hxxp://surgecheat[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
13/08/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://surgecheat.com
Sample260813-rw2ebssaph

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311052175943377"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9DD6EF1E-816B-48C2-9571-8BA900A90FD2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4200	4136	msedge.exe	85
PID 4136 wrote to memory of 4716	4136	msedge.exe	86
PID 4136 wrote to memory of 3136	4136	msedge.exe	87
PID 4136 wrote to memory of 4716	4136	msedge.exe	86
PID 4136 wrote to memory of 4716	4136	msedge.exe	86
PID 4136 wrote to memory of 1988	4136	msedge.exe	88
PID 4136 wrote to memory of 1988	4136	msedge.exe	88
PID 4136 wrote to memory of 4024	4136	msedge.exe	90
PID 4136 wrote to memory of 4568	4136	msedge.exe	91
PID 4136 wrote to memory of 4024	4136	msedge.exe	90
PID 4136 wrote to memory of 4024	4136	msedge.exe	90
PID 4136 wrote to memory of 4568	4136	msedge.exe	91
PID 4136 wrote to memory of 4568	4136	msedge.exe	91
PID 4136 wrote to memory of 4488	4136	msedge.exe	92
PID 4136 wrote to memory of 4488	4136	msedge.exe	92
PID 4136 wrote to memory of 4488	4136	msedge.exe	92
PID 4136 wrote to memory of 4344	4136	msedge.exe	93
PID 4136 wrote to memory of 4344	4136	msedge.exe	93
PID 4136 wrote to memory of 4344	4136	msedge.exe	93
PID 4136 wrote to memory of 4592	4136	msedge.exe	97
PID 4136 wrote to memory of 4592	4136	msedge.exe	97
PID 4136 wrote to memory of 4592	4136	msedge.exe	97
PID 4136 wrote to memory of 1680	4136	msedge.exe	98
PID 4136 wrote to memory of 3616	4136	msedge.exe	99
PID 4136 wrote to memory of 1680	4136	msedge.exe	98
PID 4136 wrote to memory of 3616	4136	msedge.exe	99
PID 4136 wrote to memory of 1108	4136	msedge.exe	102
PID 4136 wrote to memory of 2588	4136	msedge.exe	107
PID 4136 wrote to memory of 2512	4136	msedge.exe	108
PID 4136 wrote to memory of 5112	4136	msedge.exe	109
PID 4136 wrote to memory of 4328	4136	msedge.exe	117
PID 4136 wrote to memory of 4328	4136	msedge.exe	117
PID 4136 wrote to memory of 3064	4136	msedge.exe	120
PID 4136 wrote to memory of 4812	4136	msedge.exe	121
PID 4136 wrote to memory of 4812	4136	msedge.exe	121
PID 4136 wrote to memory of 2116	4136	msedge.exe	122
PID 4136 wrote to memory of 2116	4136	msedge.exe	122
PID 4136 wrote to memory of 3244	4136	msedge.exe	123
PID 4136 wrote to memory of 3244	4136	msedge.exe	123
PID 4136 wrote to memory of 3548	4136	msedge.exe	124
PID 4136 wrote to memory of 3548	4136	msedge.exe	124
PID 4136 wrote to memory of 1628	4136	msedge.exe	125
PID 4136 wrote to memory of 1628	4136	msedge.exe	125
PID 4136 wrote to memory of 3816	4136	msedge.exe	128
PID 4136 wrote to memory of 3816	4136	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://surgecheat.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffd8cc6c188,0x7ffd8cc6c194,0x7ffd8cc6c1a0
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1755961590598937890,14549257179440646933,262144 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12451880855636504459,3136914888552429334,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,12130442205746958089,16651954536065846009,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4530000459235153741,12401825436087371687,2097152 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14559921850560618811,12980370920242625862,2097152 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,18233932459068564055,6976051486462505343,2097152 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14372033182776225117,7556168086875147269,2097152 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3660,i,3268153960569351120,15133723282481214963,2097152 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,13949325716299433892,13490390252481149767,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,3571825238300055679,2194346416730281054,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16610992186948805753,2278945595712736164,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16610992186948805753,2278945595712736164,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13540237643970198864,3301778643596869243,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,5862294108595161976,2335474181646239050,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,5524012077596191915,5884393541932404284,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,2815840739219616923,952149929730876541,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,1909152149193953539,6915516281826601471,262144 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,4879937297607392349,16307906943588274101,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,17848246748594965392,4592822250330948444,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,2417547523451047104,4148046761448384172,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,7881416606132808903,560343045113127826,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,15551623746393175440,13384874183789620274,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,18071754368967631904,15931684625618575614,524288 --field-trial-handle=2244,i,10027375182198246104,583640026808775003,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7521eecc781e0ac677578fe920a52fdac6a90dc3d5ab9632bc83104b2e21f598
MD5 b8aa10b57b6161e9efc088d1c6e1744c
SHA1 9e1b50d776a07a618e0fd6b991dd1edb7c301464
SHA512 87fd8027983eb61e17aeb159d82d5bf28157b782750525bb5d5fafb389c65134009722d6351f931f858472bb16c3108b61b43f167b945004388b27e1147c8bf4
TLSH
T1D9E0DFC404C8D6AEAAD0775BE2E8630CC2A03A2BF3C8F90A672484C77047084A6CA690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3895c56bb1e9a41e4b1224ba05d985f782da5e05e37e3c0878661e198fb8f8ea
MD5 55509cad00b13d230999c43ec73b03b9
SHA1 2e4dce6eb79081e7cb0e0e64524f95ba1bc52bb5
SHA512 c805032783472588f9a32e67e925dbcd39b6a3acabb5f31cdd04c3a409c9ae98c58ddba9352f67f329910934649b2af2c3debb74330511ab4556c1587d44393b
TLSH
T1B6E0268404C8DAAEAAD066879178630DC2E03A1BE3C9F90A170088C6B0874A4E7C7BA0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d5a5d905829c2136e14cc18db7c1f116f5ad6c526af1bace8dc8add0ae7fab2e
MD5 6c59f43844ea0a1dc6eb2ee0c5fc2a4b
SHA1 fe38c5645db9ea212418ee43a3a35296db220f09
SHA512 0c432e1705d41adf46f82557a9643abf8d441c3f4c7c28515c787e0df75eeba3a306e789e70e0de329be7f4ea51edd376ef31e89ad0cbfdbd65f13a1add06bcc
TLSH
T17251A3B002F30493E3C0E57183DE0A22723AB9E8F91B6F4A05F067F92E84711B419C2D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f6424c04637ae3231ca797f1f5fd258aba78af732088aa2e9fbeb976448385c9
MD5 b8b254a2e2165382d56b0bfeb1a5412c
SHA1 6a2341eb19f24b98122668091c470637bc5a2c5f
SHA512 295ad3bbe848ecf726bd00f5bb2fcb8b33f74c1c788e3ad032a9644b8a0c8e7f4401dfd27fa9001173eb320f7e7efc3edb8e57c89f150f7de38d7dcec5e6a6fe
TLSH
T1865170B002F30493E3C0E5B1D2DD4A22763AB9E8F91B2F5A05F067FA1E84751B419C2D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 859B
SHA256 5cc8cf48126e474343f7a91172eae51db6eeb516fc0a47bed003a6155be5c5bf
MD5 fc648fa43b277d51f26b9c73606c80dc
SHA1 63b57a938494a6b65619ffdc0ab3660b690e668a
SHA512 9b65a247702a41fdb02f5b137a69d79d203cb72f7fb729f08eefe927d5246060f60d4ffa7608442a778f90f9c8d0caa863d6235a7b7f196f3159f761d97a3f9f
TLSH
T1B811AFF783E49A7D8E1092F4A7142E1BCE6D0851475C7C1AC9D4AE2B97E24B6E10099F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2e0608700f9678bfb76ceeb7cd99e3c5df0aad6529d0e0b6ea7f5860c452fbc1
MD5 0fc3aeb2e47d5f0d73bc5e0875e2272a
SHA1 c737f766cbcfe391d3e659a3b93bd11c90c7e55b
SHA512 7c44b84b3bec20371e90ffe1d093daa4af70520bff0bdbb1f753edbe1b69e10731c1df90e3a852d164362cf0866d1552ebeb56822448c07cf6daac7148900fad
TLSH
T1B911DAB283E4867E8D1142F4AB242E0BCE6D081506587C16C9E4AE1B83E2472E10098B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 90e29f3cdfb55452fa4c38c997dc0af78d20f263abe0ba7ee2a7c32c25deb852
MD5 7be6ffd514c6c01de8180592bc2c4c45
SHA1 12036ae8cb44d1cafbbb1cb8b803d9e7cb70e544
SHA512 176c86103c0019b1a634bb13e8d3173747d1a3077491f44ea9f29710d888226b46d58854c56e02f119875193e26ad874f54616acf551adf29382201edcb03e28
TLSH
T1AA21EDF243E486BEDE1151F4AA146E17CE6D0414469C3C66C9E0BF5793E2073E101E9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 86baa25014858a497c27e7474f3527203f8af9462ffa58dee205702f81316dd5
MD5 c80ba5c27a96cdac9715790b6cce5e30
SHA1 b6e7938b9ec7450b94701a4d569196ee5cac8294
SHA512 c20f575425ada5958daec05de6c1f1c97bc1e5ebd2e701c7986c65f7467176c5ba31adff258c808ca6d5882a906a751d3a1110af579fb4df6d9d746cd1d2ee08
SSDEEP 192:sxZYLko/fCs+weV+IuppjHW6+WN+MQ/Yv12Gp+PIg/JJ:sxZYgo/fCs+wVlHbq/upQb
TLSH
T18822D956AE38A97B4CC7E31ABA15BF53E2F55161A1D01E48EBFC951C08E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7bae49ac0a8123f719ea3a706e0d0595faf36841b70270bdd1280c78092d065d
MD5 c3dc3037fdecae0c4f7d195b92a48250
SHA1 8247d87e943d1cf0b1d970113de62e6199c722c6
SHA512 ea01e69393cbd40d00a63bc3ecd738b2ccfd8089e48bfd1158b18b6e430ca0f3955dd60c6b3f106785d6dcc37340fe259a2eb620e39dda56c91eed998ebcee14
SSDEEP 192:sxZYLko/fCsAtweV+IuppjHW6+WN+c6XYv12Gp+PIg5WJJ:sxZYgo/fCsAtwVlHbUXupQ6
TLSH
T1DF22D856AE38B97B4CC7E21ABA15BF53D2F95061A1901E48ABFC951C08E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 1768abf142a8dd9a94859da7e9d51a5f8b57d80444a9b62d80bb230bd02a78fe
MD5 4b0ac23fe3eddd4fbdfab819fbcd2ad5
SHA1 db7801b8db04b75e212ff2347892a6b4d159bfdc
SHA512 47eb93a6766d3f1d89703795a93c24e7de444aa5088e6b939cdf362f05c447b74c57a036f601e356f9c199e7521e8e9c0089fae63beb6c19d3feff689beaa55e
SSDEEP 384:sxZYgo/fCsAtl66s8qMpRiYnazAW8pZS15posJWeT+qjLHbIdLapc4:swgo/fOtl4Mnc7WeT+q3HbY+p/
TLSH
T19CC207059924D8778EC36D19643C7E33EAEC509222C5DEDA1AFCCA1C019E1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5542ecedf828929a698f6ee7ff3957158e215430cb95c56b23bc595b7b84804b
MD5 aa248eead710d771ccdd458f1e453585
SHA1 b3877e3ce1ba98ab85b3cdab2ce147ca11cf9696
SHA512 39f1d33da24fcbbd2661690f243f8b18038ad13c131c68193867da1d0e1637468585f229ab547bd7f75cab1f42f9a8afc98b809bdff87b03f99d2fab2d553e65
SSDEEP 192:sxZYLko/fCsAtAoV+IupPTHW6+WN+OgZYvES5Fp+PIg5IJJ:sxZYgo/fCsAtAjLHbwZNapQ4
TLSH
T13C32D856AD38A97B8CC7E219BA15BF13E3F5507291911E48ABFC961C08E77CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7f6cbe80eda9a5e400091da55cd2de62d4634117915a90ce25c32157b8d3fd31
MD5 668dd69234845aa09958d6d8bffbd3c8
SHA1 4131a2e7ee52865e2685e7d7f0b571ad11fe5b8d
SHA512 2a61ede6145529b02276dffd59b86e06b1acc75a2cda016dedeaff28aa2144d1ee19943c1146ae799ec1a7d0afe865d5f44c90584ba6df4f25660157c1928f8c
SSDEEP 192:sxZYLko/fCsAtAeV+IuppjHW6+WN+c6XYvhCGp+PIg5IJJ:sxZYgo/fCsAtAVlHbUXcpQ4
TLSH
T15322C956AE38A97B4CC7E209BA15BF53E3F5506191911E48ABFCD61C08E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7dbc3449e6279c90f5ceb58c6e208dae0f2755f9c6ae2069cfa155290abdac72
MD5 69b28b6da1d03f1e5692ef38d52e6aa1
SHA1 f8020a8a1e85e4c7ecb0adc067b5b00c97fd9a95
SHA512 76295d1d6793e1f432c68606ff97e7f5021a11138a22c53f5ef08aff621856eec34b8cd4b5df59d8db2da99df61fa31edf2cf71fce37410e0473324300fc4a4d
SSDEEP 768:l6ee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbSroUu:l6ee3rxWvhffnu1jatcL88bJ1
TLSH
T11CC2FA3B640CCB7E5F800A9DDC5A6F977FA802C797548D4087FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 936B
SHA256 dab401355de48583e32418dc8cbccb98ca5a7bb72536f0f0378baa4a445b9f9b
MD5 4493d80e7893df09fdc852fc4a3a06c5
SHA1 c2540297b56b660cfd8ae48544d9c35a3b414d9a
SHA512 01a14770664f081ed034c8593cc6390483a999dad23f831a458954e14cc6b3940cf9a983d87a21d312bf2ac9b63bfed21eb79fb07d69fae9e2a4a409e2f678c7
TLSH
T1F81144061E618D1FD56805B718F9B0F4737089CC5721E227682C6D3B2C27389B4072CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d092a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5d092a.TMP
Size 936B
SHA256 12a99c5c18ad374d94355a8909c17037a67f07bd31deb6bbe526b08b7e5abb41
MD5 ad690ddc68d59d7e987b1022c3a03cc6
SHA1 b51ca050a74828f715c9dea8820dc022d6ea76b5
SHA512 faadbee3811c240b03d4bed3d37704bcd7efbaac580d21bf6fa4390225670fdb6149a8edd4cf9abcf8b354db41335c4d9b8dfe4f0376de288b0915e49e0c08b0
TLSH
T1AD1123464BD24E2BD85405BB1DE6A0B8F3308C409323F7A3746D253E5C767C959061C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6ad34fc6f8313dd4e9036f1b8370ec71130c6c9b8944771abc8f4533943327ad
MD5 682509cb2ceb5353b94b4f1000c2acf1
SHA1 b65c04f68e6e04ab646683c4606be3eb2430e413
SHA512 2befeaf2516eece54fe81dea91b08ad044de00251c0c674fb5e2e6bbec4cc3fb11320bff1bf87f436c8d590bc1646662a561f4b54408e66996253e18423fca56
TLSH
T19CE0C6B62DD32810BEAFC3E220308490060A78ACEA45FC0EA42BF6C310B231530DBC36
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3740729ebfe4005b6654fa43ee8b81d12497881d5d842f8d8e1463ece6abdba6
MD5 82d14ea9278dca2e782f8705f0856b4a
SHA1 8488424bcc339b6bf90ac4c55c14b25512099793
SHA512 657754f52c91bce2eb671479fe6accecc6b212b119989c6da41e3b5da8430f0344cf11c4cae1bc7e3820cf944cf93b730483c28171ed0b54e6f25a83bc17980c
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EK:KYHIhKggkXyiAI7Khysnyd5IxKK0s5
TLSH
T11C914646747B02523C7F2449B6969A76AE8135E33464E5AF7BB800620F6BE110EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a40388ed-2e80-416f-9a11-ffedf3d0c73a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a40388ed-2e80-416f-9a11-ffedf3d0c73a.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 dd8e664597a37e81a45dd0687e5cd33a6a66343a272f82f66b647d93acb38495
MD5 c6fb1350cf38d98ac1391961cec0376c
SHA1 b9af6e275506701c935f21819743437af89caf22
SHA512 fa7769345b1154824316371e594a8ee65b5baf5624e024526aad29c4b911fe69cbd70a21aee9e8d34d72d95673d49c26ab21fb9d527b1807a75fa63eb2668f09
SSDEEP 192:u4m+xasuheOwQxMvsNsU9BQZG1M70yUQmiU14PY4MTY+FdL37nFd300mE8z1RqFw:8ZcIMsNsUvcL7TkYnOd9dkzFcYx
TLSH
T10B626C719C78AC77ADE3B145F0862B134FF4816B96C46F90E6EC6F1D05DA6A8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 91fcb2bbf5d93600623b5489613e46bd48e653133c23777cd2a3cb1e13af5e01
MD5 0e471864152b1f95ba128e63827caea5
SHA1 db347434b69005655058c9c57c7a383bb47058f8
SHA512 0219de1523dd450c4b96a41ba30bc8f75673ce3953887b7b28da52033deda29be0509f0c6afc6d47a27a9ddf824e78b159d88ecba60434ea332a07d42c99e5b2
SSDEEP 384:MNFiZcIPsNt8TUNTUlIlIcL7TkKnOd9dkz1cYx:CFQPEwglLfOlw1cYx
TLSH
T12AB209F248D7987AE9AE6743E77D2E134EBCC067B5849950B7D85A0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b60f429a701c7ced6000e525072042614c881ca525d7a90fcb710152444edfb
MD5 cacf433451932d6950189f8bf15b297f
SHA1 863f10dc9394d8fce0fb5879ed4a9c5a9dec6d80
SHA512 ed3aa6c12a88244ad60eddd9ddf97d8bf109cae57dc8395a001a4052c55de520f0ae82f83c76b24a4fb29ce5141be394548de79142e86797bff9c03962fa4654
SSDEEP 192:lONX6vMtPQmiUy2jThTY+FdL3v84786BU/u:lONX6UtR5TpdbdBU/u
TLSH
T198020935AC786CBBEAA7BD45F48A27171FE4116BA9D05B94EAE82F1C01D764C1303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 67bbeaccc09dce6bff3c960b4f04d1ad8c48e4b158c04abcc0d0d514a5bd607f
MD5 ceead0d5d2dd71313b29dd580d797b80
SHA1 d213e0b4914f16cbfe71675f3349709a67d8eecb
SHA512 2d3fb55c1e4e614c6c637d03d97bfeb4e7a310bef6d2935c0d16ded7669de04c7dac18ef55db058c1df474973e88372fab5e2de0b3a6a645c8f4c83d663268fa
SSDEEP 192:uxm+xasuheOwQxMvsNsUIQZG1M70yUQmiU14PY4MTY+FdL37nFd300mE8z1RqFYx:BZcIMsNsUIcL7TkYnOd9dkzFcYx
TLSH
T1A3726C719C78AC77ADE3B145F0862A134FF4816796C86E90E6EC6F1D05DA6A8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a8e2b466258acabd5aac47625628f531333da746ef3dd366692ed52e920036c9
MD5 1eda8c262e38d11f35c416e9727cf56a
SHA1 d074b7284262304b2cc4546da6c6a5baaee910b5
SHA512 c017020c8d16b6a16a50a374655e049e20506b1e46d656775eac69927162d657fc4259a03378d70de5c46529a505c2966f237b124d23e68f64925fc846187761
SSDEEP 192:SON+6vMEPQmiUy9jVhTY+FdL37nFd300m980IRqFU/u:SON+6UERcVpd9dkzCcU/u
TLSH
T1B8121931AC68AC6BAD93B445F08736135EF4926BD9C46F90EAEC3F1C01DA65C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c4ede4b-88d9-45c2-8c69-c96f59a9c126.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3c4ede4b-88d9-45c2-8c69-c96f59a9c126.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 191172be96c1b025ebeaaf3de7e77770f67fdbe515e2e3cc27ba31479d4526da
MD5 6e9c0adba73bdff2022436e69f342816
SHA1 ae8a2d2aa9d653bed15c96dcf488369327317174
SHA512 137eba1fa4b97c583a796b7b7e58545f136e9bac6a0769062d0d46662810e83ec823afc48c31d2cbe5352388173499f598dda5646eb3fd6892c73853bb0285a8
TLSH
T110411658A6FA1148F3B77E165FF6A86D887EB9372E0AC45D10110E4F0A22E40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download