hxxps://order[.]toasttab[.]com/online/sodexo-poppy-and-claro/item-chai-latte_34adbbf0-a105-4553-9efd-59a36a897f41

Analysis

user interaction
yes
max time kernel
898s
max time network
868s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://order.toasttab.com/online/sodexo-poppy-and-claro/item-chai-latte_34adbbf0-a105-4553-9efd-59a36a897f41
Sample260807-mt19bscl21

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	22	https://order.toasttab.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a275b2629ee08168	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305731816867299"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E10750BE-A0A3-463B-8C42-B365EB6D1080}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3844	5052	msedge.exe	86
PID 5052 wrote to memory of 4672	5052	msedge.exe	87
PID 5052 wrote to memory of 1052	5052	msedge.exe	88
PID 5052 wrote to memory of 1052	5052	msedge.exe	88
PID 5052 wrote to memory of 1052	5052	msedge.exe	88
PID 5052 wrote to memory of 2240	5052	msedge.exe	90
PID 5052 wrote to memory of 2240	5052	msedge.exe	90
PID 5052 wrote to memory of 4172	5052	msedge.exe	92
PID 5052 wrote to memory of 4172	5052	msedge.exe	92
PID 5052 wrote to memory of 4172	5052	msedge.exe	92
PID 5052 wrote to memory of 3972	5052	msedge.exe	91
PID 5052 wrote to memory of 3972	5052	msedge.exe	91
PID 5052 wrote to memory of 3972	5052	msedge.exe	91
PID 5052 wrote to memory of 4600	5052	msedge.exe	93
PID 5052 wrote to memory of 4600	5052	msedge.exe	93
PID 5052 wrote to memory of 4600	5052	msedge.exe	93
PID 5052 wrote to memory of 4648	5052	msedge.exe	94
PID 5052 wrote to memory of 4648	5052	msedge.exe	94
PID 5052 wrote to memory of 4648	5052	msedge.exe	94
PID 5052 wrote to memory of 2392	5052	msedge.exe	97
PID 5052 wrote to memory of 2392	5052	msedge.exe	97
PID 5052 wrote to memory of 2392	5052	msedge.exe	97
PID 5052 wrote to memory of 4784	5052	msedge.exe	100
PID 5052 wrote to memory of 4784	5052	msedge.exe	100
PID 5052 wrote to memory of 4784	5052	msedge.exe	100
PID 5052 wrote to memory of 2080	5052	msedge.exe	101
PID 5052 wrote to memory of 2080	5052	msedge.exe	101
PID 5052 wrote to memory of 2080	5052	msedge.exe	101
PID 5052 wrote to memory of 4620	5052	msedge.exe	102
PID 5052 wrote to memory of 3392	5052	msedge.exe	103
PID 5052 wrote to memory of 4620	5052	msedge.exe	102
PID 5052 wrote to memory of 3392	5052	msedge.exe	103
PID 5052 wrote to memory of 676	5052	msedge.exe	105
PID 5052 wrote to memory of 3424	5052	msedge.exe	109
PID 5052 wrote to memory of 4408	5052	msedge.exe	110
PID 5052 wrote to memory of 3788	5052	msedge.exe	111
PID 5052 wrote to memory of 820	5052	msedge.exe	119
PID 5052 wrote to memory of 820	5052	msedge.exe	119
PID 5052 wrote to memory of 4720	5052	msedge.exe	120
PID 5052 wrote to memory of 4720	5052	msedge.exe	120
PID 5052 wrote to memory of 4720	5052	msedge.exe	120
PID 5052 wrote to memory of 4864	5052	msedge.exe	121
PID 5052 wrote to memory of 4900	5052	msedge.exe	123
PID 5052 wrote to memory of 4812	5052	msedge.exe	122
PID 5052 wrote to memory of 4900	5052	msedge.exe	123
PID 5052 wrote to memory of 4812	5052	msedge.exe	122
PID 5052 wrote to memory of 4412	5052	msedge.exe	124
PID 5052 wrote to memory of 4412	5052	msedge.exe	124
PID 5052 wrote to memory of 1736	5052	msedge.exe	125
PID 5052 wrote to memory of 1736	5052	msedge.exe	125
PID 5052 wrote to memory of 3700	5052	msedge.exe	128
PID 5052 wrote to memory of 3700	5052	msedge.exe	128
PID 5052 wrote to memory of 4520	5052	msedge.exe	129
PID 5052 wrote to memory of 4520	5052	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://order.toasttab.com/online/sodexo-poppy-and-claro/item-chai-latte_34adbbf0-a105-4553-9efd-59a36a897f41
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffb8ad8c188,0x7ffb8ad8c194,0x7ffb8ad8c1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,13239697883368978881,8404584953855665288,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,9050775585129253870,13297083252172863129,262144 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,1082149184707088675,11637676772553917750,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12410860544456713585,8592112851044507438,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9018454027434933477,11583100445511710671,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12576099338374511221,13117405345235347591,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,15641523010650560182,10339350271852109824,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3880,i,2454477902962059482,558177296021852799,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5320,i,17900588328398486187,8401419356728326610,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5376,i,8532559665136476596,7638437566971455811,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,10188042571890687562,5298925278299077410,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,4995430836599634852,4452801780030714637,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,4232911665756959213,9978128244554123062,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,4232911665756959213,9978128244554123062,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,13567444032776010731,16845112234616088367,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,9350010307433070163,433587669834429172,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,9355135014802413494,5222434847713606361,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,17293498236136094852,12614390957770536110,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3772,i,8463325387068309100,12518820097067511464,2097152 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4812,i,9385815093666852294,15901789593955216334,262144 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,5628932366130970736,10296478673025420704,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9032261823498867101,15305765566064358039,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,15304210815020469207,9356695029856289501,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,17461006585461762052,8443801693347972980,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3188,i,2586117529504953397,13119162449078383509,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,16093952397468403750,5849114344272426415,524288 --field-trial-handle=2344,i,14146264194138538660,3540281232580037312,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4d729e150367d81be8cb1be0a5f81a2148313b41405940be1b327cfa04dd93fd
MD5 ff9eb6b423237e25671395978b94da4d
SHA1 cbfe2682d77de5f6b7787841ced7912fffbc37bd
SHA512 7a8d43b2ce707827d95f218f1c264f08b825e4c13c6eab4f21b60bf00dd6010e42d7afeb4cac6a748cd0c6738dbab8939ef8fbe1003dbafd1f207d12482020f7
TLSH
T19FE07D8806C8DB2EF604A45B517ED30DD2C43A5EDEC8BA1E1F10B48872C3D90E2CA9B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 0c45336c66ef0d19216c8a1ce0b71feef27b5ebf16048d3aa4ba8d4403e5a5f8
MD5 e72b2e3c62e61e7d769f00ebf4f5d8b1
SHA1 0ea05fc6caae072dcf31569ac306947ba8cbae19
SHA512 29fb753527d51380a0f9ec80b974a550bbb976c4b51ecd8c27c28e5639bd5cb52577366be023626d258eec3cc43923d088e74d3d5c84742874d9059e2014c073
TLSH
T16BE0265D9284EEE54A00954BE279733AC1D4B507DE8CDA7A3A16FC8DAE42823925CCF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 887a2324ea091643ee57914056457a54c5d14c25106c12a49972cd1d9a7d801f
MD5 29ffb068c4a9b70254c76f50a28718fb
SHA1 fa96e39c4c684c8dc3319582bfa09109f7fb2cca
SHA512 a6cddfcb4097d166f0b68938158112ace6e4c2dbaa1a64b8b7cc9a2ccbc02c7185eec4d14a691a8128b8f9f67250a4fa727b099eef5cf02438d25e638642dc4d
TLSH
T14CE0208808D4CE1D974065C7D178974D61C0361EA6C4EA1D1B10D5C43747D60F699971
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c0c8b4ca270cbdcaed2c2984bdc71ddfddc96fec1ea47daffa24bc425f89a661
MD5 4e4a5bf4bc3f2bc1aa77a241c67a0e43
SHA1 b92808d5d73e62547b8eca4563663b54faa23f27
SHA512 a80271b2ef0e2c3c0f6ef8fae49afb03738825962c443adab5a68d5cd6a933c4db893f97578633c1d05260dc8ee68c91bc3364eaef77d99777b86b7cb6a14e68
TLSH
T1237120340171C86CE313B479C0A5C2687CFDA5D8F8571E87D191DA366929FE0837DCAA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 707a6c4cab95f77ff46d7efb45902c2b01f109368fe1750421deaa1884bb3194
MD5 c006235dac0f74363321c979af280442
SHA1 4a1dd434ef99cf7bf9c6c37d081fc18dc9f6afca
SHA512 97e372c7a1f3e7cf0a911d7d402cebcc9cfe90b809e0693c654103c7553780487f70dca7623a1c1b61f6c3672c588bcd8fb5177f461b5fa0270ea97b79e5b45a
SSDEEP 48:pxtYj6oUfuLQNqWX4RaJ2qoYDmKKsyz13rteWhs2z/orRoLl0ubhZRI:pxtG6N30WX4RaJmtKKsu19s2zsRoPhZC
TLSH
T1068176340571D85CE713A439D0A1C2687CFDA5DAF8035D8BC245C936AC29BE0837CCEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58914e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58914e.TMP
Size 3KB
SHA256 966c716d3ac788626b91547a9867d2b300b95932d498db9297e640a723d141cc
MD5 a96a60ff9b0da47f1f669632df1aa9aa
SHA1 707a7dd504b88f9bb430b4c5326be0cca996d922
SHA512 81686641aa1dd4de4a5e901548000b3c5d26bae24fe6655e9b9c4c2f33c036557869b85136e38380b3ef16da89a7dba7451f64b605cfb5cb0c0b97802c8a0c90
TLSH
T1AE712F340171C86CE313B47980A5C2A87CFDA5E8F8531E87D191DA362929FE0837DCBA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6f1ea1267b474efe9f5081a2e5eeb9f82464dbc55a817eb17323ba7a2ee0a49b
MD5 3d6b62420164c601bad40185775551f4
SHA1 c9f5cee4c791a18fc3fd69c6f8a544d68a0e1a9b
SHA512 a83d0b90eb6cfb1748289a9a3b63cf41d7a40abfe9fafa70d476d6b793a0432b593d4a842b931d17343229387635262839879c5c5a84dd42ca0b34c26187574d
SSDEEP 96:DyOrTzeBpznqnFrwlGxRlpuMcIaUett1k7iA:DxrTyBp7qnFr8GxRlpuMcHUett1k7L
TLSH
T1F0A1AFE6C7F8962D8C2151F46A197D6BCE690A14435C3C6AC5E5AF179BE24B0E200B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1f8e7e79e87a78980a0b65c78d094c90a042bb63eae88b8f9e789792be9a7518
MD5 3154d2a7a44575bc8eacca4e8b8b742f
SHA1 5d6aaf25657ef7313f811e42b7262daa6345a36b
SHA512 8ebedca0e16b8ac4ccdbf108781bb51b602d140c8163698f2ce9b9bda7c0c9b4af320c28c3473be9d62d3240229e7a203941ae0e103137dd9904bd907862d7a5
SSDEEP 96:D/OZuWiEozBWnFrwBzR6uMcIVett1k7inGj4/3:DWZuWiEo1WnFrkzR6uMc4ett1k7GGj4v
TLSH
T183819EF697F4962DDD21A1F4AA096D2FCE690510535C3C7AC5E0AF179BE20B0E101B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2300b8d9b0751305618d2ef1f425d285e86b87e095d37a9dec9205ca30d29a6e
MD5 ae9eaf76df148d226b850bc6a0665bf6
SHA1 968cd0538ebb9e9a554cfa28a895032ea898dda1
SHA512 4f327cef783a1a3975ec7aa95fef8300da5c6dbb040f366a0d782d3b186f586bb19b2de69cebf4a4f87926d92b3ec2992767ab93e3974262a24787f6473bd280
SSDEEP 96:D/OZuzeBAozBWnFrwBxRlpuMcIaUett1k7inx:DWZuyBAo1WnFrkxRlpuMcHUett1k7Gx
TLSH
T17DA1A0F687F4962D8C21A1F46A197D6FCE6D0515435C3C6AC5E4AF179BE20B0E200B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 77f07122e1b3f0f234767d27077bd8ed2d2bfaa24a4c3d4810969869ca6bfd5e
MD5 db6b7ca9aea55fd3f1064ccc3c86bc96
SHA1 c4ffe91b5a47480db058b8404220f4d705bae1e6
SHA512 58ff0de9a4e9b1dc4a5ca9c36ae2a2c911300a34d73e317791dae9c19278b5538fd80231bfed47875617c91d2d6b7ac027f4a9ec0e138600b7f8f038834a040c
TLSH
T1C34181B6C7F5966D8C1152F06A146E2BCE2D0615435C3C7BCAE5EF1B57E2070D101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c04103b1-682c-4bbf-882d-d332ab927cc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c04103b1-682c-4bbf-882d-d332ab927cc3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1182400804f7ab267cedeb4baed2f778649cf8724cb7fc25bb5dd46df9f595a4
MD5 cdaed9a322fc8817d6bb9dc5c28c332e
SHA1 73289f0319a61a91f0447a46ae092ddab6e86350
SHA512 dc6ef323bd8b037bc054697829696836fcd702a0ae249ccb82a33eb98eea8d5aeea911a93ae5a0d7d9685c64568b8cbfb475856a3ffddf1b76ef10fd3914378b
SSDEEP 192:sxZoRmyM/jK1Ml8Mkx/fTsiUDZIdpvmnxHW6+WNKmwP/YzoYcWIgrJ:sxZoIMx/fTsiU+vIHbK5/U9
TLSH
T16742F8526A34697BCDCBD209FA45BF53D6F54572E2940E44AAFCDA0C00E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c3aaae647277af05605e5f29331e3ea1467276539c028731ac976547328ba6a8
MD5 a382a2d8808e24127c32630455015a6f
SHA1 e5786f03be699a0678c50a4a64cdb40ae07b2255
SHA512 b48a119458dc0ba7c113b19120a26f137b71ef0616637803cc8c337a1f14bbe7fc533838968dcba7356481ac84206fd8377883cf80d665e62549daa2a73c8591
SSDEEP 192:sxZoRmyM/jK1Ml8UQbkx/fTs7ntZIdplmniYHW6+WNKmg0XYzejcWIg5OJ:sxZoIqwx/fTs7nwlcHbKOXZc
TLSH
T11D52E8526A345977CDCBD209FA45BF53E6F54572A2940E44AAFCDA0C00F6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 377b4c10b8248998d65cd640b2feeed0b9ac9b7aa7b0e54f819fdd9ea1e7457b
MD5 4e97dd344466fc3ae06286ae203eb9b9
SHA1 e6c27c23cb404086ddb30fb55532f380de30a577
SHA512 0bc252093162a00a6cd2ea95af90fd7794575a01395f0444ee3f597973e47fec62603dbf75b5caec4ef74f473e007c9db36cf8d6b5da046bf3ee032ee0cd4966
SSDEEP 768:bOW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjwroIs0mYd:bOW7kf0Wvqinau1jaa5LA3jbid
TLSH
T172E2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\temp-index
Size 1KB
SHA256 87ba4358eb10eccc24d88287d3446dc58ae6168c48405356dd656e91530940d4
MD5 41eb3fb9975e2e4203d52d301d2ca6b6
SHA1 f018dff79beddb1f8321174b8a36667c4fc11560
SHA512 a331eec7a67bc5b97304973efbffa3e1c7d37166c8db5c4e5000707db662c3ba1ffa5751fd2bb30de184c50d71819b12fd9c7107ab45cf798d3a6334ac03718f
TLSH
T17B3130898E81A96FD9E444F214B374E537B0D9CD2711A3A3883C62363C673992E0F1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cc328.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cc328.TMP
Size 1KB
SHA256 9cab972fb8dac508ff800e6ffe7078613c84adc8fddef0152dcda64b73df7737
MD5 9be3ed2faf8daeab85b95f8ce817af8d
SHA1 026a8184daef83fdbfa01ddb71027cee48de31db
SHA512 f54397422fd6d2656b5bc210bdbb0c7da3a86f606ee549ed1a1b658a83daa349f5f4b1622d31820dc17f590cf454c5ecf02a95743de2b154a300cbce7c913854
TLSH
T1E431688E4B51591FD8E441720953B4B83375C840531173D3947D633D6C7579D6E5F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 58cf54736e0b8afb60fb79e760d237089f1486f9396b8915d6066f7c3ed6c3a6
MD5 413a73b509b164bcfe2f2479509cfc6c
SHA1 a97bb4be4b45cd5d24efcb81ada54d328cef9c14
SHA512 8b9b7563a5163985b3e48cb038ec53ee47187899748823396d74cf957410d41e0fb3ae83aace72f86445b6bf8a47d6422678240c0de45a9ef8c85a83b19dda11
TLSH
T17FE068BB2DFB1920AC6F87C138B054A081853818C900EC4E312BA28730F23523406C31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5d6833413c8405430004a850e4797d29f7d741d800f272760366ff68a18c6cd9
MD5 f92e962fda38cc0f31910f5ee14a7408
SHA1 93e9af90aff9b9cf02660f7f83519fe2d03c57e2
SHA512 7e25cb4ab4c456ecd58acc7aae0ec1436f2a6eb57aee6a6df49250ded76226e2b769d56ad103fd41674762b5e3de3d98c89a3cf8797fb29a44f589b5750d8354
SSDEEP 96:KIbCKcXrOKcwOigAKVKmviKYkeiowKFil:sKFP4pX6
TLSH
T1F0D19D26333B164178BD3908A75AD677AE4132A33498A46F7F7940660E27E139DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591498.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591498.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ae282cece4299bca0acad1e37bb6a908fe6a33024bd3af1334e44a6939f901ab
MD5 2b5f50b796c7af1d60917d7570990f74
SHA1 89afec6d79093fc02288a07b1d3de70bd36569b7
SHA512 f22c9048eb03346eeedc6fc56e14a7f418c4b4449bc1554277020cd25ec9f4ab5caefd87f34c01861660211706b7672be0b4bba6281172ba78f1f6f82064e01a
SSDEEP 384:wZcIhsNm00eqebbXpS+I6CEJrMWf5Urz0:OhnCF53hMWS0
TLSH
T104928E756C749D3A6AE6E140F88633179FF48127F3C82A88E5ED7B2C01AB598170791F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ab62864330adf081fee7a99cd5672281017fe66bfa1c7b126a6be6cd3b83834
MD5 68dd5d44b74b16772ecd207614a82fb8
SHA1 02bbb54f23b090f580c46401afe44c71e498310a
SHA512 985d628ed5d487203e048e5b3c54b57b74142bc07520642e7f30d713076580f238ad6f5f4b837c348705f247ef3c5d0feecce9e5d6ff058fd072f6a8c4115688
SSDEEP 192:MONG64BAQmiUy918W5GBPKmbCIgaDk5U6:MONG6eAmCW9Ip8U6
TLSH
T1D002FA39AC696C7F9EA2AE45F48627175FE4113BF6945F44EAE42B1C01D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 21005e9ad4a3310010f034bc3b2de07fcd50e5f504cf674b1c544a5e6620c1ca
MD5 a284b91750584c7dbf2974ea3cebf8af
SHA1 91130ef1aac9e4386445915636a2e8f5e4ad8f54
SHA512 f54bad698145e4879b86a711c0bd1d94138ca66ef984565322437dbab7aed5f6ce98c88cdfbd8580ec1a24f8e9e40b503510bd86e62e4c0f630272733688b99b
SSDEEP 384:VZcIhsNmjA/qebbXpS+I6CEJrMWf5Urz0:thjCF53hMWS0
TLSH
T1DD928FB56C749D3A6AE6E140F88633179FF48127F3C82A88E5ED7B2C01AB558170791F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 49f22e97cf77e9318085647a3480973d69c10e3dd5b8d4c40d970e26619fdd67
MD5 97101691960fcaaabbc2ad66440b39b1
SHA1 d8f817edc63745c1e0e5da21c4f724229fb7bfa4
SHA512 9cf8912b34cd3f8d24adb14e9918f81b543c72c0ad03392c1c86c5b21e88ebdb8d88b8a99f547099780f84e64df15857be74fb65b94dbb1765d5eb0b64659cf1
SSDEEP 384:7iFiZcI+zsNm8TUNTUlIljA/qebbXzS+I6CEJrJWf5Urz0:WFQerwgHCn53hJWS0
TLSH
T16DD25BF258E7893AEAAE9743A77D2E038EFCC167B1846544B3D8651CCC561BFD306809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e721f776fb95b4675c996dfd08ef1a70d5de054a3d759b48756d92c6608ae355
MD5 6317758549f659811068650fd6939ea5
SHA1 2a89d25d205c420dbd021e37d537344bd4a0d608
SHA512 434ba1dbf9f18f7d4f04e111337f91decc3090ecab8271f6186838805a71fbdfb5ede9b0d42b8ff223a0a4b9d339a638650be72993cdeec2aa09cfc16f2d300b
SSDEEP 192:vONH64B3QmiUyI8O5GBPKmbCIR4FC1SJrTWwDq1U6:vONH6eZ+O9I6CEJrfWU6
TLSH
T16D120A75A864AC2F5EA2F541F48736139FA4523BF6886F40E6EC3A1C01EF65C230691F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 29d49eb5c8c7c8df45d4180e84e9d7b6f55fdfc1680f93c43ae2f0aefe901553
MD5 13428d7252e9004faedf5f513ef5a088
SHA1 c9a9dec8e94abb522f28c8d565c00f0914580d34
SHA512 41cff8547e4aaaeca0b7003e3d95893fb404780b00cc0993acf0f98a13c73b873d7ce6c31caeb6beea5e01339c7ffc1f5e33e2091fdd76412f0bd25a50516577
TLSH
T1E4E002015301007DC124133010971F203FE2C450026243474735016CAC363003E10680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe594b09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594b09.TMP
Size 392B
SHA256 7e7ad66ae1b3caf22edeaafb54ec3e80a5bd7f20194fdf3203121f690e856c7d
MD5 8f52b00079adf246989eddebdd7f7801
SHA1 9df6b871f30d08dff63c7bbca54f8f2a3c282d11
SHA512 25cec5be04d288835652d2ef1fd768ce176b6117ba1df2b58bda7eafc4fb86ca30d409152a1a29a47f857e6e99a903fbeebf0471cf501be041a25bcd231763d1
MD5 SHA1 SHA512

Submit Download

6366035e-d528-48a2-b6d5-13274c740153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6366035e-d528-48a2-b6d5-13274c740153.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e10858ff47ae268411a1bc5752883a33c8682f2f09a6c52da71eb148f39918c5
MD5 95298f1d3629ac493d7855b7ec6c089e
SHA1 92595240b1df25dac25d61e3e2fc7dda2896bc23
SHA512 cede89885a7a76d6124775d1905481b32528410e7ff61427c891f4c718b5d1f520062ca073947123430fd45cf33b82d5de2537257276b5a0d097ce2ee7a116d0
TLSH
T137411858B6FA1148B3B77E5AABF6A86D487FB9332E06D95E10110D4F0B22E40D871737
MD5 SHA1 SHA512 TLSH

Submit Download