hxxps://secure-web[.]cisco[.]com/1LJjUalxx65VN-DQUEwW-qHhKjgZ7BZeCSz4VGbZnKiWqJcqI-42P2B1f5D0oATmFkCIjGP68JB0H7YQLEhi-8sme18tNyAfxQ03h662j_9e7EcNaoPwUQ_viZjmiuE4rbXimPKlPZcnXnMtBG4efUoVVYeoFs3Ki9lMRhpYRmj54CiaKm5OG_Gqo159nsjTJdQpELcOlwaWi-B31z23jkbqhGLuOckRUWKb9M6IROnf_UdD49b3FfQA1kXRfbz4HJ3KDrEcr2Cc7wtbrpf5ofpKrMCoZidgy6j7ZVeXkoSgE51xSEtdY-SQADr_6IjDS/https[:]/app[.]tonicdm[.]com/w/e31b7ab0aa134e00bb94aadbf129358f%3Fp=2c9fc34b9fcf1406019fd94b463912c6

Resubmissions

07/08/2026, 13:17

260807-qjqlmaen3v

07/08/2026, 11:48

260807-nyscnaxtes7

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://secure-web.cisco.com/1LJjUalxx65VN-DQUEwW-qHhKjgZ7BZeCSz4VGbZnKiWqJcqI-42P2B1f5D0oATmFkCIjGP68JB0H7YQLEhi-8sme18tNyAfxQ03h662j_9e7EcNaoPwUQ_viZjmiuE4rbXimPKlPZcnXnMtBG4efUoVVYeoFs3Ki9lMRhpYRmj54CiaKm5OG_Gqo159nsjTJdQpELcOlwaWi-B31z23jkbqhGLuOckRUWKb9M6IROnf_UdD49b3FfQA1kXRfbz4HJ3KDrEcr2Cc7wtbrpf5ofpKrMCoZidgy6j7ZVeXkoSgE51xSEtdY-SQADr_6IjDS/https:/app.tonicdm.com/w/e31b7ab0aa134e00bb94aadbf129358f%3Fp=2c9fc34b9fcf1406019fd94b463912c6
Sample260807-nyscnaxtes

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: 758681729565rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305769297444253"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{3EECA3E4-E15D-4345-9C85-F9B8997AD158}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4840	2696	msedge.exe	84
PID 2696 wrote to memory of 1640	2696	msedge.exe	85
PID 2696 wrote to memory of 1568	2696	msedge.exe	86
PID 2696 wrote to memory of 1568	2696	msedge.exe	86
PID 2696 wrote to memory of 1568	2696	msedge.exe	86
PID 2696 wrote to memory of 3108	2696	msedge.exe	87
PID 2696 wrote to memory of 3108	2696	msedge.exe	87
PID 2696 wrote to memory of 3764	2696	msedge.exe	89
PID 2696 wrote to memory of 4140	2696	msedge.exe	90
PID 2696 wrote to memory of 3764	2696	msedge.exe	89
PID 2696 wrote to memory of 3764	2696	msedge.exe	89
PID 2696 wrote to memory of 4140	2696	msedge.exe	90
PID 2696 wrote to memory of 4140	2696	msedge.exe	90
PID 2696 wrote to memory of 3800	2696	msedge.exe	91
PID 2696 wrote to memory of 3800	2696	msedge.exe	91
PID 2696 wrote to memory of 3800	2696	msedge.exe	91
PID 2696 wrote to memory of 4764	2696	msedge.exe	92
PID 2696 wrote to memory of 4764	2696	msedge.exe	92
PID 2696 wrote to memory of 4764	2696	msedge.exe	92
PID 2696 wrote to memory of 2444	2696	msedge.exe	97
PID 2696 wrote to memory of 2444	2696	msedge.exe	97
PID 2696 wrote to memory of 1708	2696	msedge.exe	98
PID 2696 wrote to memory of 1708	2696	msedge.exe	98
PID 2696 wrote to memory of 5116	2696	msedge.exe	100
PID 2696 wrote to memory of 3760	2696	msedge.exe	108
PID 2696 wrote to memory of 3760	2696	msedge.exe	108
PID 2696 wrote to memory of 3760	2696	msedge.exe	108
PID 2696 wrote to memory of 4688	2696	msedge.exe	109
PID 2696 wrote to memory of 4688	2696	msedge.exe	109
PID 2696 wrote to memory of 5024	2696	msedge.exe	111
PID 2696 wrote to memory of 2108	2696	msedge.exe	112
PID 2696 wrote to memory of 4504	2696	msedge.exe	113
PID 2696 wrote to memory of 2740	2696	msedge.exe	114
PID 2696 wrote to memory of 2740	2696	msedge.exe	114
PID 2696 wrote to memory of 2740	2696	msedge.exe	114
PID 2696 wrote to memory of 1860	2696	msedge.exe	115
PID 2696 wrote to memory of 1860	2696	msedge.exe	115
PID 2696 wrote to memory of 3052	2696	msedge.exe	116
PID 2696 wrote to memory of 3052	2696	msedge.exe	116
PID 2696 wrote to memory of 3052	2696	msedge.exe	116
PID 2696 wrote to memory of 2580	2696	msedge.exe	117
PID 2696 wrote to memory of 2580	2696	msedge.exe	117
PID 2696 wrote to memory of 2580	2696	msedge.exe	117
PID 2696 wrote to memory of 560	2696	msedge.exe	119
PID 2696 wrote to memory of 560	2696	msedge.exe	119
PID 2696 wrote to memory of 1428	2696	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://secure-web.cisco.com/1LJjUalxx65VN-DQUEwW-qHhKjgZ7BZeCSz4VGbZnKiWqJcqI-42P2B1f5D0oATmFkCIjGP68JB0H7YQLEhi-8sme18tNyAfxQ03h662j_9e7EcNaoPwUQ_viZjmiuE4rbXimPKlPZcnXnMtBG4efUoVVYeoFs3Ki9lMRhpYRmj54CiaKm5OG_Gqo159nsjTJdQpELcOlwaWi-B31z23jkbqhGLuOckRUWKb9M6IROnf_UdD49b3FfQA1kXRfbz4HJ3KDrEcr2Cc7wtbrpf5ofpKrMCoZidgy6j7ZVeXkoSgE51xSEtdY-SQADr_6IjDS/https:/app.tonicdm.com/w/e31b7ab0aa134e00bb94aadbf129358f%3Fp=2c9fc34b9fcf1406019fd94b463912c6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe5ca9c188,0x7ffe5ca9c194,0x7ffe5ca9c1a0
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,12120868565576847683,18165197918395651900,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,13909213438880578619,13763284442517824775,262144 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2093211914499489250,13492565000405874453,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3601904866280331476,1659877823780450552,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11754347842992635720,2687118867491322859,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,7433003035953274886,17179947961772914707,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,7347801745477652207,18267659749699124937,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5835725992632805943,8163281962541963916,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16317108801858229083,18334993921031063560,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17318335498962247028,7730230093788254840,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17318335498962247028,7730230093788254840,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,1452608649352591283,5156656265629935526,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2061853703853860118,8344936040461745183,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,1777603813225168455,13073372071075393378,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,10490405210223860376,16077439464920520944,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,17652787134936967558,7106879682395249333,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6600,i,7280465116759432264,3710155447078499184,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,175648147448057066,11020724285578714632,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6728,i,11547106524290529512,16331530526658646424,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4384,i,9114025792043176011,9283844359707914489,2097152 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,13270965227207275635,1421378937769771994,524288 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5732,i,18210171758320713690,15481649421275068577,262144 --field-trial-handle=2328,i,7366773932472941176,1009567965972178001,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 9804ca50a2167059f49dc246f444aae68cb39aa139cf744d8f88e09e9b31c394
MD5 2d1e9f6978a4b0289a95e48c2648fa63
SHA1 deb5e96ed50c832ce158d975cf94158626ce1406
SHA512 2e6aeb67fc4d20d0becd8f79c912b87807b5920a0a0d0e7abe38d8c084f58e13dea69c73d347c25f89e70b23b996f2ca5af2d510066d3b4ba4e4897be932c8e5
SSDEEP 192:qjWI3oooooooooooooooooooooooooooooMoLO:qjWI3ooooooooooooooooooooooooooH
TLSH
T116E13146D2D4DA5E8F0690978E64635D40F1370DEBECF608039C8DD9318F4ABA5BA7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5d5d4f56e798f35f810a0f6ed7ea50f034411d9eea58ec3f3c46f57a283ae66
MD5 e5183644060d498de7db7e88f2e008dc
SHA1 9988d4c86d8271d2d2440c5c0902534aec8abd5f
SHA512 ffa173bf867874d69771cba6052efb656a3843e743dc53e7cfa5dcc5064c77c52de43743d0fa29b95c9d1e313c5f213db035afd7567740c03faf3f185ff51a61
TLSH
T1B271F9785E4708A5D713A0B375D252C032318AF7F426EAB1C16D68B0660776BDF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ada.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586ada.TMP
Size 3KB
SHA256 aebd50ce98db60d95898ecd6d36fe0793f64643b7c08fcaffd043701b007bcbe
MD5 f16ffce55bf3fe88e553b8a45b1f9912
SHA1 63a3c9d0d245c1f03a11ae6e9636beae3ded267e
SHA512 309f8faf79369e9fb472b653cb8ba595a28992e7ab1ff922543e33430d3ab37ad082e6fbe1d9d9f9dc39f9a4682de0fa7038ece168d465eb5477a594053baf86
TLSH
T17B71F9785E4708A5D713A0B379D252C032318AF7F426EAB1C16D58B0660776BDF1B47C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d19ec4bf93eea76df9f61ab50664c019a05f24248b933a16f183a77b0e63ca27
MD5 63d8c870d4ad1ff0a611ea8fe630fc35
SHA1 96ed035bcca4bbba836ad14979eace95ec2df2e7
SHA512 8fa9dd065864a3e7d3071b11fd4d5ba429dfaa1d924e524713d582b914a780544a7b5dbecc6de57278ead62a98203448875713c913e97ac1d356bee2020fba65
SSDEEP 192:DADS+/9qVXDwHO1i4/oU6n1hV235LDGk3vozx:DADS+/9qVXDwHO1i4/oU6n1hV235LDGN
TLSH
T12FE18CF7C3D4862DCC1172F15F287E1BCD29096862683D2AC5D4EE8B67E6072E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a63e74fcb809d9689dce6f370cdb22a496519bdd1456edab7d9e95b92c3abf26
MD5 cccf53af75c934c40b98947be154e8ac
SHA1 bd0776d90422bb019935a2c791672fff34609469
SHA512 618e53972d9f1f35835a377ded995b51f726bbf8935e50d91e73d48c88850f707f2e10cc6c8e42bc11c104d721a1ca68be1287ce5058ceaeee2179264644b5ce
SSDEEP 192:DADS+/9qVXDwHO1iRGk/oU6n1hV23X4LDGpt:DADS+/9qVXDwHO1iRGk/oU6n1hV23X48
TLSH
T172E17CF7C3D4862DC81172F15F287E1BCD1D096866683D2AC5D4EE8B67E6072E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5f5a8e69abedd9c9125a590a71970a9418f5c6f94b84a593b644880b01741571
MD5 ecfd0d96523f7e3ee3d30833cb15c42e
SHA1 34fe84e25c1ec0f68149e51069fe08886bc67fb9
SHA512 c5ac9745d15ffe14676ac40915440310d1a74c8ed6dff89c88a36d8351cb5985c466407e3a56ef4fe0e4e2955171e575ec859da03334ec69c3fe0727d64e8d89
SSDEEP 192:sxZuRYyM/jK1Ml8Mki/fNsaDaiIdpvzHW6+WNgPk/YInNoHFIgrJ:sxZuWMi/fNsOaLLHbz/g9
TLSH
T1E642F9516B34A97BCCCBD209F945BF53D6F94572A2900E54A9FCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c0bc490da43d0484dac08319da1b70d81636aa96d3de3ebda90d20c78c47003b
MD5 3ef878fa68ac3c5f7f3ef3923c949d60
SHA1 2df0ec818f8172e84818bf9fed07bb7caa1a62a8
SHA512 63fad51ee5637db2f98bb4c696a7044ee016fa2c46324415f28c70c7ffc0c8be214f1f9a04e9194fdb002b3fbda76d908f5c14d4051337cb6c12d9f4ed2895dc
SSDEEP 192:sxZXRYyMojK1Ml8UQski/fNssDkcIdpOuO404HKAZO6+WN7AtL0lPk0Ix/YIiNLj:sxZXNq3i/fNsgkFhHzzy5/72
TLSH
T1FB62D692A6346A7BCCDBD219F945FB53D2F5447292900E54AAFCDE1C00E2BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8da2d493597bf36008b05b2116a03c1579c1113a25d542163473834bd2c11e8d
MD5 6fc528c8b377a99aec015afee67aafdf
SHA1 52ffe08a90abc05eecdec4b5b8f74865b203d2f3
SHA512 3cbe9b25641efb65c8a3a5a583e299e1657d64eca63e965dd8ed4683054802a846280f996093bf91610972bc2c2c4709d76070863e512d3b75696182db3cf7e8
SSDEEP 192:sxZXRYyMojK1Ml8Mki/fNssDkcIdpOuO404HKAZO6+WN7AtL0lPk0Ix/YIiNLuF2:sxZXNMi/fNsgkFhHzzy5/72
TLSH
T12562D692A6346A7BCCDBD219F945FB53D2F5407292900E54AAFCDE1C00E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 73ca0a897ac0b504bd84b63b33c7d80f97e94abd3e587762aaf7db66121fe2ac
MD5 38365aae28f52871e93a61a2a1e2193c
SHA1 8161dd5e84ddce8c8005e0a80664eedba7bb867b
SHA512 d2fb25ed5d23f71acd764bca05942b53492f419699f239ff7e5fefc257ca6376b2826ba3996051018b8f8642285d208f07e33c1dc311588883520ab764ac2ae2
SSDEEP 192:sxZuRYyMojK1Ml8Mki/fNssDkcIdpvO404HKAZO6+WN7AtL0lPk0Ix/YInNYHFIr:sxZuNMi/fNsgkF7Hzzy5/s2
TLSH
T1B162F892AA345A7BCCDBD209F941BB53D2F5457292900E54AAFCDE1C00E2BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e3b4bbbbc02a2167600295ac1c63c00dcae5bbebf0418d04e11a4fadd6acc075
MD5 d67fb561fa659e6a09f24de1ca0503ce
SHA1 9bd147f6ce584d8fed1a47d01b716e40757ab669
SHA512 402ed4319efcb486b96d289f713ed2ae971fb99ed8a5098811a009b2d4c1985c810d97adb27356f05dd94504c01ddc9fe5342a3f14a71b2f76f9667c3a4e0dca
SSDEEP 768:6AsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9JroX3ir:6AsqxXlWvJD6Tu1ja54LAs9iXSr
TLSH
T155D21B3B694CC77E4F840E5DEC26AFD66ED801CB66988D5447FA884C03CB3EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 39feed134018d454fb37f5afaa94850a4d4142ee8f49f6c8fee15f64ce553ba3
MD5 31bb1788ef13c5c1bdd7f1509f4a7605
SHA1 3571634f128ca10b17424ed1b503c1dcca0b0430
SHA512 3bc4a2c8ac65d9705513242b85693618a7308f7f74c3f0da2f9efd1ba13d4a368b57faff7f78bd0435f3d46fcdc8213222b3c886322faa478bc5b10d3f5837d2
TLSH
T1B8A0021111E69459C0030771DD9B028D631148A02206176282BDE0768AD4290792F15C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594c32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594c32.TMP
Size 48B
SHA256 a52b2063cd7e1ebadc6f6fcc6c92277d4ba2073ae26da9d9d4342b6d1a475ee7
MD5 9e6b16ee9d0747a7de7b9f0ee166358c
SHA1 8bcf040dfc77ed61fa4157ef017ccc784f45339f
SHA512 42cab7c7a0d1617964b7be15bab01304e20d4bb764ce2b8d9e637e164366e3900453debd542f5005708f9eb8885cc1845f541269774ef90c95308a8a012fbd17
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c7eca73ee007f8e0cc02bdd2b0d49c02e3eb9b24dd21a9ca3576a01bfd528d38
MD5 17911eb70b3ec9698dc9e3a6e2d7c392
SHA1 97cc714a83786c55929d36b23defea850c663d1a
SHA512 3c039a54fbf4cb191b9fcb95380108a5ff678a0e2ff36d86d53f848c702fa94528cbdc03bcdd8cc005bad85684ab156aed12b354445e859c10640a732a64a9c4
SSDEEP 96:KYbaKYIKSogKteiCQQKp2SAgKdG6Wh2KKgS:Exb7j+rtn
TLSH
T1D7E12746713B220338BD2948A36695769E4131A33418A86F7FB841764EB7E214EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a26a9a34-ce77-46ac-a591-5d915ed622a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a26a9a34-ce77-46ac-a591-5d915ed622a1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f54620d3-3d37-43cf-8b46-cd7a6450b9c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f54620d3-3d37-43cf-8b46-cd7a6450b9c5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5006dda1cfa6c34f0d4c572af0862713637b674ecf707c2c0f0687781049d571
MD5 5eaad95938e2562330426ae61a54cf9c
SHA1 c1a18908f84b92dc3339cbbd207178b6ffe38107
SHA512 6d5f561aa78449e4a9c5bf580097ed5370b5d0478c3940fff05b4b0a04aff1b6bad6d309bacca4c7a5751cd2d532980befba1c21056c75c7ab899154e16c790b
SSDEEP 384:ZZcIhsN+mWbllSVRN+Oi+p9S9f5Urz2Wz:xhpgH+Ois9S9S2Wz
TLSH
T1FC929D716C345C3B6AE7A546B98B32178FF89037A3C52BD8D5ED6F1C01DA69C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 193b5a9d1e6590265d440ad0f3ded8c4087b8d6ed040b018f953a70591e73eea
MD5 b8d11c89f6c67268b78b4d9ebafa4bfd
SHA1 9227e9a895602e55596deb7ab74cabe4b0e05d53
SHA512 a9ffce6e60b63da98ed52041599136d3a9ca322591a9ae62d44b5189bb3ec4f78d702b706b0e7ce105f5abb9893ed88509b17bd64691967e5c90a3f4df2dc2c4
SSDEEP 384:diFiZcIkzsNO8TUNTUlIl5WblvSVRN+Oi+p9B9f5Urz2Wz:UFQY7wgygH+Ois9B9S2Wz
TLSH
T1B8D25DF118E7883AD9AE9743A77E2D134EBCC027B5816694B3D85A1CCC561BFD307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1a16751f1eb8c9664f13fcf75709e36ce2e3a94af460f19b32ba17885d49037
MD5 ddcf4ebd6bdab59a9d4be8c774a0796d
SHA1 d675f8729785a20d55e417d14083a35addd72e9e
SHA512 23b0d6531cdaaff23c8830c4438469971b27898a833c789f9a9c018e58749676685d5849c0c24843871f99dd9e716ae2c53d184d1579dd2783144c4330e9c726
SSDEEP 192:tONd6JkRtQmiUyDhW+RN+OmJ+Nh34RCU6:tONd6UrqW+RN+Oi+31U6
TLSH
T16602D835AD381C7B9EF36E09B48B27175FA8203BEA856F94D6D81F0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 93ecee14c43a53beb6aa6abfe54c2890c742f1c3a51675baa9c829b748c95e6e
MD5 0ce06ed9d47f4d6a7b7c00a2430686ff
SHA1 e9eb2549e34a5ff92a035b907d3cc3185f49c835
SHA512 02a1b31a2b0e9d8da59f506dc3a5da4e52ddff99e331409a5143b94cf11a874c7fd00b95f3f6af4b00b67a8d41a1b95ccab3482d643306cb3f83a4db3158bed9
SSDEEP 384:CZcIhsN+5WblGSVRN+Oi+p9S9f5Urz2Wz:whrgH+Ois9S9S2Wz
TLSH
T18C929D712C345C3B6AE7A546B98B32178FF89037A3C52BD4D1ED6F1C01DAA9C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1d2fa96764321d10e9a26dd13b210b64878a686ddd3bfa753d232bee578a77ed
MD5 9aeceebb88647cb8795d3052502f46d2
SHA1 44a740e5683ce61016287e92fb3d0630ace3e034
SHA512 20efe024c8d75b6a632e99a1646f5271847f1aba0b531ec9b38af39b15e5bb4986c12ea4b2dda0bdb3a2f531a9f9948849f19077e64e910f426e0477b06198dc
SSDEEP 192:JON36JkR/QmiUyEhO+RN+OmJ+KG99Vc5qnYU6:JON36UBHO+RN+Oi+p9w9U6
TLSH
T1FE120A3668385C7B5ED36545F48B32178EA4513BEA856F90D1DD2F1C06DFA9C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6a60eace69188dcdc2f6cffa32449b7b2b87034cdae9ced2e379fdf50684861a
MD5 bc51eab540d007148ee60f8990ac8c81
SHA1 55a5cecc419a73d4627e75bb72d18b68118a5d47
SHA512 4d7bbf43846bad9abccc32f6a54f204a82de7eb43e58715f1eab10e753493c2f35c48d9f91f9744405938b66cc6aa7f148ff28f5064c60b046471f6b7e660163
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fb4f25e9a606074234a963c65e3e0732cf3712f8f512bc9820cfae0b91d0de3c
MD5 ddf63fd63068bd1c206cb847ca7d3b5c
SHA1 27106c5e4238055058e554fb9316ffe180adbe71
SHA512 612d8a3395db2f7d7d091e6d8d2c2e07b83ef3bf7b535970f80513aaf098fad39791fee35724d6b86b9d4303b77f8e519a9adbe332038935fd125c5a725ba680
TLSH
T167E00243532400F6D14C033815831A011AE2807023B202078F2095781C136042C20B08
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58b7e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b7e1.TMP
Size 392B
SHA256 a4c91a8d4b777fa4f48a15f284fcec7e904b9fbc14da1fa88526deec478324e1
MD5 5439bbeffaea74ec2c800302f1844a27
SHA1 f96f01f6a5314a6076bfd45a8a41bd353fc5b0c9
SHA512 1606132b8315ecc612ba23a344eb3ea0ce5565eaa7a95647de9dd11545d469c353b0fd7083e1b219cbc4eed421f4ad9005fd8fb44b53d28165d824980cf1df52
MD5 SHA1 SHA512

Submit Download

c3c0bae1-c926-4f35-87de-f93db6966089.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c3c0bae1-c926-4f35-87de-f93db6966089.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7c84210ca2f900a2a7ada9cca87b5f6b3f20c1d8a85eb583615cab9a57040dcd
MD5 d968a8b008680eb93ae558b1b9f04fdf
SHA1 41cda657d2d6460e9b5568e742d54654a97181aa
SHA512 6e6f527aeaf325aa8c2055cd2ad08f9063d29b5a54a149735ab62da70ff6654e82325112821c5dcac3a1d7922a41f4a8ed0289879e882ca6c802fe4fe31b562b
TLSH
T161410B5CBAEA1148B3B76E5A9BF6A96E487ABD772F07D05D10110E4E0A62B00CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download