hxxp://www[.]computerforce[.]co[.]nz

Resubmissions

14/08/2026, 05:38

260814-gb89bsdn218

14/08/2026, 04:54

260814-fjr5cavyc16

Analysis

max time kernel
898s
max time network
734s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.computerforce.co.nz
Sample260814-gb89bsdn21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311595687876550"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{CE588634-5FF1-4FA2-886D-D9806B304526}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2836	1568	msedge.exe	85
PID 1568 wrote to memory of 2136	1568	msedge.exe	86
PID 1568 wrote to memory of 4440	1568	msedge.exe	87
PID 1568 wrote to memory of 4440	1568	msedge.exe	87
PID 1568 wrote to memory of 4440	1568	msedge.exe	87
PID 1568 wrote to memory of 844	1568	msedge.exe	88
PID 1568 wrote to memory of 844	1568	msedge.exe	88
PID 1568 wrote to memory of 4172	1568	msedge.exe	89
PID 1568 wrote to memory of 1952	1568	msedge.exe	90
PID 1568 wrote to memory of 4172	1568	msedge.exe	89
PID 1568 wrote to memory of 4172	1568	msedge.exe	89
PID 1568 wrote to memory of 1952	1568	msedge.exe	90
PID 1568 wrote to memory of 1952	1568	msedge.exe	90
PID 1568 wrote to memory of 2652	1568	msedge.exe	92
PID 1568 wrote to memory of 2156	1568	msedge.exe	93
PID 1568 wrote to memory of 2652	1568	msedge.exe	92
PID 1568 wrote to memory of 2652	1568	msedge.exe	92
PID 1568 wrote to memory of 2156	1568	msedge.exe	93
PID 1568 wrote to memory of 2156	1568	msedge.exe	93
PID 1568 wrote to memory of 2080	1568	msedge.exe	97
PID 1568 wrote to memory of 468	1568	msedge.exe	98
PID 1568 wrote to memory of 2080	1568	msedge.exe	97
PID 1568 wrote to memory of 468	1568	msedge.exe	98
PID 1568 wrote to memory of 1128	1568	msedge.exe	100
PID 1568 wrote to memory of 4916	1568	msedge.exe	102
PID 1568 wrote to memory of 4916	1568	msedge.exe	102
PID 1568 wrote to memory of 4916	1568	msedge.exe	102
PID 1568 wrote to memory of 3828	1568	msedge.exe	104
PID 1568 wrote to memory of 3828	1568	msedge.exe	104
PID 1568 wrote to memory of 3828	1568	msedge.exe	104
PID 1568 wrote to memory of 2248	1568	msedge.exe	109
PID 1568 wrote to memory of 5092	1568	msedge.exe	110
PID 1568 wrote to memory of 1688	1568	msedge.exe	111
PID 1568 wrote to memory of 2668	1568	msedge.exe	112
PID 1568 wrote to memory of 2668	1568	msedge.exe	112
PID 1568 wrote to memory of 2668	1568	msedge.exe	112
PID 1568 wrote to memory of 2688	1568	msedge.exe	121
PID 1568 wrote to memory of 2688	1568	msedge.exe	121
PID 1568 wrote to memory of 3740	1568	msedge.exe	122
PID 1568 wrote to memory of 3740	1568	msedge.exe	122
PID 1568 wrote to memory of 3740	1568	msedge.exe	122
PID 1568 wrote to memory of 1760	1568	msedge.exe	123
PID 1568 wrote to memory of 4348	1568	msedge.exe	124
PID 1568 wrote to memory of 4348	1568	msedge.exe	124
PID 1568 wrote to memory of 4348	1568	msedge.exe	124
PID 1568 wrote to memory of 1692	1568	msedge.exe	125
PID 1568 wrote to memory of 1692	1568	msedge.exe	125
PID 1568 wrote to memory of 3512	1568	msedge.exe	126
PID 1568 wrote to memory of 3512	1568	msedge.exe	126
PID 1568 wrote to memory of 2824	1568	msedge.exe	127
PID 1568 wrote to memory of 2824	1568	msedge.exe	127
PID 1568 wrote to memory of 4112	1568	msedge.exe	128
PID 1568 wrote to memory of 4112	1568	msedge.exe	128
PID 1568 wrote to memory of 3152	1568	msedge.exe	131
PID 1568 wrote to memory of 3152	1568	msedge.exe	131
PID 1568 wrote to memory of 3152	1568	msedge.exe	131
PID 1568 wrote to memory of 924	1568	msedge.exe	132
PID 1568 wrote to memory of 924	1568	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.computerforce.co.nz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb4ca6c188,0x7ffb4ca6c194,0x7ffb4ca6c1a0
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,18007561407516238714,1042388746069670866,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,2729025175496166616,7360382075320517046,262144 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,15646691969512251179,5207010200661678357,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,18046679538198224958,16704243797757058990,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14401514558882550069,8276352670032250048,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,16717421193123746581,4446855457891629832,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,7666403707049220340,5977275506741895899,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,155419861746662693,11636000046514355240,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,3130668803401756498,17693889901894070338,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,8178437281375210771,13036994496753106868,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,8178437281375210771,13036994496753106868,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6212,i,3865972523626518934,1198951536568400500,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5064,i,17300877352817967304,15678608938263984213,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13363636940093726346,4149851402741106117,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,11484994308092755593,13926702018776622283,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,17126943289058552604,10174385957218245426,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4996,i,2233200269000403408,4483213109796031978,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,3690520057005651750,1714880064370677869,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3752,i,2302829767740611627,61300500887652609,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3664,i,9341932583081183141,14216362927832227444,262144 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3348,i,3753035777929910986,2019578902433028580,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,942121426408577583,9655871941086244507,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,6042639636663818641,8852811504549170928,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,10945212165581582083,9104410591925924591,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14505540620069654002,567701757558283056,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5016,i,13395180758576408917,5321473188183549938,2097152 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=1528 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,806044552300052533,155281085667378404,524288 --field-trial-handle=2296,i,10465858958190246245,16007186103310439584,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2c619caf85b6078c7f3d9de900b75c5a1c2828896e2220f212ed8d4a328a9936
MD5 5d6001da4da9283690d5ae15908333c2
SHA1 7ead9e73cd720f1350378876703610a1d0a45b23
SHA512 a7226359d10a4cf68e6d558803268b86f242b86fbf68455448c99772c7697633b05a6fd0e96cb79ce49a59281cf3274691867f9bb6b0cfb6b6a157b6073acb3e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T117B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 22b347c4d6863a3f08895873cc04a64ae86243b34de61012f11069989dd24032
MD5 dbe5135dcb98b232ed42c987b18d1a5c
SHA1 ae48212c99a10591bb5dc3bdc74c4de8f3fd3d15
SHA512 bdbd4e886c3b3d39b8a9055d2720db02676282aa25ce95bed96e2483a53e3751ec850b311f4c7f8e7c8cf55d14c9b7618a413953c6274b0b181ba03ff0e5f90e
TLSH
T1C3E0D8141386F5966D809787AAA663948430734FB5CDF8D522FCE0DE145098252B6098
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1090abd39d1976b004502856b84d4da5ae408deaf6cd4fd855b7b5a6ddd662ef
MD5 b438aec9357ea237024ca307e4904498
SHA1 91bb3139d0782bb1600bade555edca3b679e88ea
SHA512 e060da676e4231880a620d0da0a36acd5703e98975e7ece3283adb0471b1957f35f7fc18d3ef750a9b4cd0b7ea7f8ac7b32ebf37926a9df984407458121adc99
TLSH
T104E020C415F5D25DEB406947A354A34CC1703A8F92DCB9C55740CCD93005540F68367C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d27d3a368b2bd187aa492d1bec717c059e9ea8d3fa64127166c904aed57ff260
MD5 fe7ccb8cf9085498de9412fa402f3c4f
SHA1 84b3bd7788e91ab9643445bcebefc0cbb9177241
SHA512 2601f237612282162bb9b88683c553cb259f0f8c746a163496b7d79ce4b452bbd6bc605de48a6bf8d68abcd84f2a2acc9e5bf8171641354a8206d9f6337c41a9
TLSH
T1AA714CBE01262079D35080B9A2DD05F539F1A7EBF1163F5910E79DF23E8D3158C1A078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588c4d.TMP
Size 3KB
SHA256 045cd621fc454a3a3a8b617e2f60023ebe4bf20dc4ed5cfa88f8c1f85b270ce3
MD5 e476f0767e3390e595cb82593aeb2d8c
SHA1 a9ea839b8f829e6e98eb3091489b41e87c11b00e
SHA512 67704a295455f068cff38b9177f2e38d864366140db0edce7e56d554d3a4a42e77ff233a8ed9a9579a98030f208ec9ac3cf80a451a4341e61fe5e6b134ec092d
TLSH
T1D9714CBE01162079D31080B9A2D805F539F1A7EBF1163F5910E79DF27E8D3158C1A078
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 cbc00d1941da86426fffce0191e388c71c5f0a00f34de5a1571c6b1800f79d1d
MD5 89cba2d85052e08c9ab288e32bc39a51
SHA1 bf0b34a437a907836a2939fefc209f5b5fa151b7
SHA512 829b1a415eb57dc714dc1f2fd948dd5ae3564c61fb928fa8d4f6dbf9a46e1b627c77974323a34c437e1c1ccbc5b7a92da02fced227ae6d9409f881d21ef8e3ba
TLSH
T1B4115BF387E586AEC91516F05A28EE2BDE2D0506421C7D2989D4EF27D3E3075E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 222b1b1eca2c07d01d6f0d06ccfa7ba8f9eda923f1796416632cfe655fcfb83e
MD5 61215438d054153776c84b312c42f061
SHA1 84d68d96740132e293e13194dd71d25b6e744e2f
SHA512 12b5eb6892702f2795b57b0acba2649e4c5bccc10c34f5ee51094bb784be6d88e7436e535a297306edde4c7a9587b640f1a31465dd4931c7cb9c349d845541dd
TLSH
T1A91157B3C3D586AE890116F05A28AE2BCE2D0606421C7C1989D4FF2B97E7465E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 61f7b737a5534da5bd34963720c4dd765b3e1a7aeb77c286a7860acb3c906285
MD5 c4aa9d6c0d96e0405cfb84620a54d3f6
SHA1 62fea89b7f27596708531e0b2f1b566760984a6c
SHA512 551987a6a84226013975d4a09836368da445f3ab83d3f289a83e8eb15269d75bb99f35ce98da3602823e3475a631d96405520b90c3be13800444b082fb683d24
SSDEEP 192:sxZWRFyM/jK1Ml8UQykT/flsy0ClVdIdp4RHXb6+WNGYvMeL04Ig5GJ:sxZW1qxT/flsyt+IHQGy5Q
TLSH
T16E52D555AA345977CCDBE20DFA41BF53D6F50472A2900E44AAFCDA1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 68f4edf6d76972fb039abc1235849b6dbc238c37506d88dec791d3d73daa38c3
MD5 4dd700ce53234aa66197bdf3ad8bd614
SHA1 2e8141512f2ae821ca07d3350dc073e95004496f
SHA512 7b703e164aba2b8378dbc51fce7f3970d93345cac5697bfbfdd417812a1d9dd272318f3f4513ac576f2c54989f0c5faa1a703347ff96725538e375c94cb30a9a
SSDEEP 192:sxZWRFyM/jK1Ml8MkT/flsfBClVdIdp+RHXv6+WNGYvrzd04IgrJ:sxZW1MT/flsf8+6H8Gw59
TLSH
T13442E6116B346977CCCBD209FA51BF53D6F90572A2900E44AAFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dde551ea31d20ae96f9623880f4b82c410eefb4fb2cda56448230493b1e6a612
MD5 3e68cdaca0b9a11c38923aad31f1b1c2
SHA1 c9665907d6525716ea89b435c808bd26346ff867
SHA512 8aada53af7a22f014f574ff7a57730fc34ca62de42aad15cbe684b29a3a62ae4492edc3046a2f621c390bed03f567811193172eabacefcf2f5ce4d5e4b0a50ff
SSDEEP 768:plseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppmro5e:plseJ3xWvhfynu1jaVcL88pd0
TLSH
T18ED20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b7f634472d1d0c4c7a621956375643fbb5b730c770a1f332f168dfde2ab1e26c
MD5 fd5697ed9397c895ddd994beed3983d6
SHA1 864744d45cbaf6ab7c3f3a29339f59a141800e92
SHA512 32fa5b06c02f42a4cf5be2a68fcd29de28390b15a97b689371d8e0a7b5d27536aee30b454fa99d49243133c17d81f376f6cb347d63f0094080e9d47c310cecbd
SSDEEP 96:KYH+KggmSWsKvKqqm4K/arcng8S6q2E6S:49/Xnccng8S6qh6S
TLSH
T1EF912616347B12123DBD284CA3A6A6378E5131E37458B8BFBFB814624D26E114EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

061c3df0-19f2-40d1-88e1-fa59aa41c46e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\061c3df0-19f2-40d1-88e1-fa59aa41c46e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a11459d220f34beef1068891f600df67ed790252e59ec3467795085408005dc6
MD5 db9d1ec1e14ffe7a1c10cc2106b5c0f4
SHA1 b4bf720cacb75c2bba310898bb873385ea70d40c
SHA512 c6cbc8b1957ec41c6d5ba43837f00f384f21b2e5574c38ca9d167ae4a2876bfd34c3e552f4e1ddd313451bbabfa00656baf0f91424c8bc69fc5cd94746866775
SSDEEP 192:uRLsN9VQQE7Z/UjDM7qD+GQmiU1kG94MTc/CsbLq8z14q+36:6sN9VtE7Fv7Q+iRSimLDg36
TLSH
T1DF42197668649C6B9DA7B541F04A32035FB491AB9AC85B80EAEC7F1C01CB2AC1307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f2de9750ef90bb485f54f547bde7795e7d77507b147b21fb957b01e181eef7c8
MD5 5c0c3b38da6f4f142be1663406bb9714
SHA1 8889beed3493cf9496f3fc8db57056a32bf4c9ce
SHA512 00b2c58981e3e7232498b16abaa458daade0c2379bd2655940acc520a655705eff189dbf26038e45040077226c9f99f930487bc5bcadc4f3ecd71daebffee1eb
SSDEEP 384:ZiFiZcIysNH8TUNTUlIl8tE7Fv7Q+iRSimL2gTB:wFQy+wgXZV6PmL2gTB
TLSH
T15F822A735C64CD7BADB7BA45F54A32139FB480A7DAC4AA50E6DC6E1D009B1AC030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d280e50398f295f99ae28c87efb94bc32bea54e3772a310bdfc3df0478f2c25e
MD5 65b5717b5d625fc16cb8c9e1b634ea17
SHA1 99f9bdeb282a1b8b918bf5bb1587783125782a89
SHA512 c874180b4a11c3f4b141edbdb943f9d1abae00f50a10924e468a402ff2ebc31092325eb29ab802c90f373dae5e89e8e15dde46b767e8b582d7f7a5789ace0b8a
SSDEEP 96:eqONk9QsjpflMoUZre5ih/cIPURHl8h4otop5POD3BjPYvlCr5pgz6qNGebL5Fgi:lON56vMtPQmiUywxThTc/CA847kpWU/u
TLSH
T18502F835AC786C7BEAA7AD45F48A27275FB021ABA5D05B50EAE83F1C00D764C1307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 68e42b5208cf07068232d9f78f2748a4de6d0ab7f5a462a4f4665ccca3f8b3d9
MD5 7355351b622cbde2fb0961e6156a7419
SHA1 a826297d8213f8aa30af079ce71381470f14fbc7
SHA512 71dcae8d4b104276e06da15e2b10729c98863c1da934c697e68d2fb47ef54358259b8dc8511946b627a6854e4b02e12c208c495214fe1cf783d046f5753ee3f5
SSDEEP 192:ufm+xasuheOwQxMGsN98QQE7Z/UjDM7qD+GQmiU1kG94MTc/CsbLq8z14q+TTYy:FZcIhsN98tE7Fv7Q+iRSimLDgTB
TLSH
T14C625BB26C649C7AADB7F141F48A37035FB8906BA6C85B40E9EC7F1D01DA6680317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 923d31773a2320b7bf04c0430c6761955fdda3d75fef121635b0b6d3d2a4eb14
MD5 4492de1144de2d4150ec3b3c8940e0f0
SHA1 33e99bf3c2054fa7bac4c47fa5286083c200d643
SHA512 4028a7ca73b24e7efa6bde2610ced43753047965200b4d3f15223d9a2f41ee766f72edc34dda50eb8d8a7bcb3be3bef35901d6ddd7f5e8d23f42bea003f96601
SSDEEP 192:EONo6vMZPQmiUyhxOhTc/CsbLZ80I4q+U/u:EONo6UZRmOhmLOgU/u
TLSH
T174121A76AC689C6BADA3B441F48A32135FB4916BEAC49B50EADC3F1C01DB56C1307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 3KB
SHA256 acdfe7703a81f80d9e98246eea56b70aea9811a91755177d6a196af1e28899fd
MD5 0fb6310c0c932ff6c61840a27c0763d9
SHA1 ce454926ca64cb696103f0283a9e0386e12679d3
SHA512 e9427954a12e9bb2702acf14e572151a22e57013bfebcc7b066417db332d5f570735f16187ad69df50475811e52646e9ba0a2f08ec0fbb0cc88463ee8d5c1017
TLSH
T121515DD3A4E31E6F99CF3EE21C0649C11D459525619EB049FE8356FC43772B73858640
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe58c02e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe58c02e.TMP
Size 584B
SHA256 8cebb34510443df2058b44e87d64b33aeba2cb140fa3a0d6d82c8e3642e345dd
MD5 f7e67ba0d91d1e778fba8f956eb5873f
SHA1 c2301e427e3a86b919d61cd45f92973d13911aa1
SHA512 23cd915a617ea530a8f00324d57f460da57e0414e45b784871de55bd8251a033b33faa5b7e1c65a1527be6bba6b8eaa70efeb470e3b7f35d8c4d606e79a0b7e9
TLSH
T173F0475C90359C0DE29738BB44365D872310AD856D8433AFF0080829B2CDBA813D49DD
MD5 SHA1 SHA512 TLSH

Submit Download

5eea1ffc-78e7-4f91-a956-5041a19d1d7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5eea1ffc-78e7-4f91-a956-5041a19d1d7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5463721ea9c4fa1f5eb4f833c4663789f4ca6d9a659385704754f9cf6ecfa35
MD5 0214b55bcab05d42d723fc7073514578
SHA1 6b63ec79f08f9811ac09c7e92d2fed786108f882
SHA512 53f0b66629a84ebf85dba5831aacc39e4b88f27e2a170ccd5e7a460d1250d650c8ab555ff4f05d64635643fa3c1727248ce57256ebb7a6c02cca99998853755b
TLSH
T191410958B6FA1144B3B77E56ABF2A86E487F7C332E06D56E10110D4F0A63E41C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download