hxxps://destination-alvdalen[.]se/alvdalens-porfyrmuseum/

Analysis

user interaction
yes
max time kernel
209s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://destination-alvdalen.se/alvdalens-porfyrmuseum/
Sample260814-pawkvahe34

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311829016095870"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{014440E3-C78E-4C79-B9F4-0ECDFA0847E9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3456	540	msedge.exe	85
PID 540 wrote to memory of 704	540	msedge.exe	87
PID 540 wrote to memory of 552	540	msedge.exe	89
PID 540 wrote to memory of 552	540	msedge.exe	89
PID 540 wrote to memory of 2384	540	msedge.exe	88
PID 540 wrote to memory of 2384	540	msedge.exe	88
PID 540 wrote to memory of 2384	540	msedge.exe	88
PID 540 wrote to memory of 2148	540	msedge.exe	90
PID 540 wrote to memory of 2276	540	msedge.exe	91
PID 540 wrote to memory of 2148	540	msedge.exe	90
PID 540 wrote to memory of 2148	540	msedge.exe	90
PID 540 wrote to memory of 2276	540	msedge.exe	91
PID 540 wrote to memory of 2276	540	msedge.exe	91
PID 540 wrote to memory of 1312	540	msedge.exe	92
PID 540 wrote to memory of 3976	540	msedge.exe	93
PID 540 wrote to memory of 1312	540	msedge.exe	92
PID 540 wrote to memory of 1312	540	msedge.exe	92
PID 540 wrote to memory of 3976	540	msedge.exe	93
PID 540 wrote to memory of 3976	540	msedge.exe	93
PID 540 wrote to memory of 3236	540	msedge.exe	97
PID 540 wrote to memory of 3236	540	msedge.exe	97
PID 540 wrote to memory of 3236	540	msedge.exe	97
PID 540 wrote to memory of 5072	540	msedge.exe	98
PID 540 wrote to memory of 1448	540	msedge.exe	99
PID 540 wrote to memory of 5072	540	msedge.exe	98
PID 540 wrote to memory of 1448	540	msedge.exe	99
PID 540 wrote to memory of 3112	540	msedge.exe	102
PID 540 wrote to memory of 1840	540	msedge.exe	106
PID 540 wrote to memory of 1840	540	msedge.exe	106
PID 540 wrote to memory of 1840	540	msedge.exe	106
PID 540 wrote to memory of 5060	540	msedge.exe	111
PID 540 wrote to memory of 2472	540	msedge.exe	112
PID 540 wrote to memory of 1272	540	msedge.exe	113
PID 540 wrote to memory of 4812	540	msedge.exe	123
PID 540 wrote to memory of 4812	540	msedge.exe	123
PID 540 wrote to memory of 2220	540	msedge.exe	125
PID 540 wrote to memory of 2220	540	msedge.exe	125
PID 540 wrote to memory of 2616	540	msedge.exe	129
PID 540 wrote to memory of 1164	540	msedge.exe	131
PID 540 wrote to memory of 1164	540	msedge.exe	131
PID 540 wrote to memory of 2936	540	msedge.exe	132
PID 540 wrote to memory of 2936	540	msedge.exe	132
PID 540 wrote to memory of 2616	540	msedge.exe	133
PID 540 wrote to memory of 2616	540	msedge.exe	133
PID 540 wrote to memory of 4772	540	msedge.exe	134
PID 540 wrote to memory of 4772	540	msedge.exe	134
PID 540 wrote to memory of 4556	540	msedge.exe	135
PID 540 wrote to memory of 4556	540	msedge.exe	135
PID 540 wrote to memory of 4556	540	msedge.exe	135
PID 540 wrote to memory of 2520	540	msedge.exe	136
PID 540 wrote to memory of 2520	540	msedge.exe	136
PID 540 wrote to memory of 2520	540	msedge.exe	136
PID 540 wrote to memory of 3388	540	msedge.exe	137
PID 540 wrote to memory of 3388	540	msedge.exe	137
PID 540 wrote to memory of 3388	540	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://destination-alvdalen.se/alvdalens-porfyrmuseum/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffeca6ac188,0x7ffeca6ac194,0x7ffeca6ac1a0
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,5742878543248377440,11125891114261221073,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,665161966265723221,1572823124497068844,262144 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,5574810349900984104,9490519361840021075,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16343218161616462280,12936146581348089607,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16334199074844065552,7320599373217863590,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,14546890210432355833,5238168504894454851,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,5006341749342416053,1614731501473258162,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,13367888479576475572,15304770681017742608,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10472389605600819525,3379337828041437564,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8695814102272252244,5124660786744981643,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,17753406160923779748,816142125261527792,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,17753406160923779748,816142125261527792,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6112,i,15935770489447309973,8176510305118707044,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,11306183475746477567,1907025317489291646,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,1506200874780696488,16748546996640285311,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,10873098029865936948,15265719241973478768,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15269200722456370167,592121959547793351,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,13877400173511566124,9781910028816773396,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6376,i,4086727637139602865,12406509156582756590,262144 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,7152370565046400438,8412454893430995776,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,13291304627377429902,15860962329191980247,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,13477855900262978142,5544876958788665716,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6585416242923490452,15982957471629868972,524288 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6148,i,12033197220993014579,17315087646331308640,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6952,i,13336421688171045529,10199534922544501487,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7164,i,5321455696539179647,4332153585101654347,2097152 --field-trial-handle=2960,i,6109210369834045760,4407663546548566287,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 27f794d3f3e1e3be0c5ab9845162c1476fa29e17506a0f81d47be2e1428800fd
MD5 2b7cf4711ab6d54c4a6fe4638c9c17c7
SHA1 8f1f031ec3a5357d434b1bb41e111c0e1fa76745
SHA512 ccae5edc6af86812feed3d19b5a57aba2c7e8918763c592114cc0d91fd1d37c1c6f2ab18456557cbff2962116e61833f573a19d8ec401fad4303236b88ae52ba
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T187B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 3fd2026906aea5648f9fbcb2c48d071c05b71072af680322f4a26bfd8b2c78a2
MD5 626dba71b381d1f2df54ecf29da5becf
SHA1 2bb8a9a616a5f4df843d44efe58bb5d78f711321
SHA512 53393a6bd7e4e5de497e5a36bd1a79f0f0aadc0445bc81d495e866ee4dd00eb8be3ea354db9f0755f6ec9f220518ccb57169de21a1556fc76f59f9e062e84fa4
TLSH
T172E0DF9A52E8EAB42E419747A07CA21BC170701FAACCFCDF664C7A89644084042470CD
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 205KB
SHA256 c75a579a2529f8f94c91d69297affd8a0072bc2b4c153a6b0365c2dfb2f7d5ab
MD5 ab23a17228509bcf5bea776f415e7667
SHA1 69b47ce514ad2e04d8ddd9f55d6ce59b76f25e67
SHA512 38d3e927683d0e42a4944989b774ee52303d7a04483b2cb87992f5dd289a936a63a213e5199874e8497e93655cdf894f03738a92470b043655acf86cb09f2701
SSDEEP 6144:OesEnqv33cf3wP8WLxmnHqcs2CrNjkkJ6QG:Oe1qPqwpoH22Cr98QG
TLSH
T1F52412ACBC9095B3F7178733BAA231D0B5EACE45F3DE4651ACA66CB3809184D261E44D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4e8fbe3e6f927700354a243558dad5d6699378bb0de46064e5d295bbfeac5ce4
MD5 b4a56558824ab8adc3d93983489222a2
SHA1 1803cca54f5902235c196c2a2316ae266dd384a0
SHA512 4e86357a5d1c557828ecbbf649042785db83eae35ae8df789d9182634c6c20b01b4fb51195df447e01a0a9b56ab5135c296b4773b62a2310ba1f640b96b8ab3c
TLSH
T1047171274B4D0553D36A2372E4AB3A12F4B0C64BBEB75D761548DA3C660ABE0D22D80C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cb4a2ffe68650c11adc598072092338e8444aad3a59a9abbe7765bf04a49cc16
MD5 18bc23061a96f9ca9addd20a2ff6c271
SHA1 589448257fc520412067d3405b09700dff2842bb
SHA512 060fbeacbdb72d21b20925ff6849a35a573c05dab8254e99784a939f37af417deffdd8a2a0d2ddb6197b875397d93b604299ea1e7722449e2f41e3a80d2dc727
TLSH
T1F27183274B4D0553D35A2372E4AB3A12F4B4C647BE775D73154CDA3D660ABE0D22D80C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc22.TMP
Size 3KB
SHA256 9be7cbb700609399400fcd929d993b090b903020527da147875ee168b4619fa1
MD5 991ff33b194469ca767ad841de8310ed
SHA1 ee419d4551af548d679290f7ab8702ad81a61ed6
SHA512 9177c7c1e4f792b1aa796372cf6036a2d72ac9266cb32b18ce93f3bee7374d9948f8dbc84a59a60e00d38538cdab4156313dede336042d1a0497b48018d38d4c
TLSH
T1AA614F2B1B4D0963E3693372E0EB3A16F0B1D64BBDB74D721548DA7D660ABE1C21D80C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

094e320e-76ac-4491-b977-3df9274ab938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\094e320e-76ac-4491-b977-3df9274ab938.tmp
Size 5KB
SHA256 6c7b4af314a25054b5a6e0d44c3393a158330068cbe9ca9f0b34f1940c450d77
MD5 659462057dfa2da6c1fb0cc976c60312
SHA1 40e30d1c8462d860dbc6c6d3716671362e4b4ae5
SHA512 fe7aadc26db759459eaea5c06f62ad46c00d23d98176d8a1940a09e7b13213634d879d5aefc7c2e7c74e56e994dedac9f624448a3d348686a83874a494212120
SSDEEP 96:D6OOkdcscUcQ2vzBqFqzRduxOo0mIi21KcRc4cTMcln6xwQ:DpOkdvFN61qFqzRd+Oo0mIn1KypQMWnm
TLSH
T147C1CEA3C7E8C27D9D055AF1AA906F1BCE2D0526422C7C16CAEC9F1FA3E15B0D151A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7e91807dcdb35a0cbc3becc807d6456d371996bb4919baad03e946cb178082dc
MD5 e18439f04f26bb4f6abce1c55d7b3670
SHA1 6df10a2c067a0a4d8ccc9488df3cde567cdfed7d
SHA512 73f562a508fb03190230443ff46b4d7708fc54f189b2bf8d6b5505bcec062a83a467f5dfda91f2b195d269144d9758db49355a2dd5bde63376231282df6d1e71
SSDEEP 192:sxZHRLyM/jK1Ml8MkB/fwsfZ4Idpr/HW6+WNw1q/Y4p8iwIgrJ:sxZHtMB/fwsfZJzHbh/W9
TLSH
T19A52D8116B34697BCCDBD20DF955BF53D6F904B292900D44AAFCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cee5916753566cc7ab32714ffb7dc5603d1b22af92aa0023288c8459c9eb677c
MD5 123d63ccb9dda8c3da2cb0a5ce70ee0f
SHA1 b2bba3f7fbb62d9a24d7c259a2a76674b9d59c17
SHA512 ed07680266b112a2f378704b3a85973fede085b3b96a5869499c86e1444b98df9620a97858ed9e2716d05c9decc32cf3a3bafb98499160a780912ab82847ae8d
SSDEEP 192:sxZ9RLyM/jK1Ml8UQm/kB/fwsvH4IdpZpgVHW6+WNweeofR2/Y4yZiwIg5wbJ:sxZ9tq5B/fwsvHJYHbYN/EWt
TLSH
T1FD52E911AA346A77CCDBE21DF951BF57D6F544B291A00E44AAFCCA1C04F6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b03b5d2e2fc60cb93e091618d478eecf61b675528da4209bd19935c974a4261e
MD5 b263d4feb925dbcb1725abb964723fe4
SHA1 4d8253ca3623a965d1f05edd8df5fc925abca6df
SHA512 40b0b5b2518fcd816d02e57c320475a4bf3fcc45737fd200913213414b9ccb3613c0217ec364b42aa11946921ed21beb2ae2434e78bd93c170b3d4eca4937970
SSDEEP 192:sxZ9RLyM/jK1Ml8UQm/9B/fwsvHmIdpZcpYpMgVHW6+WNHpQMpdeeofp8tu/Y4XW:sxZ9tqcB/fwsvHHlHbBc/VWt
TLSH
T13F62D752A6345A778CDBE21DF941BF57E6F554B292A00D44AEFCCA1C00E2AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9a9e3a092d0a229df6378104614237ac326a077e0eb1181ccd83220fd83b5a57
MD5 678640ab38ac027b6992e57dae6e522c
SHA1 7714a4a0c261c0707419bcfdeecaade19baa4145
SHA512 0cef2bab02ed7108bbda8d770a02651e0b75e371dd8088281f677c2d54e2d0409f4baa6d40d225539fd13e679eafca3bb6f274bc028451a84240a1de300f9cb1
SSDEEP 192:sxZ9RLyM/jK1Ml8MkB/fwsvH4IdprpgVHW6+WNweeXY436iwIg5wbJ:sxZ9tMB/fwsvHJqHbYXaWt
TLSH
T1B652D911AA346A77CCDBD20DFA457F53D6F944B292A00D44AEFCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 eeb2171bac808fdb0faf2c50149ee4b3868ae52e792be7d116909010a95de900
MD5 0913337d33c8e1c6d57fd0df12c86ed8
SHA1 30dc12011bcb6cebb1803b79600111decac7f599
SHA512 bc7107539d97381f3900259b5093c562132455c5713499fce12a5cbc9fb989fce74f16b35b4c37258dec5e47d68ec16389ae9b44131ac2577db6d20d333cadad
SSDEEP 768:KQ8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdhrolkOYUnN:KQ8iJPNWvx76ru1jahALocdauUN
TLSH
T199D20B3B680CCB7E4F845E9CEC266F966ED801CB5B984D5447FA880C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 01c0070642abdb53dbd04593840534ea3a2d914828901ebf5eda0a65705bd076
MD5 7953825f88df30d8dbd65d03874e59fd
SHA1 bc9b0df3579d403f9699038070cecda47d917dc0
SHA512 455e0fa404a82ce55b6ef32d5b842ff38eaaf809cc03b48ef6402ea5f12e26c2ad2c36505c87e487ffbb1e03ae35c3305f281e0e004143cb23c74df8ae1212ae
SSDEEP 24:Kd2fZKLaYdM404sY+/IjO0Ki3ha401EWkSmqM782pyXYmfJ67aodcIk4co+PIj+0:KATIxKAwUzy9DI1KcMQcjI1KI0o/y1+
TLSH
T1C091431276BB13422DBE290C92558B174741B1E730A8A47B7FF941B61EA6E600CFF8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67f0c505-aa9f-4c8e-9cc1-921a11f9810b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\67f0c505-aa9f-4c8e-9cc1-921a11f9810b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 43b2e7bc0ca065f2a0b6b8aca09e3d8162b26f24c71a8df80e26338ba1dd5371
MD5 30f0ac3b527fb19494440a47124d364d
SHA1 de63ec2f3418b46a10f53bdb2efd685ffca7eff7
SHA512 41108537d688cdf464341f336b30749e0ef33206bef1d9f1a6d5f7b16838f6eda357faa2b5cabfad4f2269b0b9431b457f684c568cda89350e7db94985d918fe
SSDEEP 384:hZcIhsNuyVIHMnk0JJr1KGOOPrXLpe8C/atV4:phKL1hMGOi9PvtV4
TLSH
T17F929E71A8786C675CE3EA45F88637175FF840B7F3D42F9496ECEB1C05DA5980306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 23e3e2d78632d6a6dcf17ba9210a0d002ef95b14fa5bb963c35961717ca8bd2d
MD5 24c6b141cca5b5d39b5904dcb8d66ae9
SHA1 e911398985cc89c9345452aa4cf4c5031dc08950
SHA512 11c617274b6c828bc69dbe8e823d7ecf23a90754e89c8c7722ba2fb6a7bdec9dfc2ecbfce8e313074de3d06b68ebc85a6423cab365543b5708841ddac0c4ed05
SSDEEP 384:6ZcIhsNuZVIHPo2k0JJr1KGOOPrXLpe8C/atV4:4h1ooYhMGOi9PvtV4
TLSH
T186929D71A8786C675CE3FA45F88637179FF880B7E3D82F9496ECEB1C05D65580306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24b664a01cf92cdee4c45675f6443d18721253fa1b37f80e0adb33dd704963eb
MD5 720d735674205574be14feca4ee2e7ac
SHA1 1694d71ee95a4c1ade8b431daf2ab08869e264c8
SHA512 611e451238d4c3844afb63ef9c0697b68a0e6af49c11eb10e85e665f84d17b72775bdcf45cf1c95dae9ac8080fd093d6f73cfe27ec40e7f72eb725ea9108dab2
SSDEEP 96:ZqONkiQsjpfmUTmDK5ih/cIPURHl8h4otop5wf5DwFBhPwivh50xy0SFYKQAxaYx:gON26kDfQmiUymQZ903LPQiWFU6
TLSH
T11302E6386C787CAB8EE36E09F58677275FA5117BEA942F84DAE81A1C00C764C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 72c86e53855ad7f88eb5e6c06ec425a1d34c86371b3614b026d6b7deb2181f47
MD5 c8eba1f538c123ea1a08dbb93d41cde3
SHA1 7ac93baa43940623934a66c3d160b077a1cc3533
SHA512 7b793ecfce25d07a2d4cbfa178e609a7aeb627e6955f5b92d5260a0053887a34f5ec351f16b9bf8c25bb99c4a5a813315d77b5f2bd2d0c5628bf176abc7600a4
SSDEEP 384:g3iFiZcIwsN+8TUNTUlIlZVIHao2k0JJr1/GOOPrXLpe8C/atV4:gyFQwzwgRVoYhtGOi9PvtV4
TLSH
T1BCD217F258D75876DCAE9B47A77D2E068EBCC0A3F5945A50B3D8990CCC960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eaa87389c48e6df92389bd76b74091e6f16f3de98be3e81a4c073d51a7b2f563
MD5 e88591d71076b121c106d63df62a2687
SHA1 5b0236fedfebf7e9212b3cf8f04487855e293b0b
SHA512 076f9ff4f15cf136065a74fd68f2a48fdf10cf832c4b8829fe9165874079424e823c1efdb8c5cdfa2ff38751f023e171389d775d5fc7892fd9eda3feadc8754a
SSDEEP 192:wONP6kcQmiUyOQV903Lx1eYMSJr1ScRiiqpU6:wONP6hqV90JJr1/GU6
TLSH
T1D4123831A8687C7B8DD3A854F48736275EA5417BEBC96F90DAEC2B1C05DB59C130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8766bead0bcf81b3e2c62d71ceef3f052dc7bc17c3cbc345136d3a74aad5de20
MD5 39dd15bf64cef793df36b8b6f81fbfa3
SHA1 33a13a3caea27cfe9474f85f874680d86905710d
SHA512 0a159852b2b766fef0980958a36fe8a2293db7e9766aff76d25989ee6531e126ece7632e0a0300a7d66411d727a17829e23a4a695e87d812fe17704e35e58372
TLSH
T19DE002015140002FC038173000C3173077B0841103974345515141F45C153142F31AE4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b3778.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b3778.TMP
Size 392B
SHA256 0e2993c3ea626a2e72d5c5b5a1f84292a05a83be3201f2e8e065f0cb71009804
MD5 54204ccb734c2dd5cb197f3e4077eb6f
SHA1 f52e78be50c70c1b7949c4ef92db49099d6603c8
SHA512 ae759a01a8bc5991c16f19c80a7205757d16c3e7d4fea8bbc9dce1c6094038bc5d1080b41f68d31eb26751dabf3b9202cd76eb64a40e7115fbac7089f6ac5245
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 554deee7f1de6258ce2fda7f76fede11b179f3951ec8bdef7cb4250cc3086b17
MD5 b922f9609b07430b4ec8b7fdcfcd1eda
SHA1 2c8b2d31d435f927619b5b8af99b3ddf8194e376
SHA512 efef559127f9a6ff21dc92244e13036bda440d10d8f3e41d57d33339f3086d89972a95b410547bfeade5c5b12926de64fd2d901df5978f973fe718f5b19f7f21
TLSH
T12F414C58AAEA1104B3B77E1AABF6A86E443F78732F07D45E10100E4E0623B45C871737
MD5 SHA1 SHA512 TLSH

Submit Download