hxxps://www[.]surveymonkey[.]com/tr/v1/te/w8cnWVwYQGsTjE4VsW4Hblh5p03MqIxyI1c_2BWZMOrIir8hb6JsnJJmIEkZhw3YjvAAEHG8vdd2yLxI1w2EtfK_2BEojuGiHHq1fOpT_2FsGTqPHJHLhasqyyfQ63_2FwXJuMN0Mc7MrL61GhFPx0Aw8gfgGQ_3D_3D

Analysis

user interaction
yes
max time kernel
928s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.surveymonkey.com/tr/v1/te/w8cnWVwYQGsTjE4VsW4Hblh5p03MqIxyI1c_2BWZMOrIir8hb6JsnJJmIEkZhw3YjvAAEHG8vdd2yLxI1w2EtfK_2BEojuGiHHq1fOpT_2FsGTqPHJHLhasqyyfQ63_2FwXJuMN0Mc7MrL61GhFPx0Aw8gfgGQ_3D_3D
Sample260815-es33jayejb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312407992884346"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{AA9D387B-79B5-49A9-ABB7-FAE03BF4B8C9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1856	1380	msedge.exe	84
PID 1380 wrote to memory of 960	1380	msedge.exe	85
PID 1380 wrote to memory of 3060	1380	msedge.exe	86
PID 1380 wrote to memory of 3060	1380	msedge.exe	86
PID 1380 wrote to memory of 3060	1380	msedge.exe	86
PID 1380 wrote to memory of 2076	1380	msedge.exe	87
PID 1380 wrote to memory of 2076	1380	msedge.exe	87
PID 1380 wrote to memory of 4976	1380	msedge.exe	88
PID 1380 wrote to memory of 4976	1380	msedge.exe	88
PID 1380 wrote to memory of 4976	1380	msedge.exe	88
PID 1380 wrote to memory of 1364	1380	msedge.exe	89
PID 1380 wrote to memory of 1364	1380	msedge.exe	89
PID 1380 wrote to memory of 1364	1380	msedge.exe	89
PID 1380 wrote to memory of 3872	1380	msedge.exe	91
PID 1380 wrote to memory of 3872	1380	msedge.exe	91
PID 1380 wrote to memory of 3872	1380	msedge.exe	91
PID 1380 wrote to memory of 2832	1380	msedge.exe	92
PID 1380 wrote to memory of 2832	1380	msedge.exe	92
PID 1380 wrote to memory of 2832	1380	msedge.exe	92
PID 1380 wrote to memory of 1564	1380	msedge.exe	100
PID 1380 wrote to memory of 1564	1380	msedge.exe	100
PID 1380 wrote to memory of 1564	1380	msedge.exe	100
PID 1380 wrote to memory of 1080	1380	msedge.exe	101
PID 1380 wrote to memory of 1080	1380	msedge.exe	101
PID 1380 wrote to memory of 3452	1380	msedge.exe	102
PID 1380 wrote to memory of 3452	1380	msedge.exe	102
PID 1380 wrote to memory of 1680	1380	msedge.exe	103
PID 1380 wrote to memory of 1680	1380	msedge.exe	103
PID 1380 wrote to memory of 1680	1380	msedge.exe	103
PID 1380 wrote to memory of 1736	1380	msedge.exe	105
PID 1380 wrote to memory of 2296	1380	msedge.exe	110
PID 1380 wrote to memory of 1364	1380	msedge.exe	111
PID 1380 wrote to memory of 1492	1380	msedge.exe	112
PID 1380 wrote to memory of 1084	1380	msedge.exe	114
PID 1380 wrote to memory of 1084	1380	msedge.exe	114
PID 1380 wrote to memory of 5028	1380	msedge.exe	126
PID 1380 wrote to memory of 5028	1380	msedge.exe	126
PID 1380 wrote to memory of 3468	1380	msedge.exe	127
PID 1380 wrote to memory of 3468	1380	msedge.exe	127
PID 1380 wrote to memory of 1732	1380	msedge.exe	133
PID 1380 wrote to memory of 1584	1380	msedge.exe	134
PID 1380 wrote to memory of 2656	1380	msedge.exe	135
PID 1380 wrote to memory of 1584	1380	msedge.exe	134
PID 1380 wrote to memory of 2656	1380	msedge.exe	135
PID 1380 wrote to memory of 2144	1380	msedge.exe	136
PID 1380 wrote to memory of 2144	1380	msedge.exe	136
PID 1380 wrote to memory of 2576	1380	msedge.exe	137
PID 1380 wrote to memory of 2576	1380	msedge.exe	137
PID 1380 wrote to memory of 4360	1380	msedge.exe	140
PID 1380 wrote to memory of 4360	1380	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.surveymonkey.com/tr/v1/te/w8cnWVwYQGsTjE4VsW4Hblh5p03MqIxyI1c_2BWZMOrIir8hb6JsnJJmIEkZhw3YjvAAEHG8vdd2yLxI1w2EtfK_2BEojuGiHHq1fOpT_2FsGTqPHJHLhasqyyfQ63_2FwXJuMN0Mc7MrL61GhFPx0Aw8gfgGQ_3D_3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a0,0x7ffef4a8c188,0x7ffef4a8c194,0x7ffef4a8c1a0
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,3246318275576582154,9849962828249751231,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,993217849219868659,16270889348720988101,262144 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,3436062193223275602,4584488905047246042,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1182723991964710284,8537261819119094192,2097152 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,8680365421848079205,7135250842492906782,2097152 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,11670353522214907956,13251684208369061104,2097152 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,11639238753821528294,57490068897710478,2097152 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,18000746804657201889,6929422125348213393,2097152 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,8580215450093511549,8626904376378811835,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,10594991335691429949,14888945620014332502,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5924,i,11609258213045837469,3200553442882970840,2097152 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,18424250151802445058,15305489603693097522,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,18424250151802445058,15305489603693097522,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,13511532328157586579,15068666654506118401,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,6772794806003256007,17715606397718278799,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,15880866104074966174,6810716809411466905,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,6769974174236147084,13765711829650217251,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,9113321986367016611,12929430482172092572,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,753788253906253424,4557566238812458496,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5372,i,6010156792780300969,13619227451913085092,262144 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,1982725992025785029,16307764704300603668,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2832,i,1673597769647035419,12399913088056637255,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3440493040313010398,9654878505053258581,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,6871962265472454388,12786640124905645571,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,7713698408699173698,4407900102367865101,524288 --field-trial-handle=2292,i,1312746685734479079,11240012476734533379,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
  2⤵
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ed8584e9dec93fc03468f203f8d9d81e1600082819bf842f1a063be232fd2b5b
MD5 e82ef9af19aad09d6d038352f88cf1d8
SHA1 0097e4d5c77ab192f17f4094eb466d9559b0b0af
SHA512 adfdbfa241de3eb33a7bb7b8418f501346169fb77b345ea5d914d96d11fbd2e4841af786264cd8de85042fbbfe24d019cadffe8f2779559fb7a13d6b2af45ed7
TLSH
T1BEE07DA548C9C66EEA70E4D751B8430DC3803ACBD6C8F98E5B4084CD73454B4B3C36D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4de1dfde7e7dbbd8e0c2694f7dbef1e2c1c910d3ee95c21e42463604c4ff87ef
MD5 3cafd53fce3d16888a328d4cee433580
SHA1 1eb38b718596a4c0423b585541f97984aed7c463
SHA512 466f697fae956a8d1f2cc42c616ebb0b04e1a543d8bddcbcd17f83b5fe7b25cd392bcec45b983a6963e9fc909a175edf33049b17d7e1302d774e18beb48316fb
TLSH
T1A3E026A50CCACA2EEE5D764B5178474DC3C93ACF9ACCF91B1744888C7A05850A3E7A94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c74ea055ee97880eadef45076ee6e450c3e70e4bf89b19380eca34e9d4ee6cf6
MD5 60cd857289d3fdc26acb53712f20c052
SHA1 c2235c77f7af790aad7408b6d551967ee93a8a2f
SHA512 8c1b7f48dbc3d5925212e9c4fc000b18080dc112a82ebe074f0a5d07e8ecb91e9adb8d58d461c68bcf1e7517cecbcc33fda580e9ed67e46cdd1aec3a37981f84
TLSH
T105E026A919D9C26FFA40644791B8634EC3803ECB92C8BD8A1B8084CD7249194B7C3694
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 eb4424f07795c90159c330d17bbfb7d0ec238fda4b03636755ad2c13ae1abf99
MD5 9bb3672ffa3d883f2c402e3427ef4479
SHA1 0f06be34ac8cb703a160e5a17328e61c4985a785
SHA512 02b7d80742815ed929e925ae9c18a74ed8ebba83fb37fd3ad3a05ca890e90f90d412c21fd2d86b9c83db1d981aa4852c7f329c420c64fad9fbbd52106b84291a
TLSH
T1A2E026AA0ECAC22EEF536847517C474D93813FCF92CCBE4E5744988C7305494A3C3695
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1ea6d8c48eefb97a5f8efa8b77b679d313f7b8d37a7ab4a426f6d5b7035033cd
MD5 5d6cb65bc687579740c4b6761d6342de
SHA1 db629874d09a1e641f94f14cf1c745c9c26ea431
SHA512 c85e1738a10fce6abffa307a3f0e84a91c82a1d38127bb885eccdecc019631e20c67b06103785427cfb85166bdf36e6901f09cf49ab664c6140573c0901568a8
TLSH
T16C81C455234288B5EFD6813CCDD21AC27A71B19A895F0E9606719F7E77CCB2F4C2048D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3187ed52b5758c079174d9f8489f0b72b6170b8d6af0f04ab0dcf4bc20739f4
MD5 d65a2dd2f0df23f124d6fc1bf880382e
SHA1 3c9065b2302e96dbc6cb8a1d3ec1cd6e5de64c09
SHA512 f9b179b71facbfb475e8c3ffb685a0bcf7f4fe6e8f4f36e25e9aad5b7f69b97ce6e7266ce13ca0a917b8ef79df40a5a2babb2554faef009c71ee47de2c1956a7
TLSH
T1E971C455234248B5EFD6413CCDD21AC27A71B19A895B0EA606715F7E77CC72F0D2048D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eab9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eab9.TMP
Size 3KB
SHA256 8fbd5095c2090e2f0e3f71a5085b0845eae074610a4f421a08267befcf319560
MD5 311abf030baf8de00cdf7ff060c00f30
SHA1 d3c0b7f2f58b099c05826fc7e19423b882a1083f
SHA512 ce71532ee20ab746a804e03d05ddd0f4c637f39198e1c0fe2092d95626def70a511102c388ceddfc95b0134180ee0bd4d419014188decbf6e183aa94dd61931c
TLSH
T1C871C659334288B5EFD6013DCDE216C57AB1B299495B0E6A15B05B7E77DC72F0D2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 19427147d4187e23dfba616a8899a47b2df53c67cccb8e9a4d2f4c302d59d631
MD5 2641527080a2d9e52dbfa7be8f0d7d1f
SHA1 fdae16a602f0c03c67e53235f24a42a81ff080fc
SHA512 925906110fbcbeaa3afbee2fff894529ae1f63e649631bc6a23886e9995b70d59a54cefa682a0f45700247e9c799001e823069b42de72e85bf91315d8d5474ac
SSDEEP 96:DBm/OX4SKxvhzBBqEDINDGDVRynAuxuMMbxIxOpxKBLwBxpaGj4/C:DBmWX4SKxvh1BqEDINyDVRyAuxuHbxIi
TLSH
T17CA1BEF7C3F4866ED90196F0EA18AE2BCE5D0416436C395A8DD4AE17A3E2471E241B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5a2a9e7a296ad6e7697964430f6b7c77252b8e73c052882978c213188a1ae63e
MD5 ce7d21b1fce74a5a778fdf4594ac5f2a
SHA1 b3cdf2b579e9378ff600938968b324d38e0034ae
SHA512 038be53a50b0760d7e4da5827ab34a6e344b79b22e4ff955e6c170c713d1206d3d92e9679bdc3935852f1662daa187a2cd7692766ab7b5ab21b1f33452bec384
SSDEEP 96:DBdMOIQmwfxZzYBqEDE6VNDGDVGynuuxuM8bwBxpixMxOpxKBLj4/C:DBdHIQmwfxZMBqEDE0NyDVGyuuxuvbkt
TLSH
T135B19DF7C3E48A6ED81256F4A7246E2BCE5D0515836C3D5ACDE4EE1B63E2470E200A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 df0341eb6f07b5ce8eff78edc4c7bf263ef922ffc889dfe1e85317a120d5e900
MD5 c249cbe8a958fb635a57699964ba82de
SHA1 0973a66a8644171276c61daf1f6150abf3729096
SHA512 e5b1a7d8324d2625508a0c782f19508ffddc10b4d1a81373b4670b48d8697026cfc75b5aec783f0ffbb4b64a35292162f075349384d706debbd8cbd948c1a0c3
SSDEEP 192:sxZ5REyM/jK1Ml8Mk//fwsr8NIdpgkl0HW6+WNgb3JG/Y4t9XDIgrJ:sxZ5aM//fwsr8uEHb8I/t9
TLSH
T18452E812AA345A77CCDBD209F955BF53D6F9047396910E44AEFCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c2f1b07095f8b9ea26bd4ce4cf78954cc417f0f1a078acd0405baa5505c093e3
MD5 b312800512add8b52c10dfcce858e4b5
SHA1 a76911a93e394711bff362c2abc5e06134596ebe
SHA512 cadccdc3a961885b0dbd00842dfea803d157b2d01ddcbfb8d3d06c00e25362c073fc4115c698053342aceba8c8f21cd1a409bad0f9ae79c4bca309581d37f34f
SSDEEP 192:sxZ5REyM/jK1Ml8UQuk//fwsZ17Idparl0HW6+WNgbmYmcvJG/Y4NCXDIg5jJ:sxZ5aqF//fwsZ1kVHb8AP/YT
TLSH
T10F62E812AA345977CCDAE209B945BF53D6F954A392904E44AEFCCE1C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 46510f10bc7b96b3b82eb6d3903e06dc9a43734bdb974c01f1d77866f3bfa1b9
MD5 33228a13c1d6f8ff24d440531a9b112f
SHA1 90fa407ee946f25dedcf87a83a87d97909704b49
SHA512 1d42d3468a4fac8d851b4555faef3a3dd42dffb3a416b4185669d3487450f0aaa0457d6c3fa7b4158d0d93fe417bdb131d494fd38d9516a24800e5043ae085e8
SSDEEP 768:ht8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd+roBk4UnV:ht8iJPNWvx78ru1jahALocdVFUV
TLSH
T15DE2FA3B680CCB7E4F844E9CEC266F966DD801CB5A988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\temp-index
Size 1KB
SHA256 bff27323cdcb1e09a0731f01240d5a9d6f9d9b99f971e16669673641570949ee
MD5 df9a01582d6086409e7cf435f151110f
SHA1 3976edb60de488e36ccdc4f693b93d79bd90eb4f
SHA512 102eebdeb6d4c1f0a389a429537ee9a36fb438dd5454a315be4ed62ec8d2c62fc10acafaefb5bbb43a7a82083f6807b73cf293bfa373b349c4878a53300b1085
TLSH
T1233166494DA1CDAFE8B04672067168A8737084DC1625F713583C31357E2375A264B9EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1446.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5d1446.TMP
Size 1KB
SHA256 6f448560ea23650e2defc19817db58c6df267533dbf89a797f9f4dc67d1ae5f2
MD5 52296850c2ed09ebdde48daac15305cc
SHA1 bc02cd6bee585f7a7536b375949f3255ff611c2f
SHA512 26d2f1804df391bf596375c94bee5464e50ee8b5499ca96624fe3e6d3c5cdd3a677baf4d6023642a16b052ed160f37776864fd443257175048502c0c1caa1bdf
TLSH
T12531324A8A918D1BF8D4517B1E63F8B8733588404311B793A97C6239AD21B8E2A4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 286bd47e042369f51ff42dab6988c939683fb73712867f9d3f428015468c4aea
MD5 327b11a06e6f58e945c1f1e1caf470b5
SHA1 9ea368fe2a96740cb2286be7f33b1255c221f79e
SHA512 7f3ebd0aac93c0bbe5785dcc6872ed84480f3c5ae9db60736954a07735bf0152222bd20ab1a4f67eec42fb22e6bf1f45235af23e4859177bd5b9f3d7ec928ba0
TLSH
T19AE0C0F72EE72880FEBF63E1147198B00281B459D584BC8F2416FB9324613533406C22
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59546f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59546f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7c7d48c54a70367a44ec666cec7c14d62014e458c8f549f433e4d28f0b0d186a
MD5 08281a2cbbe3cba3e7a9ff99c44890ea
SHA1 0b54efe42be50625dc02f926ef401ba2746df088
SHA512 138a5cc9d8a14afe9c3226a6bef2a80629139186f9e541f2183531c704a36e6101d6810c0665b125fb40b561fa2bfdabff24c6ee9f8d96ef0d09a96ed6624fe6
SSDEEP 192:uALsNnHQ81WiMmv3QmiU1wkN/4k03tjzorYbraEXH6FyLIfqRU8:BsNnHj3BhbNwkM8YyEXW/yU8
TLSH
T1DE32093168786C3B9DE3A555B44B36239FB4442BD7C92F84DAEC1B1C04DF29C131A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6e7c4ac271d8048089ffaa8b8b57c6647e4a4a9269d924c4cd3b0310fecf2e94
MD5 5b01e5f4050f1b3d1bfb4ffefa83e14c
SHA1 dbc775727d7ec88c12de8dbba765906c350e2938
SHA512 76cff4dafb11ebc5ac10f9b9884125192b8cfb6912751b8dd6286ed796b0d997910d732d598cca0e667236b5b6ff4d02d93769e7f1a6d5790c95a4c49dfd458b
SSDEEP 384:hiFiZcILsN58TUNTUlIlkj3BhgNwkM8YyEXWoyOOPrXLpe8C/2:IFQL4wg06lMVyOi9Px
TLSH
T1C3D22AF248E7583AE9AE9B47A77D2E128EBCC067F5856690B7D8460CCC8617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e543a0083a78bc7613ed127bf8d8fcc675f3f5e6227376dc0c515100e33114f
MD5 c6a3513f84628a743bb6595ef53f8e2a
SHA1 70dac69274cae1415738448d62bedae0c9662fbc
SHA512 bee59305ef646493bd08bb8d288ecfb22b0f1d070e42926073c0cf79d48877fb6e65de2733e952930b543cc61b5b52ccd04e392299fbfb840efe3e052cd4fece
SSDEEP 192:gONS6kDfQmiUy9aZ903tjzorYbracQimzU6:gONS6gh5Z9M8YyKIU6
TLSH
T1C302D9356C782C7B8EF3AE49B44B27275FE4112BEA952F84DAE81B1C00D764C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 205d18ebf01cae610aeffd02c4f8e1bbfc53ac3dfb415dad19beb21ffa2f7967
MD5 007c1bb2f7f8fd3404953a31e8cf3235
SHA1 bb0bb48c755ab64ba5fa85ff3760ad896e086609
SHA512 bf145c196288564510f3164d4552e4e97d068a922d42f43ede371432d30fd148999fdddbd1d4cba149c121507bff302c47a849988a74168e3fd7111fb0aa5f4f
SSDEEP 192:AONq6kYQmiUynaw903tjzorYbraEXH6FZcRfqRU6:AONq6lhw9M8YyEXW+yU6
TLSH
T12F121B32A8786C7B5DE3A955F48736239FA5412BEB893F90DAEC171C04DF65C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 80eb7ced9c7365516813e9594f166e1a012c6399c2e6edb198f01c52e4b74af8
MD5 1b1ea5d2692280ee8e81d8babe632f74
SHA1 c276f3c636f5febc56f455346c2b5dde407f76e0
SHA512 19e42402186df8fa6945aa72a5bdba09cbea5438441aeeb9dde91d7f539ccbe2fe8882828b607bdbd79d719d1d6d7db1dc85c0f4f7f9ed0903e55371c760b3ea
TLSH
T16DE00146D7015079D01D423000431B102FA6D02004E2238B9B2001582C363013D30A44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 afcde77e950900a3e0716e2ec8ccdb61b73e648c1689e77e9f850a3cddfc7c12
MD5 5ee5606bc91f997cdf90c1321658f24e
SHA1 19461722249067b7f48d5f7181b073fc4405068f
SHA512 874737fec96a4f62697b7f3c085cf0f124daca82c54b52cfe4b0d743053d23c276d6f13ed8ad9ee12ec5001f6d7fc533e851917e9701aef517ad0da097987e39
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe592c36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592c36.TMP
Size 392B
SHA256 40f3798a2c28b5e75e7801a0e5a07ba284f90fe72173ba2de92e39ad8232f507
MD5 92f190adcdba8eabf73a20a06f2f915f
SHA1 c63af8c621f3f53bb3d1b64ac95308f8542b0dfb
SHA512 21eb58a2f5bcf940b41c1355a2972fea2173aba0ed5680223c0377bc1deccef24b5ac1ee7ab5fd0705e9ec329f8da3d5165ddec8a9698afee863f7d2668985a9
MD5 SHA1 SHA512

Submit Download

e5ef0b76-7770-43b1-9419-5ab4885e4fff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e5ef0b76-7770-43b1-9419-5ab4885e4fff.tmp
Size 20KB
SHA256 b878b7cc48f8049444b6aa35624795f49efded8780a14f19dea8a3787398d104
MD5 101fb3ee72a1f1982477cf98f86fedfb
SHA1 b1a7055df0da226e7574c17931dda3e340afd4d2
SHA512 47576360f3f1f784fef16af1d30ee68d728ce76f249dc39fce76c16bb9e92219e6657501b092902060adeff64d59439d3279e0dba585ddc4024999405110b09b
SSDEEP 384:5ZcIhsNnkj3BhbNwkM8YyEXW/yOOPrXLpe8C/2:RhddlMwyOi9Px
TLSH
T1B0929E7198B82C2BADF6F945F54627239FF84427F2C82B849AEC970C05DA55C131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

545964da-af1e-4018-afe7-260002a5f54b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\545964da-af1e-4018-afe7-260002a5f54b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 be9a9d6b293b00ef2037d08b836aaaef8f9f856a56954c9323f02ce9105b681a
MD5 2dd185da102ee4cf96fcc0ce6384db89
SHA1 876096f955ecb89849f4d3fc40a7721fbdcef9f9
SHA512 9a38cb02c2da36a8ad99cfcd22b969b059a932e39cdad5f94e8b74b038ebf505aab35b23ca86bfbb34f308a9903adfd374c87ed61b8269fed29998c6854cfe36
TLSH
T1DD41FA68E6EA1148B3B76F4A6FF6A86D583E79372F06D45D00110D4F0A26B40C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download