of 3812	4508	msedge.exe	96
PID 4508 wrote to memory of 3812	4508	msedge.exe	96
PID 4508 wrote to memory of 924	4508	msedge.exe	98
PID 4508 wrote to memory of 4396	4508	msedge.exe	99
PID 4508 wrote to memory of 924	4508	msedge.exe	98
PID 4508 wrote to memory of 4396	4508	msedge.exe	99
PID 4508 wrote to memory of 2640	4508	msedge.exe	101
PID 4508 wrote to memory of 2344	4508	msedge.exe	112
PID 4508 wrote to memory of 2344	4508	msedge.exe	112
PID 4508 wrote to memory of 2344	4508	msedge.exe	112
PID 4508 wrote to memory of 1656	4508	msedge.exe	114
PID 4508 wrote to memory of 1656	4508	msedge.exe	114
PID 4508 wrote to memory of 3288	4508	msedge.exe	115
PID 4508 wrote to memory of 3288	4508	msedge.exe	115
PID 4508 wrote to memory of 3288	4508	msedge.exe	115
PID 4508 wrote to memory of 6020	4508	msedge.exe	117
PID 4508 wrote to memory of 6020	4508	msedge.exe	117
PID 4508 wrote to memory of 6020	4508	msedge.exe	117
PID 4508 wrote to memory of 6080	4508	msedge.exe	118
PID 4508 wrote to memory of 6080	4508	msedge.exe	118
PID 4508 wrote to memory of 6080	4508	msedge.exe	118
PID 4508 wrote to memory of 6092	4508	msedge.exe	119
PID 4508 wrote to memory of 6092	4508	msedge.exe	119
PID 4508 wrote to memory of 6092	4508	msedge.exe	119
PID 4508 wrote to memory of 5620	4508	msedge.exe	124
PID 4508 wrote to memory of 5632	4508	msedge.exe	125
PID 4508 wrote to memory of 5636	4508	msedge.exe	126
PID 4508 wrote to memory of 5992	4508	msedge.exe	129
PID 4508 wrote to memory of 5992	4508	msedge.exe	129
PID 4508 wrote to memory of 5680	4508	msedge.exe	130
PID 4508 wrote to memory of 5680	4508	msedge.exe	130
PID 4508 wrote to memory of 4340	4508	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tse1.explicit.bing.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3437784215948365731,11707004279230322577,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6610948057683670768,12272528973430945488,262144 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,4012291898237579771,15174068701301357164,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5255515426832267496,15327393061378944448,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9080913009977663897,17823707687910571062,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6003932843352287957,5476680319756914329,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,18424739886565563940,530103394214843868,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,15396294623402198198,15500821751749558118,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,14197350057724934201,16574404372985226738,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,8407310737877304609,12521220924395833449,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13819425041731419864,18388156346358305559,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13819425041731419864,18388156346358305559,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4836,i,7346059023685318704,16856654975776026186,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,7314487511174854100,12124709806178203462,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5916,i,2256957919171033519,8966059276608131920,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4464,i,8398875559605003020,1041753084711379103,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4768,i,256253986540993375,9110817579851780573,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6124,i,17218822351620890864,8711025625867587436,2097152 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,8108962093351438468,15351724376447199986,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,14460506724868369518,1490045588407322939,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,9839366105054056831,10666897213387679602,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,9970866753541299099,7466998576760840952,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,4811837888409460564,2877730093032633615,524288 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5760,i,17268042158790631210,641439394717876711,262144 --field-trial-handle=2228,i,10029711419219713695,1517122943286413986,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 68KB
SHA256 d57595fa250e885e5c20572a24bcfb95db9a488a89cd7c702763b483abd28a66
MD5 c82330869a91007bffdf44b4dc71a7dc
SHA1 7ae45d2c48db838cfbca4be2b503283aa32efb7b
SHA512 f4e75e29e08ec30e596dcae8b195c8ce8aeea3d07a4479c8da06c167c019bb8f07a5da70850fc4c2f5bdcd619dd9d3e621ea7c12202cc79e7d4a4cfa36af0673
SSDEEP 1536:viBhuVtgXan5fzAzOz6iuHdZl6eP+eUViPr1O+sih:vi/XW5Up9SO+eB1Om
TLSH
T1E26302773D91A313B54A09D60B74719C1B386A9F0642BD2C32F6F962317CB8B69F9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 405KB
SHA256 af11c5d2374cd8fa7cefc5be9c78f97211e0b9c3ae3605c35ce843e2c540240d
MD5 63d15bbba31b8c110f9dc44ceb974fdc
SHA1 f633cdcd45232cc0d5f1fd98b6ae0545069371a4
SHA512 feb6072a99b34ddbce9f9dd1c8c5e1cfaab6d7e4aa61dcfef514aab9534c6f4c0991b3aea447f152d2df72645ed5c7d31692212825a47030c1a039b6a3917db9
SSDEEP 6144:TFSrFg2IHB/y5xSTX6XxgVyVrE/iFJnmHNsXvKihMOeB/5ZqzGa4HO5JY26cYtmf:A8yDSFVytEqekvKiK/ba5JY2eKJ
TLSH
T13394238F54906E3C6B9B0E91A49CF7F2376536C3063DD05EC81AF9C229C9105ED99FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 78KB
SHA256 be18ee476965bd3081ebb3f7993f6a6712d9a69fbe4d3b0adf8c7306cc21e124
MD5 15ea7d5d03071287a062016e621de22e
SHA1 6bd5b5c99b4772cd3e4af4d7c89a383ea0fdc289
SHA512 7331e43ef8ab600957e86e8a4c699ad42ea219f77db00dac07bec07855a15b33332b3a6868abed1de69d97d43e5cc7d914ae56e12f7abcc0e3a12db27b6e35b2
SSDEEP 1536:DnGAzzjJzv9t97/8RBblIWos4Tyl210qrWa9UXIvB:PFzr97/EPIpsgD1BX9UYvB
TLSH
T1ED7312341503FB87C78BB70D5A43502B0E0847E7D5914CB266ABB335A145B9D6CEAD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 16KB
SHA256 5dd1c64a38698ff8aeff573794977443121235af418dd9d2c79a5314189da2aa
MD5 0831783dce7c9f7ae3d19fd7ccad5d46
SHA1 c7f7075a6292462d90154ac8caf8478be15c0f97
SHA512 59f84adfb930ab067495343b59be6767569ffc0279f05465c0a622f6e59212175ca1195e64b7c29a88d1a40bd0c56fd735c7ceec28ed9c897fdeaa11250a8820
SSDEEP 384:velXJoyRu2nLAIAboKufdRAq1+91p2ky36j3NYmG:mKyRf8xbbu1RzMzFy36hYj
TLSH
T14172D0D6272DAA9772F5F44D20AF2A9B12805733DB98843350771A366BC64FCC9607E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 60KB
SHA256 973d7c4cd91c428490204d4647f283b60daacc9ff0e8c83bf8c1bf994528602d
MD5 b96f8d90119f9f8307274adc5695da21
SHA1 57e36157b36dbc401c5701d0e27ec2885193a4ae
SHA512 e267cd9d04f6ced28190e549640aa7e08060673a0f616b7ade1ef3aba4f7c8ef52a082266ec362f42ad2bf3982141bb8476e4be4c97ef8c40248a1d9e25efea1
SSDEEP 1536:G3gKQfQWtQJzaGw3WZiWX0K1pFlvnC2c+6LABHgO:G3g94oSZFkulqJ+6LAZ
TLSH
T1895302A1F19608BE6EBA88B35DEC427A99F9F4E653D66D32D54F124021B8821D937C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 72KB
SHA256 d34fece7fe088e24379899d2a4ec66cb1e4c4d464866d75a6304d08456611cf8
MD5 95ee7deebe14c576463eda99fe518d77
SHA1 9aadbf90c01952c279f8149d40464a0b59213c95
SHA512 44e17c1f8c1b3ab4e8ba3df3c71d3e22e6133b810c74794d4423cb590f6f7b03f72daea1c246143367c4b7d40a81a13b30a0bc9158ace290db1edc02441202f2
SSDEEP 1536:+tQeYGgtKAvmyggmPjb6xX6Gjhka5mDF6SubVmfuDEDRcQMp9KB:8hgtvmyg536xX6Ta5bEKscQP
TLSH
T1D2730201B5C409FCE6168ABE999DDFBC5C6066D4F3BFBB961422264627721E4B1CCCE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 68KB
SHA256 9e4788840f43b463a51534f036f6bd9a36e5293bd6da8e4654b43e1d83714d81
MD5 0032df338799c529f8900ed1df3fe473
SHA1 3552463fe133dad96c5fbb369d3225e51f729c51
SHA512 15265ff935bcd4e70263c233fcc97185785291a454838bde98267e26dc2143af16720dae70710ff0149a783ffa484ca7478ae76fc451fe2743c2c1069d7b04e0
SSDEEP 1536:U6UIpg9QPWEgHpuRQAPmrc930G+7F4rwzk50fpuMSKlZh:U6LO9AQy+GnSfDS+Zh
TLSH
T12863129CB8B56F8C40B28EB153ABA01DD306C65DC47B93FAC214B64F029D129A43769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 61KB
SHA256 300ab06fa3ab93bf62406e4c6f56950cbfe38716910a90e8d68a05daad52c6e2
MD5 7088bba2c986ecea3ad754d835666d1c
SHA1 065b000a0f370c39295cd8d064d7fa5a495933f1
SHA512 29ecda82668f039ae1306caff44fab2442a0e965a8b962998e72f4e96f2cac8d0eb6c74e63d436c6e34682e1ee9ea481b319057d182a1f7c2f0f38a4e7ac4c67
SSDEEP 1536:ec8R0HWk8YHa/32tRok58aKuTHYkmmRECDpaXtPp:1g/2tRjKuTxmoXDwtPp
TLSH
T1D2530270744C44AE843D07711BE11455AF9B602EFA03FCA94D7BB4BD94B5CA25BB60E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 38KB
SHA256 c6055b57d5aee320d1e4334dbce0ee8afb0b5e006f0290bc41236930848c11db
MD5 2d888bcfc3a3c36fdec7a01e9d086cc4
SHA1 9b39a3f2bacf2a489f910ea6517d076f95ab5a3c
SHA512 8231c95001a06ecc3274b44640b582f935ec21344b501a622711795c9d89f7d3a08e0c84f859b22ac7af8a37a43bba9dcfc4dd1eb9ff0286c62688c2f53b4f74
SSDEEP 768:msFkD7e9LVxiDhJDi6JPH+0749gFkpIVqNlpnPN50VrEmctTNGiaZqj:RiG9LVx2PDi6o0s9PzN505UJNuqj
TLSH
T1AA03E18C9B5D00A81FDADBF4992E25CD9114387190A1D4F365FAFD450AECBCA13DF650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 bf067356ea46ee6270662cb1e46f803d190482c931130a5f2efd2c3f89ba1a4d
MD5 24d0878af9922f58fcaf77d1b00c5ad9
SHA1 aca3823e6afaeea3a5597b1038049f6e7d5f32ca
SHA512 111784f42322b08901cbd916f53096eb05423a490626a2fe75ef752b2caadbf47667b2c8b218740bc393dd75953420f12fe203d4d7c93bdb432ef04748bde697
SSDEEP 192:BLoKrWWfvZhuBzPdrmTn14p2+Gg5dSQVpv4XcGAtj5kCttVRmvQUGnmUM37AlM5d:B8mLyQ4+Bysv
TLSH
T1ABF11F4749E5FE67CFDA91F0F2E94A9875B192A31C432FC349E8983D24DBB871882215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598b7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598b7d.TMP
Size 3KB
SHA256 a2c35fa07400af308b59f94f00d7ba80579939b59f8adedfef0447dfdb9c82b2
MD5 a209fb6b54dac920d87c20318c77405d
SHA1 c50a9867bea2aa1bfa5166bfae4b8661038cc759
SHA512 296d21a8f0fa08d755b24889a494a4bdc0f36e4a75681f74f0da2d63a57cc41d597e55f730f1bf5da485e712fbc4c0c2b601717d265fa707a703d6ee811b7c74
TLSH
T11071A20B06593E95EFE71470F3EC420D38F283F94D632E661DACC87D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 7794d20cca8dfa8f537800cc96f1e9e02fc913bcf9bba3aae6212e58555ea3d5
MD5 e8439d190b5e537d6867d664abcdd680
SHA1 3658624631ff5744cb8b8069023d92eb033d153a
SHA512 89bb213c49ece30136e5e2d262caba0701e63f024586ba9ee120dc61b079f8afb1b780591ec3b7dff46a217c4e7b5823de0f78225cddafb8ec36c2201173fab2
SSDEEP 96:DoO4sMuyVeRbzBpjOjAbN6Ip3fv7gGOEB5c+IcgFGwK8w9Gk:DT4sMNVeRb1pjOjAbfpfv7g7g5c+Icgg
TLSH
T10EB1CBF7C3E6826ED91191F09A18BF1BCE1C0556436C3C5A85D8AF0BA3F24B1E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 3e3dfd1e1f0baeaaf839cf06d985a611167aa1dfdded7f5dd2a8932900833787
MD5 82558b7a2c58f755dac03bca5741f52d
SHA1 316ddf5ffbc8c1d145c7f1b5a91094f57cdc9fd4
SHA512 d0fc61445fcef19d7e6ca67789238f5822691deb312b3679152c5f3923abde2187da597fe08e2a7d32336a05c5ae4519a8b4031216db5794cafa3b5187167a79
TLSH
T1F6D02363530530B6E55D3FC55057FD8FC33640510D83DDD511D06559153545D4B17144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe594a8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe594a8c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 667346e3cf02fb8e9ec6785894cdb5dce48c66217ec1e8ad54cdebde05a0e2d6
MD5 1db0883d17395b505dd0fb7795e4177a
SHA1 182ad2b1612c066331ce423ea000b1b80b4468ba
SHA512 cdf2116784d67294079dc54d80ad29f954aa60b6fa8fe01baec3b7c33d375814df4fca5fda30f472977b97c5023933eacd2b00319aacd6c69c031ae94258d99d
SSDEEP 192:sxZARCkD/fzs3dQIYbrUfpIEHW6+WNMng/Y4joiNIgrJ:sxZALD/fzs3de8BxHb9/T9
TLSH
T19F22C6116F38A97B8CCAD20DBA19BF53E6F94032A5D01E59B6FC951C04EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8308fbcaa5740f3910b6f905e00b9a1166d4d0ef43d4d3b1cf2328691522de8
MD5 761cbead1d9a16ecc6e04fa7081c1ef6
SHA1 156dff3cbcb607e9fc6106bc00c71018c75caf2a
SHA512 3c0d32b540221f36c2984d70efbdeb28245a76ed3461c6208d682dd23ac1985fc518f1488217dc0945e9fb51fddffc6b44f741901a5a1ff31a2ba11422d3413d
SSDEEP 192:sxZARCWOD/fzsedXCTKbZgLdYbrUfpmcAEHW6+WNBcgArBng/Y4KaoiNIg5xJ:sxZAJOD/fzsedA+gy8BlHbOy/NZ
TLSH
T1E142F9026A2869778CC7D25DBA19BF53E2F8003295D01E9DF6FC991C04EB6DE620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e12c92d122f056c7294572ceb8771a1e795e9f481783d3366a46db3842d25348
MD5 dee8bb09e2ba349391450c09c5e4bb7f
SHA1 964aefac49ea19de949be13999019e4056691953
SHA512 e948bca477fee417ae5d195840f367558d74bea8f37a9a327fc456a530d523c1cde05064d5c634055de4a66f0e6794f08cb9aa50841802d27551246332d251aa
SSDEEP 384:sxZA3m1D/fzseszMSgP8BNHHbCyU/ErIH:so3m1D/fxszMhkbHbEpH
TLSH
T14562E952662499B78CC7D65DBE35BF12E6F80022CD914E5DA6FCC90C04EB6EE320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d86145d55e956b35d091753b4e178208fd793f142843a7916c321f7ffd282633
MD5 c1edf774504d55229c3f437a34af396e
SHA1 7266690bd6f4e5c574b0dce24f2f03df53ceef16
SHA512 deb25aab52582818f0d1a15f68754c6fbe792ab24f081f7b5cff7ac3c2fc5b80ae66f86803632e9aaeead1f27132daeed891aa362bf44b8abd63b5653938b76d
SSDEEP 768:4zqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opTnroSeUni:4zqirTNWvx7jru1ja5ALocT0TUi
TLSH
T176C2EA3B640CCB7E4FC01A9DDC566F963EA802CB5B948D4087FA994C02C77EE61264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 551400993e17bd8e7f9e176fe3066591f0f5146505274ef651b080928d5c296d
MD5 6e80ccbef0db06a46875fc8f807886dc
SHA1 d300c1e6109a2d0286edb4ab70527c8097a00997
SHA512 c3235976d9f2cd6454cf849191aded573deb979baa7e4810dfa296100c73a9420c7a0b72669eecc00973b06c4c8bcd6a79357994fdff4d31079330787b975b68
TLSH
T1E051E70E4C831B9EDDBC167229FB0044377A78ED51984B23F0ACA534ACC73362964228
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9c7d0375dfe7480bac99432a85d592fba1a7ad4f9dd3fac397347df1c2a81f11
MD5 cf80fad5377c8e530aabe8a500aa5f70
SHA1 174912a5c07dfbf96ccf61df1aced0af1e7044c8
SHA512 f2d978047b8b47fec78796bb19eea3b9efd6e61e67a2915faeffe42c229cd4f52cf6de01ae78afbc0f1432545f13aebff13e316ce57368904e3b681f9c4a6c5f
TLSH
T1FEE0C0F72EFB2C84FEBF63F1047198A00241B459D584BC9F1816EB8324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4111da7be7a06eb0b54d59c01a98e02b409d6bcd5ca0bd30236a250d40aa9e85
MD5 74642aa4c57aa170a9f675d5fa2627ef
SHA1 bb7c66bc65ac41a40f53cace1020e4000c43dd6b
SHA512 26460253be69976b07b0fda5aac09fe0c7fff3eac55f8bce123cffd9009715273ed1549ca274a30d3c633b3277c5b56576cb618b726e9cfd6a03f66370e75416
TLSH
T10AA00251CA589141C06042B89EA502C46AB099BC46052211C6FC9198CC771848196404
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2adf199b8eb7f58fed9a32f46f41fd88c45c3c20f75725fe1df71486f980f401
MD5 d25c6b93066acc8f7b50be7a9b696d92
SHA1 2f7a97a44de79e358a5388dcb5813ce400e3661a
SHA512 461fbe721fb36e7cee3b03138fcdec3342709e988afc32d6c20e91cf808c009b2b925c4d62cce82c3fe8b5df130d66b184f275de5f04339233bc7b026a6cb27c
SSDEEP 48:Ki/27vhFpk5FAPIAXkKzBbJkHP0GghP5yJAIHKBGM1jIFKcE4byt:KEIgK9WK6A4KBGGjaKcEuO
TLSH
T15C91706671BF03416C3F2A0CD2599B175A8231A3350CA52B7BAD01E24EA7E251DFDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a30c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a30c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 78bd97aabcc987a5dfff04919aeab36d825925c38fa60fda1f3f3f08725418f1
MD5 875fee36d5ad9d09e0d5feb073aebc59
SHA1 479f02e29f92ff7db84712f5c21ef60bdf891576
SHA512 8cc735011e2df5c365d6e4a5c65e72bc97c3c5240df8c6a2eb807516a5ca96d690ff67766d7042701443f4ded434d0c15ed66f2a8dd13465d2f7ae17be0b5f10
SSDEEP 384:3iFiZcI+zsNe8TUNTUlIlmTZvV3wam2kvMdtNXoz5s/IkhrfK67HBuX:yFQerwgW2amst+zmZhrxLBuX
TLSH
T144D229F148E7947AD99E9747A77D3D038EBCC067B9849A90B7D85A0CCC960BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 102afc18a24fcdc7f8ed1a3e30def7ddbdaecdddc0e83d184fa1105535bcb5a4
MD5 723d938cce9989cb7b033f633b5de79f
SHA1 e5e3bd22461099d93076e1962455127191f2e5a5
SHA512 00d467e24cbf2864479512453b3de289e40316e6af85a6a06698d40a804a17c90912f2f6665537b6bdd85b4e1441433374e98217011da73606d957af1ba35f86
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5u5DoBhPwivh50xy0SFYK7Ax6YLgh:gONc6kDfQmiUyYcZ903NIQiQEU6
TLSH
T11502E8356C786CBB8EE3AE59F48737275FA5113BEA942F85D9E81A1C40D724C1703827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6263a0a36594fb4d5ba84097681f96ee28b7701c0163ae1ec1c1f8ecb4c50e41
MD5 2476942bc333cb0f72ff8d13f2357394
SHA1 9d455535a1d984947f05ebb803c68e0c7c2f803b
SHA512 0742e4b5e06dc7061d8c9795663516233fa17fe125804cc1767ab1a07c730508873ace0345ccfb47e5f9b93e0998028b19c06f39960c3d0e7a50e18776e458c6
SSDEEP 384:+ZcIhsNOmTZvV3Dam2kvMItNXoz5s/IkhrfK67HBuX:8hSNam/t+zmZhrxLBuX
TLSH
T10C928D305C74B97A5DD7A059F88A76138EB4C037DBC85FE0A9ECAB0D05DA598132782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6f10c08fae5f468c28141e2b314bd01c3539e5ff28750b82baf173d871699d38
MD5 6fce07bb30561ed5eb47946b7ba0c36f
SHA1 dbe00121bb1bd74fc22acc14f80d11b7c465d065
SHA512 7b1beb9664a5099c49eb0d72842680911457b237621631188926cc196d70451c84055647c35537e2bfd4f503480631ed8ccc8e91df05b6d2ba2d0b06293a50ff
SSDEEP 384:9ZcIhsNOLBvV1Ma9kvMItNXoz5s/IkhrfK67HBuX:lhbAaIt+zmZhrxLBuX
TLSH
T15F928D305C74B87A5D97A059F88B76138EB48137DBC85FD0A9ECAB0D05DA598132782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc0343c20622b32efbb91f7c1f7d8a68c8de8e502d0f14d10a3f988ae453bed0
MD5 48a20737f320c169c8680a3d2d27fdfc
SHA1 0314fe36f8fbbddb8d9d252bc380b4263d51bd84
SHA512 242432b9b1b8639b0476de17d5af91c4ac0c762f8618c43326aa5968fac6266e9c14dc2cbdeb4060c66b598bec2ab940c6896b62e04b6acddf6a76aa16d7a2ca
SSDEEP 96:vqONkDQsjpfmUTLK5ih/cIPURHl8h4otop5unDoBWPwivh50xy0SFYK7Ax6YLgCs:yONv6kaQmiUywcQ903NoeNhcRTqKU6
TLSH
T17E122935A8786C6B4DD3A994F08736139EA04127EBC96F91D9EC2A1C01DB69C5307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68b61c93-ff12-4dd1-8222-321db12b1373.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\68b61c93-ff12-4dd1-8222-321db12b1373.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 143338c6dda2f2a4ac78388630cdd2b492bc2a6c2f7443823661119040ec873c
MD5 b6c8f802bd59ffa1e36d4b15c0caaac5
SHA1 7e65c7283269bd6bc55cd039eefe401a82c02383
SHA512 07614d25c10afc7c193c5f742edc7f58ea2c4cb13c52ef91ed1876903e89ebeaa86e8b67528bc6a4a04053de6a64f88a074c20f34f572d76c2f95ea3f5a1de10
TLSH
T1D941075DB6ED1148B3B76E5AAFF6A8AE487EBD772E07D45D00010D8F0622A44CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download