hxxp://mgow[.]am/ | Triage™

Analysis

user interaction
yes
max time kernel
898s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mgow.am/
Sample260811-l7cmfsck21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309167854656932"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{57B77478-E0C9-4863-899C-B40B9C387C9D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4892	4704	msedge.exe	86
PID 4704 wrote to memory of 4588	4704	msedge.exe	88
PID 4704 wrote to memory of 1788	4704	msedge.exe	89
PID 4704 wrote to memory of 2436	4704	msedge.exe	90
PID 4704 wrote to memory of 1788	4704	msedge.exe	89
PID 4704 wrote to memory of 2436	4704	msedge.exe	90
PID 4704 wrote to memory of 2436	4704	msedge.exe	90
PID 4704 wrote to memory of 4176	4704	msedge.exe	91
PID 4704 wrote to memory of 4176	4704	msedge.exe	91
PID 4704 wrote to memory of 4176	4704	msedge.exe	91
PID 4704 wrote to memory of 1572	4704	msedge.exe	92
PID 4704 wrote to memory of 1572	4704	msedge.exe	92
PID 4704 wrote to memory of 1572	4704	msedge.exe	92
PID 4704 wrote to memory of 3384	4704	msedge.exe	93
PID 4704 wrote to memory of 736	4704	msedge.exe	94
PID 4704 wrote to memory of 3384	4704	msedge.exe	93
PID 4704 wrote to memory of 3384	4704	msedge.exe	93
PID 4704 wrote to memory of 736	4704	msedge.exe	94
PID 4704 wrote to memory of 736	4704	msedge.exe	94
PID 4704 wrote to memory of 4240	4704	msedge.exe	96
PID 4704 wrote to memory of 4240	4704	msedge.exe	96
PID 4704 wrote to memory of 4240	4704	msedge.exe	96
PID 4704 wrote to memory of 2368	4704	msedge.exe	98
PID 4704 wrote to memory of 2368	4704	msedge.exe	98
PID 4704 wrote to memory of 2368	4704	msedge.exe	98
PID 4704 wrote to memory of 4728	4704	msedge.exe	99
PID 4704 wrote to memory of 4728	4704	msedge.exe	99
PID 4704 wrote to memory of 4860	4704	msedge.exe	100
PID 4704 wrote to memory of 4860	4704	msedge.exe	100
PID 4704 wrote to memory of 392	4704	msedge.exe	102
PID 4704 wrote to memory of 4800	4704	msedge.exe	105
PID 4704 wrote to memory of 4800	4704	msedge.exe	105
PID 4704 wrote to memory of 4800	4704	msedge.exe	105
PID 4704 wrote to memory of 1908	4704	msedge.exe	110
PID 4704 wrote to memory of 2480	4704	msedge.exe	111
PID 4704 wrote to memory of 4480	4704	msedge.exe	112
PID 4704 wrote to memory of 804	4704	msedge.exe	113
PID 4704 wrote to memory of 804	4704	msedge.exe	113
PID 4704 wrote to memory of 2592	4704	msedge.exe	114
PID 4704 wrote to memory of 2592	4704	msedge.exe	114
PID 4704 wrote to memory of 2592	4704	msedge.exe	114
PID 4704 wrote to memory of 4264	4704	msedge.exe	122
PID 4704 wrote to memory of 4264	4704	msedge.exe	122
PID 4704 wrote to memory of 2704	4704	msedge.exe	123
PID 4704 wrote to memory of 2704	4704	msedge.exe	123
PID 4704 wrote to memory of 4936	4704	msedge.exe	124
PID 4704 wrote to memory of 4936	4704	msedge.exe	124
PID 4704 wrote to memory of 4936	4704	msedge.exe	124
PID 4704 wrote to memory of 4552	4704	msedge.exe	125
PID 4704 wrote to memory of 1908	4704	msedge.exe	126
PID 4704 wrote to memory of 3896	4704	msedge.exe	127
PID 4704 wrote to memory of 1908	4704	msedge.exe	126
PID 4704 wrote to memory of 3896	4704	msedge.exe	127
PID 4704 wrote to memory of 2376	4704	msedge.exe	128
PID 4704 wrote to memory of 2376	4704	msedge.exe	128
PID 4704 wrote to memory of 4344	4704	msedge.exe	131
PID 4704 wrote to memory of 4344	4704	msedge.exe	131
PID 4704 wrote to memory of 4152	4704	msedge.exe	132
PID 4704 wrote to memory of 4152	4704	msedge.exe	132
PID 4704 wrote to memory of 4152	4704	msedge.exe	132
PID 4704 wrote to memory of 4860	4704	msedge.exe	133
PID 4704 wrote to memory of 4860	4704	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mgow.am/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e8,0x7ffff83fc188,0x7ffff83fc194,0x7ffff83fc1a0
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,4521347434343572845,14817490781443898800,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,15541545041769452954,4441677481240111386,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,2077328655889453042,712366918091160276,262144 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12158188137405163349,17681170936147301614,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10214841810556763734,9027161052398186016,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,11377572549277639836,12334630717289826214,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4226298879092635721,14291788598243166844,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5044,i,15776184722555781754,6096407442981246043,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5176,i,4248371370946592390,14934962815104326467,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,11234795157993469920,7735860862910000216,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,5231630394761940817,2126947403826858633,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,11055698826139623638,10336938544909153218,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,11055698826139623638,10336938544909153218,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6304,i,9191730689811604613,637737264629183984,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,3510769298327844603,6893916072989324863,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,18273961754175988107,582004114780803543,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,430436915540411210,12015811689555804698,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,2192501730552682416,12487680926995640894,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5584,i,16305113701382279910,2061672684458634769,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,18007092588191173101,6559197783345439509,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7933348069583726008,7606058910017444956,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6736,i,7034905626196228654,7425893853253559522,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,7509497059276263257,1478744304844047265,262144 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,17020354689561118726,10837003123706421224,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,10950262292307364767,15362852863740420347,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,2292356088445195551,5266370197073138060,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,8337281919693485999,13689821478461831211,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2452,i,14021728120872758235,6222377634868750887,2097152 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,15474729517181697473,17843309612717925968,524288 --field-trial-handle=2672,i,12015353703533438572,15431918203434362357,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8fd5e77dde0ed2e99afbe985b58a9de24b6dd9dd69f2b5f5f8b5d150995c0597
MD5 1d1d951ebc6443d6448f13be4e59ab24
SHA1 864c4f65e45891839940fca87d62116ffdd7eee6
SHA512 997bc389593d578d8192703f8fb9e60c0b322de5353d92da67cb817a193c0f6ebfbf6ab2c061f69073d1286642ec65bdc318dcb2dcb4f0c7ba0b1abf397b7254
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7i:fwUQC5VwBIiElEd2K57P7i
TLSH
T106B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 70e370fceb4f987659100ed12fe2154db769907cd710acd53547326d20853166
MD5 d9a3e7c64fe24a4869340796a22e7c0d
SHA1 de141f10c8daf5bf0a0c448d1347b0723e58a8d6
SHA512 f57ee104b72252697c6546919eb3681dc8b0f46e497771d62d466f02d223936c0652250cd76439d0f01e012b814be4b3cd550a7fc4e1ab2342d24740aaaea7f6
SSDEEP 192:cje+GHfuuuuuuuuuuuuuuuuuuuuuuuuuuuM8LO:cje+GHfuuuuuuuuuuuuuuuuuuuuuuuuR
TLSH
T1D3E16F9386D4C69B8F0514DB4DA0635E0170370DEBECEA0813DCCDDD708EA9BA5FA6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 0e5bbdbb87bdcb652edbfcca4c367eff00fb9f1be2a4674e145c3b9f00718017
MD5 f39f6d3a094ab37ddaffbb6702678baa
SHA1 99ba68e9f90f048ca873e95288a7b604e96d8ecc
SHA512 a916e01b532aeb764d68a266f4894e8ecc09ff939f1127d6b733fbd7e3021559cb336b27ef41a8194c019108e6bbaa218645af37a40aab4cae41f5284e3ae9f6
SSDEEP 192:YjxZxoooooooooooodddddddddddddddddMiLO:YjxZxooooooooooooddddddddddddddA
TLSH
T167E13A4786D4CAAA9F4560DA4DF0735C1070370AEBECE618039DDDDD318E4AEE5BB6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 0f585d974ea091b136e688d32e1ca393f814cdac1058c7c408ffdd95b7fb7fbb
MD5 5376989bbc92dd90358845a9e31a23a0
SHA1 23a5d5f52d387dc8913d480551dc1b1b0e3a76bc
SHA512 3bdcd37cd483f1331e3574d8fcee09072e97961f190ef86beaa721449f35622c87565682834a9b76b84df3c562cdc14c077344ba4d786593d200243969c904c8
SSDEEP 192:bjgtFAAAAAAAABUBUBUBUBUBUBUBUBUBUBUBUBUBUBUBUBUBUBUBUBUMDCLO:bjgtFAAAAAAAAiiiiiiiiiiiiiiiiiiJ
TLSH
T198E14E8282D5CA9A8F1515EB4DB4625C1070370BEBECEA0D039CCEDD304F5DEA5B6AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 ebcdb06bb254422541d203cdf1943d016fa35b80874def28dc08ff4e5a6d1e5a
MD5 84a27ecbb80bc27a960a9b70ca6d4d01
SHA1 27accc51d7831e855b205a81428249fab8644a8a
SHA512 138fa7067a57254a79dfeae94bbbc02823f063784d6ea74de9f83cc6a4d3bf1d09d1b2f7a4e1c71b7551f3ec2e9aa73a3846e6d092c3d8b69a1bb21d6e7b1d0b
SSDEEP 192:Ij0ldaaaaaaaaaaaaaaaaaaaaaaaalllllMjLO:Ij0ldaaaaaaaaaaaaaaaaaaaaaaaallT
TLSH
T1DBE1365A83D8C69A8F4624DB4DB0629C11743709EBECF60813DCCDDE304E5DAA9F76A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 229428428f91d94ac1e543d36183434b12555ad87fcb3b284928d61aa17be68d
MD5 e81a9df1cf6b1b80e4334e49e20d8028
SHA1 f782acc925a3a3c2196cbd0a9a977a8270f16af6
SHA512 dcedeba91b5d3a941507795f02d18ae3b12b6c955e60292984e3d6e1b0ae9f676c9d045589f0b222212587b2cd9c51d0b07504fdfba227b9d1ca518761f2cf32
SSDEEP 192:mjwEMFFFFFFFFFFFFFFFFFFFFFFFFFFyyyMCLO:mjwEMFFFFFFFFFFFFFFFFFFFFFFFFFFZ
TLSH
T101E14F0342D4C69E9F0610DB8DA4A25D5070374AFBECE619039CEEDD304E99AB5B76E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37e0f3314d843f26ef1633aae51b620169edb154116d5befda31e33f46402be3
MD5 7a3ea8e185262c41b7854db29f630f7f
SHA1 8aa279ed732c713243cc0259dc5a3fdd05e8c186
SHA512 c98141f63c6bd3f372b25787ee11f57333c0b03e7a3b5fe31bf9ac596218234c477384e0d37e8f30121a738b5925b0ecd00777434ba338f2e4de02038c47f56d
TLSH
T1476180773D350562E3AF067094E12AD23035F4DBFB4B2E4E1284B9F51524FE0CE5A918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588bef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588bef.TMP
Size 3KB
SHA256 779c4dff05f7243eb4e628c99148bab89fea98774721fabf52885e621b1d0a06
MD5 e25d056880e10c20dd9269e7928ec2e6
SHA1 f51ebd6d55dc2694439be47ec3710f63e9cd9c3c
SHA512 aa05fceca4c1e4542f4efbc1dc91e7dd72cce48ce08b9e82144723e9019166b26273834026d894521e4f8489318bb6c6ccc39dceaf35458ceff071a48203928d
TLSH
T109616F773D350562E3AF067094E12AD23035F4DBFA4B2E4E1588B9F51524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 581b2f988d7ea24d79ce580ccd00299025e13b064a5ff1b3342be78061ea61cf
MD5 4b78a0164ac7bb8be795cdc63f119a42
SHA1 b5f7e1c9f6fa33e2e7544d5579fd272eb3dfb44b
SHA512 224bc54d62d85ff27a8f38e497f3f3d783570cac2345058e3bfc81451a8cdc2fb02655a2d26fb8897f9311c74e450a4f1ef4ca4e98fe1ea286a9532673dbb814
TLSH
T122115BF7C7E5856E890156F05A24AE2BDF2D0506822C7C1A89D4EF2B97E3475E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 10a90389c975c31aa0cabc5d2e96a38b5b27871019fadc3f7f316d4cedab6c1b
MD5 e58401588a520bcc145f2f2ed2b4a913
SHA1 45e3302e27358ec3d73dffe028117772069c7435
SHA512 33893a07bea62e95b03145ebbb3be0d0dc89889a968dda64ed2fd87c5d16d4ce2e33c305db3176957e2dfeb8bc54600b067ed46e5ec348d6b7b3744ae3247634
TLSH
T1B2119BF387E591AEC90116F05A28EE2BDE2D0506421C7C6A89D4EF27D3E3075E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f2ca8f0f0c0cc70a0710ef69b08de61de9ab9e26952a74754d215df21d4667d9
MD5 1fb2d148c3272c502b421820207a5987
SHA1 c47c98634375d2b3b5f647d715de37ad444826ec
SHA512 fc2630f05dbc92828c8e0d652a01d196f2c319d5af2112df36611e256dd3fae2a332952c3285ee7c615449cac47767e78786be1a9d0abaca5571a492f2b16c27
SSDEEP 192:sxZ3RUyM/jK1Ml8MkU/fusOoxtuIdp6QHKC6+WNGY9IK4A1bIgrJ:sxZ3GMU/fusXxFXHKGO9
TLSH
T19442E802BA345977CCCBD209FA55BF53D6F44572A2900E54AAFCCA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ee2b1ab8bd3c558bb71a1d0fd5763890cde8b5aa4625d934069024488079a003
MD5 0160046ea57f6e4b24c553e18a29bde8
SHA1 12a9cbf405ec27d6bf8576fcdf9cf0367b7dec50
SHA512 e451dc41e9ccae1a6f8baea728505b2bc20321d5925adbe8ecb0536f9e9a5c05fa96fc1631255bbb27c94d55d6e278a4a9fabfe8ae7832519ec6f70211e1155c
SSDEEP 192:sxZ3RUyM/jK1Ml8UQIIkU/fustoltuIdpQQHK26+WNKwn/Y9IX4j1bIg5OJ:sxZ3GqUU/fusClF9HmN/IM
TLSH
T19F52E712BA345977CCDBD209FA55BF53E6F5447292900E48AAFCCA0C04E6AED6217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6ef423f6f03f64dfd33047f4c0fe4bdb49f26f8461392e18106963d111aa2eaa
MD5 9554c5b375fdaca7f4547d0bab25476c
SHA1 2b948120b280c87535258ea3ed73db43197a9d94
SHA512 bf2c9f085b3d4f3025518b1a0bbc6a1e7283d50796f624083da7a7a999f747b95e10479c4c05ea9b344bb81156be9f8ed7a91a4112e878eefa82362c6a591f19
SSDEEP 768:rEcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNEroFg66:rEcv21wWvu+Z+u1jaeFLeRNPFK
TLSH
T1DED20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 67fecf8c93b49becf09eb6a7ed2f86a52f27b26814476986d1961b85442c50b8
MD5 4d085d1923f2364d843997e3f5ab9a9e
SHA1 d899e48350b6c8974a4ea2ba64b6604faf09fd80
SHA512 67f88cb0bfc1864ad78edccabce2f734bbed86acb70c169a9221b830767113b8a945eda9437822e6c20827f3cdc2e6a638d121d2f3e24eabcaa45d9753b690e7
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiY2R2bHBo:mT5RXfdFR2bHBo
TLSH
T117C1F006707E0342387D6919A7B586378E8176A33814E9BF7BB800A68F67E111CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14333c55-a709-45c0-b424-48ec286382f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\14333c55-a709-45c0-b424-48ec286382f3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d8fed5d31ab8cece81109709bb6bd91f1ee3f4b8bf8e2ebc5893191b415d250e
MD5 9d08b8df59c66eab175d3f05a783685c
SHA1 e8f450a8763c4fe7f70e3e6148c0c3284b505f55
SHA512 c8047fca843d43c44b136957e70e9e8935ab3ced24dbc234f70a4e7b16a5298081c2557347393b56e9a3bb3ba7801369a8c742a39f6c7ee8cea553763d5f6cc3
SSDEEP 384:IiFiZcIHzsN/8TUNTUlIlYn0ziKZDe+C/dHeWS+2TQOOPrXLpe8C/il3:TFQTawgKABiHkJlTQOi9PNl3
TLSH
T145A26D32A9688C7BADFA9F85F54736038EF89173D9C56A90E2DDEE0C01D75AC130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bde1a6ddc4b6fa81a852e4ee13abfa33d9ee1f843756d77d18d53565b90f7e6c
MD5 ffdcf113b04a8b7024d3f57d6c5b8a98
SHA1 36a30c189309f15049ef4bc5bdf880f226ddded6
SHA512 627169ff0c4fbdf947277a36f7bfcba3cf8125eba457ede22830505f7785856a131cfbd9f54cd041d2e9eab07280ecab6d00c5a2abc8f1f32becd412b1b302f6
SSDEEP 192:JONv6v+YLNQmiUyt1Zh+CGx+Fdew9ohXus8fU6:JONv6vz/KZh+C/dHe5GU6
TLSH
T1E302FA35AD381C7B9FB26E45F58736175FE42177EA952F80D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6b5e89bf46d06a23d7c5a666e0067c334d1b8a176611dc27b3fa784f291ddd02
MD5 576b85153c7cf3780e23443f16c2130e
SHA1 f6b6d5a154bf63f54d1e3476ff056b109aca1028
SHA512 b0ca16e810edb85eb459d280e5fff2d467ef2013f7d0c5f6b5d6727d3dc9cd093bff126bbe49535a7221c3805e0a5fd33b81290dc83f908e034f5c7722213102
SSDEEP 384:3ZcIhsNlYn0ziKZDe+C/dHeWS+28QOOPrXLpe8C/il3:/hDABiHkJl8QOi9PNl3
TLSH
T148928E31AD381C676DFAAA85F54736038EF89573E6C52F94A1EDEF0C01DB5A81306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 44a3ac283cf95f064aac874dd10c52e07aec86cf51f4ec834381f1921dda24af
MD5 79bcf111c0c6d4a64cc415add6a55a0f
SHA1 0f5740726b002bee97c230166b0ae8e9631a71cb
SHA512 923d5656c5de510ce5c9e441abcd7610926db3ccb05a652e31a1231350762e6c39c3c9208e26b511472590e969997e622f662078647a4467b101fbd2b089a108
SSDEEP 384:2ZcIhsNlJn0ziKZDe+C/dHeWS+28QOOPrXLpe8C/il3:khsABiHkJl8QOi9PNl3
TLSH
T187928E31AD381C676DFAAA85F48736038EF89573E6C52F94E1EDEF0C05DB5A81306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6783408ebd5cabcacb132f9057801854b36ce956fdf14b8cafbc817ee596d2eb
MD5 2fc20640c624abd4ecd7d8158a382d20
SHA1 12e825e7c48b569f0aed146ac102e8b38e2a361d
SHA512 d1a22ae54d616ba121e31d3ced0caf0a265174eb53f67582ec6c626f96919b81aa31a251cd0053e7bf01609443c0e29ed66c8ad35dac584615b959c8ff34d6cd
SSDEEP 192:tONY6v+YLMQmiUyR1Rh+CGx+Fdew9oh9aFS+2Z7CH4qWU6:tONY6vz4wRh+C/dHeWS+2mQU6
TLSH
T1BC121A35BC285C6B5EE2A555F48735139EA88167DE863F80E5EC6F1C01EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f4ad3fa-440c-4122-bbcb-d82fc8c6c69d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f4ad3fa-440c-4122-bbcb-d82fc8c6c69d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f20fc68ccf0b2718cd5018b953c04a3dbbfcc94ca4709d84145cc607086bea56
MD5 42104c8244f3a9a13c6bea71e62809b7
SHA1 ec05b114c8e76aca6269199262f96412111fff2b
SHA512 b0a7cfec829024ac7ea01ba037f495ebef44556da023e233a076849591edbe18fd11cd3120e0ea8cb22fdd741a0ada385cdb0cc2feb1d1fa7f5d2d796e62a9ac
TLSH
T1E2412B5CBAFA1104B3B7AE5A9FF6A86D447F7D272E06D15D00110D4F4622A00CDA2B33
MD5 SHA1 SHA512 TLSH

Submit Download