ccc4d3d6d686d9752ee4eb157de746c48f0937e32fb5761c43640c5a317df57f

Analysis

max time kernel
898s
max time network
735s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260815-pd2w2abl8w
SHA256 ccc4d3d6d686d9752ee4eb157de746c48f0937e32fb5761c43640c5a317df57f
MD5 f34d01f5c23a3d0b779f0a186cdaa5ed
SHA1 a95c6e009dd6dc0f6fdde20f75fdbd3fe118b707
SHA512 1ae25c8e09dfd8b4ebaa464176058e717db848e7594f5482a72e7110471642bc57129b957d409f71c6a9b0e49b95bdf84e9d70ea6bec88635f1af312543796b4
TLSH
T1BF4121BE36F300022623B1025FBE7A2D67535503514DC829B1ED53448F22B89A4EBAFA
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312701741903421"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{844E7C96-A8B6-40E6-82E6-FD9F9B9EA638}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	msedge.exe
892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 820	2880	msedge.exe	85
PID 2880 wrote to memory of 1728	2880	msedge.exe	87
PID 2880 wrote to memory of 4756	2880	msedge.exe	88
PID 2880 wrote to memory of 3740	2880	msedge.exe	89
PID 2880 wrote to memory of 4756	2880	msedge.exe	88
PID 2880 wrote to memory of 4756	2880	msedge.exe	88
PID 2880 wrote to memory of 3740	2880	msedge.exe	89
PID 2880 wrote to memory of 432	2880	msedge.exe	90
PID 2880 wrote to memory of 432	2880	msedge.exe	90
PID 2880 wrote to memory of 432	2880	msedge.exe	90
PID 2880 wrote to memory of 1952	2880	msedge.exe	91
PID 2880 wrote to memory of 1952	2880	msedge.exe	91
PID 2880 wrote to memory of 1952	2880	msedge.exe	91
PID 2880 wrote to memory of 4020	2880	msedge.exe	92
PID 2880 wrote to memory of 4800	2880	msedge.exe	93
PID 2880 wrote to memory of 4020	2880	msedge.exe	92
PID 2880 wrote to memory of 4020	2880	msedge.exe	92
PID 2880 wrote to memory of 4800	2880	msedge.exe	93
PID 2880 wrote to memory of 4800	2880	msedge.exe	93
PID 2880 wrote to memory of 368	2880	msedge.exe	94
PID 2880 wrote to memory of 368	2880	msedge.exe	94
PID 2880 wrote to memory of 368	2880	msedge.exe	94
PID 2880 wrote to memory of 1460	2880	msedge.exe	98
PID 2880 wrote to memory of 1460	2880	msedge.exe	98
PID 2880 wrote to memory of 1460	2880	msedge.exe	98
PID 2880 wrote to memory of 3948	2880	msedge.exe	99
PID 2880 wrote to memory of 3948	2880	msedge.exe	99
PID 2880 wrote to memory of 680	2880	msedge.exe	100
PID 2880 wrote to memory of 680	2880	msedge.exe	100
PID 2880 wrote to memory of 1556	2880	msedge.exe	102
PID 2880 wrote to memory of 892	2880	msedge.exe	106
PID 2880 wrote to memory of 1868	2880	msedge.exe	107
PID 2880 wrote to memory of 4700	2880	msedge.exe	108
PID 2880 wrote to memory of 4772	2880	msedge.exe	109
PID 2880 wrote to memory of 4772	2880	msedge.exe	109
PID 2880 wrote to memory of 2684	2880	msedge.exe	116
PID 2880 wrote to memory of 2684	2880	msedge.exe	116
PID 2880 wrote to memory of 892	2880	msedge.exe	119
PID 2880 wrote to memory of 852	2880	msedge.exe	120
PID 2880 wrote to memory of 852	2880	msedge.exe	120
PID 2880 wrote to memory of 2280	2880	msedge.exe	121
PID 2880 wrote to memory of 2280	2880	msedge.exe	121
PID 2880 wrote to memory of 4144	2880	msedge.exe	122
PID 2880 wrote to memory of 4144	2880	msedge.exe	122
PID 2880 wrote to memory of 4580	2880	msedge.exe	123
PID 2880 wrote to memory of 4580	2880	msedge.exe	123
PID 2880 wrote to memory of 4352	2880	msedge.exe	124
PID 2880 wrote to memory of 4352	2880	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcbbb9c188,0x7ffcbbb9c194,0x7ffcbbb9c1a0
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15421593131570000388,12001081950183402862,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,6590447657098870254,11364267075286098579,262144 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:2
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,18376352435653086030,17727180236308432657,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10313803689259874049,2159682227674787808,2097152 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,17807271256428658624,13771463743352909878,2097152 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,16594545318532370099,825046506884240650,2097152 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,7123682919203986111,11447649147989987453,2097152 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3476,i,4187398083473709794,13136737707048334525,2097152 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,9168345223551264664,17121595935436104912,2097152 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,1050836790435956429,17160014584820357931,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,5854181631172377866,14232539432183693495,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,12006539547646672173,3243189215499577220,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,12006539547646672173,3243189215499577220,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,2879237982374797736,7541397413701404010,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,7967605235754272026,11516161245225990238,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,12658511047704068401,14948789971212474105,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,42011095065694378,5185709286522432746,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,12625454405920766858,101456151724513829,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,13316760295942069572,6307529118273327680,262144 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,12694620704987896825,5281520773796045415,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,8269781468170480954,6209212097882406211,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,8295875218857431003,17307463004118711604,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17868503729879820664,15390555772949238617,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,10466759186258593901,16807109456093041917,524288 --field-trial-handle=2844,i,13951803498605891027,15045098616943863923,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fdfa2b05beb03dadf9960c74292b8be74b38f850ddf914d11f64d1d8a7352f7a
MD5 934efd173892299f3adf68ad4d48db35
SHA1 a9086a9a8d73f90d456d795f755f34357e1ed2d5
SHA512 0c55601cd0d440fac0b2f014159a5ea968cf28872f29c2ec91548dc8e7f74075593e9faeda5a7c4e70d4a4dde6696b180dd37ef1d1dde94cd123e96c746d71a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1F6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

747bc953-e457-4350-bf3f-56276a8d10e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\747bc953-e457-4350-bf3f-56276a8d10e6.tmp
Size 30KB
SHA256 abd0d1bdfc802956e74963df789d799b7eab81d4b96852a75086ba292aaa7ba5
MD5 24cb17996c38573702608571af165ab9
SHA1 bbf5eb16b02e89e7e69f95f93cd17d842f76901c
SHA512 82efc4389debaabfc5a16f19dbf30df499776ebeab9e7e016e4150f5d5092bbba40ff4bbedd3cf988208c2ff0392df22df355a9a5355c5d5624185e06db4a29c
SSDEEP 768:Go8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdJrohkMUnp:Go8iJPNWvx76ru1jahALocdi5Up
TLSH
T1F8D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA884C03CB6EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 3930370a55188ac6278d961f65bb82f269311d2da62b265fb24c44d8338f9343
MD5 636de7006071355f6530eb4c375dfff0
SHA1 ec20d16155f4ff47f3acdee3a6feddf1e8ade7a0
SHA512 bf14d02940dec0ab2e78c7a2ad004d8fed07d72105023d9a6f953587d28ae26d5e0ab948898da43e0d513c48a122ec1177b435081706f8b58ccb9d3bf11875ab
TLSH
T16DE0D88796A0C9DADDC29647908B72644A516E87DE8CF4DD365674D824808088B4688C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c0e4056a75a050b32c160a9961626685a752327775334825da98b016a9ed25e4
MD5 bc34357031ef58524bf9254c7ed06aba
SHA1 5ec140869914b9c784dcf95f7459b904d35a92bb
SHA512 6427f8b8f8587fa69dadf52743de86be2e012dfea6d4472a07d3b67123691c06a1b00a1efa10b09e111668c11d100fdd0212712426b82266911e23d2976154f1
TLSH
T152E020C614D9CA3DE950758753D4A30CC7D03F8BD2CCB9DD1B00C88570014506AF39D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e8c44c853894ae3f356c8c58f3bbe08f555fbac864a30a2ba299cae72e0272e2
MD5 55d3595e9014a0525e6772d2161e9f7f
SHA1 2850c2bb9ad7ffc8f00c75f9c0b1dc06e25443b3
SHA512 d2ac82ecc38d2acce297af2dbd1061cd58d15169be0866b22e24757191648f78c5457a048dea514a8ffe62499f2095e4713379f25a2c4f703bf6e327afca8417
TLSH
T1D4E026C504EBC2AEEA44A58792B5638C83A13F6B92CEFACE2B1884C43001448A7A35D0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 454851263ed36c40cdb7111e4a366b59fccdfe5a0473f8d4e7e5a828aff557ec
MD5 422d693f6698a155ddfa28f32ce950d7
SHA1 ce081aa8566cf94aeeeae1ff913f7c0bd4bbb9be
SHA512 ec5f830a95617ffaf422a370c0f8e35c418865f5169ef697758611021d6ef91ebd206e62d66e405dd5ded8d4b427b3db7456fbb355c832f7d2f5a5959d78f383
TLSH
T18B713C2902FE035DF3222232F1D90A1434F3679B0E937D4E11A88F7C2532B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586aea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586aea.TMP
Size 3KB
SHA256 94720df6f235006ece76c844152a7bc8c577bf3943958cf46192097556adb9c4
MD5 19f47664ef5362324a39e59e12da3d5c
SHA1 f915324ccc28d14e491bce78ee6fd0825d882bbf
SHA512 9941087f71747f68543c828e989e84cc590002397d0eb7b84a8b868a6d14ba53b8e3d4c4f29a0a730f9ffbbd6eb452c95634ad07847c2aba3d65415085171fa3
TLSH
T14D713A2902FE079DF3222232F1D90A1834F3679B0E937D4E10A88FBC2532B348DE5408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 397d28081c49ad71cd006980c65f72031df7571856a5ddaa19a7da2a1f0d6c25
MD5 e881f5a852d323fd2a6dc5de1b6a42af
SHA1 4527101937f8d9556dacbd17bf2ad38ca89d8a7c
SHA512 d2cb2fc53908ddfdb6908a1785d34f87b2190fc7980d0b17d8a5ace5226ae66a0abe5c8f824da7f5d51be850d08e4fa601c4659b9bfce327370f47aefbd8622c
TLSH
T195418DB6C3D8866DDD1526F05A24BF6BCE1D091942183C16CAD8EF4BA3F2470E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c99ac8638496cac110faf7f920ffa357e4ff581e9755117ad0e74809bf481503
MD5 0318558535807907fdd02bb2aac7a491
SHA1 5bc32a79b5d1ca09a63dcae218fa54f4c6a402b7
SHA512 092dfe5b33b491dc160fecbf727894e55dc8fa06f0decf7d343b32d324b16fc7645f8c6ae88c764264046719b382cd6f34eb866df515a686859e033e5f6b7243
TLSH
T1223180B783E5875EDE1162F09A24FF2BCE2D0516425C3D258AD4EF1BA3E2071E10279B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c55f1f9614be14404451ab6c543561788b166bf95859280439068cf28d5d28e1
MD5 21ff6c8cb8ac07e47c9a02c769158570
SHA1 d9d74ae3d22a1cdbaca7109be29f7071c7ab9fc5
SHA512 1448f1ac87a38a159e17153bb6c453963a13d83cd778aafc33b648f8d9b97decf8cd224edcc95d72545beef9dde099ea999bf3da68409658b9f0368c0a5fc5a5
SSDEEP 192:sxZwRdyM/jK1Ml8Mkt/fasZp2IdpdMZHW6+WNGY4ws6mIgrJ:sxZwrMt/fasZp3mHbGB9
TLSH
T1B442E711AA346A77CCDBD209BA517F53D6F94473A2900E44ADFCCA1C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 183bfd0d639c91b94e78364549e5a654ac4d46e434f2d7399c8737c6e44d4def
MD5 0387f7c357240ec8e89814df3ec8fd8d
SHA1 abdd970220762d526634e80e6564780e27aa9ed2
SHA512 837aa957260b71991600f4285272d6a6712e3b3fca4c52669caf1d354247b8b994ea19ac7e927c736486b42e3f00c173cca80ef449e0febf829062c8df1c3a57
SSDEEP 192:sxZwRdyM/jK1Ml8UQVkt/fas7O2IdpHMZHW6+WNGY4YpgmIg5iJ:sxZwrqet/fas7O3cHbG0g
TLSH
T11852F811AA345A77CCDBE209F951BF53E6F9447391900E44AEFCCA1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\temp-index
Size 1KB
SHA256 0caabbcde089567329d01e79fa97f5e788822b963606ade0b426a16299d07999
MD5 7f33b80d19f155df183c9d3e98a9d1d9
SHA1 657bc68943696a93e01006ad92c95bbf52ea3418
SHA512 b3d599224f8177457346d1258de8ef365eaeef9aaaf036b068f71e4556e7cfb5fc08535f5abf014c1e5db355baeb425c2a422b9a80d98921cc78bea99c540edb
TLSH
T14E3165494DE5CE6FECA4427116B2587833B494DC1755E653983C3130BD2737A2A4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb02d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5cb02d.TMP
Size 1KB
SHA256 3f6dcc1e120461a68219373361bcce203e59796cba58f8c2617b82cf285da159
MD5 6d81db34464fab4019eb8728588dc10f
SHA1 c039fe59ce0384690aca15621b6e72d1c4a8f19a
SHA512 fce26c5eb64f293521e483b668f422a6ec97af0704eb57b7c69fc1161b7c374eda5968357b6a78c31c4c6821d1e60fd657c29f05f47ae0ecfee4e86efef19247
TLSH
T1E031AA4B4EC08D1AECC4407B0EA3A4B8333599404712B783947C1134BD617BD1E4E0D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8644c1b456e74ccf6fec7dc770073c032ae8d983fabbe22283d674d7fc546de5
MD5 eef5f9da792e8283a5e75568e30bb35f
SHA1 28b95150786974d747d887fc5c91286a36ffc425
SHA512 79a4a8983f052c29b52310f29bcac84abf00f8aeb7ea46c038a1b9e0d17c8161da624cc97d597b588197d8a3402c4e7783d22f0ae1d1466a0b3a20aa13c432d2
TLSH
T17AE0C0F72EE72880FEBF63E1187198B00241B459D584BC8F2416FB9324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bad73dffd9c51640ae5c939e41760b09bdece57bcb8b1af5fc9b2dfecc87ba93
MD5 6cc09a7a4f0777dbf66dc5ae6977a359
SHA1 9990989683e82a1041cf0c53dfd60cabf0671eed
SHA512 9bc941fdc03eaefbd3e073a11ffe17e24c77c22bde18668aebf440085cfd8188fac12bee5e8d93ba8db1eb8eb37e234cac492678701b66b19e5ce61327c25718
SSDEEP 24:KdXfu1Mapdddt45V+AIjptKiahant1E/9SmHMC89WyXYtfo7Sa3df7z4Lv+CIjn6:K0YIjKlqcbyRyIfKnqo3FIdKOY4fyH
TLSH
T19091694374B702513D7E290999D5CB565B83BAA3300CE86B777840B10EABE240DFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5905d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5905d2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4637bb7eab63c30062b6e4d979fdddbcf47496a4a4b5b04d22b9ca0d64891b99
MD5 8224110a88112167b2044d025cbb1b90
SHA1 e6da58fa52d1d0efd29730c7bdb77909eed6eb61
SHA512 30c23237feb61d116d6d3da883b99301ca9a5fcaaac0e7d29e01195b6baf067039034a82162c7993ef70e66ffd37c274452d4e8dac99a4a5592ef8cd0b1c4b71
SSDEEP 384:SZcIhsNChKYSNkywmfHMsLOOPrXLpe8C/7Be:ghQ1XHHOi9PMe
TLSH
T17B929D7168786D776DF3FA86F88636134FF88077E7C42B9495ECA70C06DA6981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 51ff7ccbe4fa265d0075ee094e028ec6b88eb479a4dc5583337e6d0a439a58b5
MD5 c30786208cd42239214128b478b47db5
SHA1 afe7919743922c623fa2522371535c67ede95b48
SHA512 a25fb52082d0eea864472683742fa3eade6588e44ba3e45bc5f5c12fcc2b5b3f027fbc33980c4e5a7768ddb87101a0b90236fe6a818b708c46a4eb793ebcf84f
SSDEEP 384:LiFiZcIEsNa8TUNTUlIlIKYSNkywmfAMsLOOPrXLpe8C/7Be:mFQEDwgd1XAHOi9PMe
TLSH
T162A26C7258A8997BADB7AE85F94632138FF440B7E6C46BA4A6D89B0C01DA1D81307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9f2ee4899d4021c186bcec9adc0e5ba91015b54b36a41e2d0cf6de5025773137
MD5 f10d5dbbbb248f1561cd0bf4c57e1879
SHA1 92bd96f021305b1494fb3f3d481648390b1b334e
SHA512 c9c2fcd0273d311e20efc3f069631edd86ecb954b961f45f9b22af0655e901f2260dde4801fd3805a73cbffcc85782329748b8d2bdc3032ea5be199ab25367db
SSDEEP 384:BZcIhsNCIKYSNkywmfHMsLOOPrXLpe8C/7Be:JhR1XHHOi9PMe
TLSH
T135929D7168786D776DF3FA86F88236139FF88077E7C42B9495ECA70C05DA6981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9060ec2c49610b9670af26e9af64cac7fb0ca06f0687341a4c05858ea096284b
MD5 8428e7e9f667d1f3820c5550d0fedbc7
SHA1 c5b8a205475607b15a885a87ca706f99bcb16310
SHA512 2018501ba708dabed89908428bf0209f9d644816b32afe6ac97711a768f92100fac4921e0b2559f0935b02713b8914d5bbd638f58d645c87d8d002ee2e99bf88
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5Z5DdBhPwivh50xy0SFYKNAxOYow:gONw6kDfQmiUyrDZ903iow+Qi990oU6
TLSH
T1F702D93568786CBB8EA3AE45F44637275FA8117BEAC52F85DAE81B1C00D765C1343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e6d7bd4ef54ad6026d9309a34b1fe49b014e5b5db9d60c073ea7a288825a976
MD5 d0d5c1469ce6c3dc2ca29f7254797318
SHA1 5eae18a23ce5fcdda3d96012f280b5499cbce73c
SHA512 292e66dd376894d538f5c86c7d22d7ded8fe135bc9e6cfde0073e8edd7e9dfd9bec6a7c81351ec3f352ea5e7ae11a1551242602fe8e59cb71bb5cd35fd9b966e
SSDEEP 192:GONT6kLQmiUyNDP903iowmcEJccR1rqdsLU6:GONT64IP9ywmfzMsLU6
TLSH
T11F123A3268A86C7B9DE3A995F44736238FA48127DBC93F90D9E8271C05DF29C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4e689a0-7719-4b9a-8794-6043465e2e97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a4e689a0-7719-4b9a-8794-6043465e2e97.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 72a0c958c9888e06cf420d79d2bbfa4af4c2993a18c60b59c8cacd2c5bb9facd
MD5 c0042dc7d495b4c9c0eb173e4b0dd163
SHA1 eadb0b759df6807ea9b456eb8f656dcdb5e2a3c6
SHA512 27f95ce7f58c080419591263b4ab81d5b9bf749912c5c5ab0304c749963902522980bcee9d998ae37917e66e439e1ae6ee5f3bf8fc7c36fbfaae409b0fa86dd4
TLSH
T10941264CA6F91148B3B77E5AABF6A96D487FB8772F06985D10110E4F0A62E00D872737
MD5 SHA1 SHA512 TLSH

Submit Download