hxxp://forge-de-laguiole[.]com/de/?gad_source=1&gad_campaignid=12544185339&gclid=CjwKCAjwhZDUBhBGEiwAbi5bjk10ss60nP_mX8IPPdddSS2Li4lZKda2lQrdVUneFrKe3tnrF9XeQhoCfv0QAvD_BwE

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://forge-de-laguiole.com/de/?gad_source=1&gad_campaignid=12544185339&gclid=CjwKCAjwhZDUBhBGEiwAbi5bjk10ss60nP_mX8IPPdddSS2Li4lZKda2lQrdVUneFrKe3tnrF9XeQhoCfv0QAvD_BwE
Sample260818-pl8dsabj5v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315295808465049"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{9417D560-5503-4D2D-9229-A52069FCAF14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3788	4788	msedge.exe	88
PID 4788 wrote to memory of 4792	4788	msedge.exe	89
PID 4788 wrote to memory of 4400	4788	msedge.exe	90
PID 4788 wrote to memory of 4400	4788	msedge.exe	90
PID 4788 wrote to memory of 4400	4788	msedge.exe	90
PID 4788 wrote to memory of 1300	4788	msedge.exe	91
PID 4788 wrote to memory of 1300	4788	msedge.exe	91
PID 4788 wrote to memory of 816	4788	msedge.exe	93
PID 4788 wrote to memory of 816	4788	msedge.exe	93
PID 4788 wrote to memory of 816	4788	msedge.exe	93
PID 4788 wrote to memory of 3652	4788	msedge.exe	94
PID 4788 wrote to memory of 3652	4788	msedge.exe	94
PID 4788 wrote to memory of 3652	4788	msedge.exe	94
PID 4788 wrote to memory of 4692	4788	msedge.exe	95
PID 4788 wrote to memory of 4692	4788	msedge.exe	95
PID 4788 wrote to memory of 4692	4788	msedge.exe	95
PID 4788 wrote to memory of 3456	4788	msedge.exe	96
PID 4788 wrote to memory of 3456	4788	msedge.exe	96
PID 4788 wrote to memory of 3456	4788	msedge.exe	96
PID 4788 wrote to memory of 2032	4788	msedge.exe	99
PID 4788 wrote to memory of 2032	4788	msedge.exe	99
PID 4788 wrote to memory of 2032	4788	msedge.exe	99
PID 4788 wrote to memory of 3740	4788	msedge.exe	100
PID 4788 wrote to memory of 1316	4788	msedge.exe	101
PID 4788 wrote to memory of 3740	4788	msedge.exe	100
PID 4788 wrote to memory of 1316	4788	msedge.exe	101
PID 4788 wrote to memory of 1232	4788	msedge.exe	103
PID 4788 wrote to memory of 4164	4788	msedge.exe	107
PID 4788 wrote to memory of 4164	4788	msedge.exe	107
PID 4788 wrote to memory of 4164	4788	msedge.exe	107
PID 4788 wrote to memory of 816	4788	msedge.exe	119
PID 4788 wrote to memory of 3932	4788	msedge.exe	120
PID 4788 wrote to memory of 3496	4788	msedge.exe	121
PID 4788 wrote to memory of 4840	4788	msedge.exe	124
PID 4788 wrote to memory of 4840	4788	msedge.exe	124
PID 4788 wrote to memory of 3892	4788	msedge.exe	125
PID 4788 wrote to memory of 3892	4788	msedge.exe	125
PID 4788 wrote to memory of 3744	4788	msedge.exe	127
PID 4788 wrote to memory of 3744	4788	msedge.exe	127
PID 4788 wrote to memory of 1076	4788	msedge.exe	129
PID 4788 wrote to memory of 4576	4788	msedge.exe	130
PID 4788 wrote to memory of 4576	4788	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://forge-de-laguiole.com/de/?gad_source=1&gad_campaignid=12544185339&gclid=CjwKCAjwhZDUBhBGEiwAbi5bjk10ss60nP_mX8IPPdddSS2Li4lZKda2lQrdVUneFrKe3tnrF9XeQhoCfv0QAvD_BwE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffaf7dbc188,0x7ffaf7dbc194,0x7ffaf7dbc1a0
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,9932694389902903094,6711921723825088233,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2370279294083123842,5958543083251828141,262144 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,6534160732885066050,14124013612601996739,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14664285486957560580,13226313733078439876,2097152 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,1274904403099250263,9245870138307856222,2097152 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,9052698038409320591,6550977751658934431,2097152 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,969993549814203940,13827830477958600091,2097152 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,4315319504934982258,13534290126894788879,2097152 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,16165791406066353205,5034844265637225283,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,3000084165984952038,2746678233385550519,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9157845299599566502,13915026693009492499,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9157845299599566502,13915026693009492499,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6264,i,11222474661548915247,15715748398529584742,2097152 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,15265365762440689614,14437307383098430444,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7665727327295530148,11126117842688321978,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11085369784968308652,1288297563803689465,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,14510663145007184823,719675642078289110,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16466668902231328067,18297997915164600003,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,8451253773294290110,12718094522869529692,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6828,i,1914308394836660156,13990035349918116925,262144 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,4477113151381431354,3197730596115529386,524288 --field-trial-handle=2244,i,11334076484506619566,15838775224779396313,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2e24e08605c7cfca52b6d268d14d7afc67a5d9586b645c6f44aa25690cc0e303
MD5 4f4cd3ded1d1752b942c3addbebf89ca
SHA1 5fc0017fc251880a23bbf0593cb282f9a57583a4
SHA512 97c207a1b02c7e1049bb472d38ca09950697a0b231fe72a08ac3be1dbffb50841a7a605c2c037794a7e6a9554e1f3c8a08fff73a8459871d52d522effc66ac0a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 f9aed7d96dffa60c906f6de68cc41b195e9617d1261dcaf4edb81e10f20f7a20
MD5 caff978ea96ca6fe52d6156d0a01c2b5
SHA1 2a642abdcaee0e33b0fea149be9e47fb5a069014
SHA512 9a483e2a48e9b89285e178d70bbab8a887a4b112e40d3cc7b17847fcd9ca463c90544a67b555a0c1f2f7a38f7e5a089c8389c850d4c1d47f4d08d7655406aece
SSDEEP 192:PjVKabihoo//LLUK77WWEryy+NssaPGqggMnLO:PjVKabihoo//LLUK77WWEryy+NssaPGi
TLSH
T185E16756C2D4C79A8F0550DB8EA0939C9170370EEBDCF91913CD8DDD388E49BA5B2B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 104KB
SHA256 c5788038d25aa463b155a47c8027dc2db23500d8f0cd36060979dbcb1d68d7a7
MD5 d79f84241141400a1d0c270bd7cc0316
SHA1 72acc04dcc3469bc21953e0ae5d8a355559807ac
SHA512 8d68553043b8af913a9846dcb2be920f41f172a5c8eab62a9f0a02f0d195d016d908642963e81027e428265a1ee1c5bfd102572283e004dd6da92c49449321d8
SSDEEP 1536:w51ZsfflsStzF8NmAyLrt4tNr5VXaqR+HDg2o0MK8wJQucvyt4UdICTeEp8y+W3:wJkdsTUd4tN7Xf+NMbwJ1diCT98yB3
TLSH
T18CA312922DADB1E13CA2CE3E10508ECE66548160BC5D612FD439F9E7E72E7A3C573684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 138KB
SHA256 5fea2530f06f603213a09893246f406530cef21ba1ae60510040179bac16d76a
MD5 24d38726fcec72841f27bc4e9ec6b8ba
SHA1 819b4645f68e058496ce3fa0f6fa1da5e1d02bb6
SHA512 e4f2e696e4cadb71389b32ce4c10690a47673dc89d9d5fbbc5d43ebaba53aa22d4788b7c8cd97e5bfed8808b57d733e4025628f184b66f1694a80b5132e791d4
SSDEEP 3072:sE/PLhLwOKrOT6VmxfvKFoiVEg9mUJVP6+bubdbK+vN:sIwOKrjkiF1nXJbqUQ
TLSH
T136D312E46D57D1921E1365E0D3AC06624FEE913CE2188BF9F53F2AF020DD719168DA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 e3492bd350c176e9d852f148a548104e58b94b836b3a0466443202d9857a96c7
MD5 2462f14424322828b0eeda775fdd5e53
SHA1 71b882f53494e5e96f4bb64a8b538c81273e00e3
SHA512 41fa9f23eb378bf135662314c7756e9acaa23ab33e5abb991084dcd8a3eb68ef99eac44f831d5afc5e2843804a118f7c230272c398855ff75f4f4693a14716d9
SSDEEP 96:ah2sTpJx4cFb9VcnjGktqAzT0gEgBF6/EZ2YzD:s/qcyy4JzT0z/62KD
TLSH
T16A91B218C69D0C81EB601DB9EEF9B63130B686D60993CEC695100DFE6B4A7DA4C9F50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2274797ebf09b3519aed19415161522b467ae83edc101ff89455f853e005df58
MD5 9cddd13f9eb2fb1b277e06ccfebafe13
SHA1 8f601b6e1676307228cccbbc5c9c27a946602d0c
SHA512 c585bf6a99d4efff9cf21459add0b37ff57eca7c0ed7aa4e692ed7610558d13afaa820b4fbab6791a44e625f6f495f84c0c87197ab3669ee3433015fba31c83d
TLSH
T12D816F49C69D4C81E7602DB9EEF1B63030B288D60993CEC296104DFF671ABEA4C5F507
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9abc8c6dace3f24890b0c2a7dc0e27d9d70eeb1a2167261c35e2ce9bf434086a
MD5 6ee27747128fa06cd62b5dc0184a57a2
SHA1 99fab38792a30f3d6e37cbc98e14f430e67d8a54
SHA512 43a172f95222270ed0f1eef92e2497f6506abbcb42ec76bcf78b6ea583476655ff60cb083cc6fe4ffb4128f512d0b9b898300531cc4e97739541888101a308d0
SSDEEP 96:dP/Yh2sTSJx4cF79VcVjGk3qAzT0gEgBFi/EZvhzY:dPKYqc4ymJzT0f/6v9Y
TLSH
T10991A1088A8D4C61DB601DB9EEF5B631317545DB0993CEC291000DFF278A7DA4C8F50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58843e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58843e.TMP
Size 3KB
SHA256 4a4123afe93c105c61cf38a15fcfd06905041a142a1c555ff7fa919ebfbb4316
MD5 a2909b13e4cf1a4e455d25a8b4b08c1d
SHA1 01f7b42359ccae869b21d8334133be73a067e3cd
SHA512 adceae562768c1bcbef04c717eb1e93aac8ef7d33361926d340dd27c36cfdd0a042fd20f5dcde75d60282b6a77f72add65f2b9decff566d1d75fb7ae9c4f3945
TLSH
T1C9717F59C65D0C91E7601CFAEEF2B27130B288C809A3CED5A51449FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG.old
Size 350B
SHA256 55fc6df8f21a6a4c01ce90e99fc08d061a2c8c68e21da9bec74c5d3771d655d4
MD5 42b148700473d07580bb130527ad6380
SHA1 cdab5bf71357c671ca268cc70d912bd8ed000a2d
SHA512 b8c1d52ae52d8e2b6cf0611066af59eb6fa41f34504910cb0c4743d698924e143f89775a0ab36e731ded354af834922a8a6264f06f41b28b2dbc52768216a265
TLSH
T18BE0D860A4C9C2EE6A8124C39B2A4309D2A0375BD388F9633F49888CBD051497243745
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9652196b0bc4cc762c5e89277f374bfc1ce02c507b6d296ed67779b2fadb970f
MD5 cf26b86c95460c9ff8a8aad7bd65614a
SHA1 7817d80add95813005fece83fdf8adbd896a9dca
SHA512 64958423b4df7385a9a6f7b6614af35adda66e18cc3b1f7c1b3b755e2fb5435966e66b9e19c8ba1d4f2513de882d4dc6fe52799cd345b46c707b8e380af0bd6d
SSDEEP 192:DIxWO2bt+RioqeGe3RSfjWCbaPCadIkaqngDo+/BHa2jV1Vsj0:DIxWO2bt+RioqeGe3RSfjWCbaPCadIk0
TLSH
T16D129EBBCBECC12DCCA59AF09628EE16CE1A096483187D9F85D4AE4F93E1571D100E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b8f72ca646f628df3f43faa37fbc6029780da9074bb0fb457520530db9079f26
MD5 fc06d7c7f9d058f857ccba4100906c1d
SHA1 45b3fc1b8f7cd96c0e0dd513e19fb4bbce3e7514
SHA512 145eb141209252a808cc525694e31e53677821ec1134376c46cbfe186453ce893bc91a4b79142ab4de97da8e92e0b9202b1890eb42796bbaf91245dbd43cb59c
SSDEEP 192:DIxWO2bt+RioqeGeBlsRRCJHjVRUaK1VWqi2ZjvWbfKeblAqLDzYk:DIxWO2bt+RioqeGeBlsRRCJHjVRUaK16
TLSH
T1EB129DBBCBECC12DCCA59AF09628ED16CE1A096483187D9F85D4AF4F93E1171D500A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 006d941b7348c400a1e2be3a15d35bde624c2b54aaa93635b5f52fb03de0cc77
MD5 08f5c042e7e44c73a2a15d6cb91c8466
SHA1 79b4b5a63a4824c4df99ecdaa0e2f28fea1bbd4f
SHA512 21e311cbdb2b768a10efed6d644b47b6de32e504b8879dd64e0d88ff72dcad2baf966ce62adf2fc2db6d457e3e24148bc5ae7b1d1b7d73be29941672ec2f9333
SSDEEP 192:sxZCRCyM/jK1Ml8Mk7/fQszRVAIdp0XHW6+WNjZSv/YLQun21IgrJ:sxZCMM7/fQszRVB+HbAv/h9
TLSH
T18C52F8167A34A977CCCBD309F955BF53D6F5446292901E84AAFC891C04E3AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 839544895b89373e573a3cb15608847bf92d655a9a6f25b1bf955ea0c81a7702
MD5 74fd13c08ee38521818ff0d6243e0468
SHA1 f59bbd4024c525df28974fbf603591d469d78c23
SHA512 1af80c1be6d287be479d02b06b7e7f9eb59ad1b9fe51f6919422f1365dc5465e790f2739498fa875c59187e1a8a61b8cacd266b1bb330372f676889fc086d5d9
SSDEEP 192:sxZCRCyM/jK1Ml8Mk7/fQs8RVAIdp0XHW6+WNjZSv/YLQun21Ig5EaJ:sxZCMM7/fQs8RVB+HbAv/hp
TLSH
T15052E8167A34A9778CCBD309F945BF53D6F5847292901E84AAFC891C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 05cb8e5a50a26e597f78ff8d3914ccb04822186aa2ec3cf5733f3b663bcfe914
MD5 a22c98cba39099b16c1b597a22b7a7a2
SHA1 e59a68722a163c9ba598651e9f7db70b954ed837
SHA512 91859bc73d7af13e964f8bb49059d27b487ce694987717e4478f64ac0b30b5b415be0267c9933fc4f451c2dd38b3b4d9af346e57092e158626f5ccf673cf34c6
SSDEEP 192:sxZCRCyM/jK1Ml8UQak7/fQs8Rl0Idp2cHW6+WNjnSR3YLKV621Ig5EwJ:sxZCMqp7/fQs8RltPHb2R3//
TLSH
T10C52D616AA34A977CCDBD309B945BF53E6F5847292501E44A9FCCA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 815fbab90217f7af2cfba904f45fa86417f9f54280fa97d9b117055f3366e5ac
MD5 40b4fb401fc6d1ee2798faf290ad6775
SHA1 f4ecbeb1f3bd7aa931495307414c7bafa9221db0
SHA512 ad381cc6f243da855d227e712223c64e33d7078126194122ebd10b33363585cbecc24159b5b48205d99ecb8896e1337576d7a29c0b33ebd4360a52327118b1cb
SSDEEP 768:rrs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN0roEY:rrs6pD1WvxzWju1jahILIsNfEY
TLSH
T1B1D2FA3B680CCB7E4F841E5CAC2AAF967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0830e9fbdf0b5376567445d840d3d1cad9c74bcbd32c12d70d898ecec0802a16
MD5 b81c92788d9d5c8ad805c459ec0f8fa0
SHA1 89fae9ca769818609d7ed918a8760027c0812e2d
SHA512 7933864bf20e2206ee891a26bd625285d9ffe48a26ed83b60af8823958a2e958f1578fc851ba19aebfc30511adacb7c1ca7923b733001c9c142dbec4856df53b
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8w3:KUAAKtePiwQKFWvC6EKfKuurmKA8c
TLSH
T179C10C12717B0A023D7E2B0CA255872B97427273305CA92B3BED44754DAAE394DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f596.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f596.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 72e37bc8a65ec2b0cbd766a15fb211456d0f1182f320558e5f409ad7c5156481
MD5 49a70882ba434ffbdbab75759a91e7b5
SHA1 17de7a140c9012ab22656a055e22c23c7536b96d
SHA512 3601ab02212556ab073c7e9eff2d7f5b5ec4947205aa16a74e58861b9d0fd2fbcab645e5aa1fdb7eb3eb27e118596de21f954f7dd3f9f40ccf6b02294ed1ff8e
SSDEEP 384:K3yFaeO8WsNRIS7ubna99d/Vfjtr2Yq9m6BMMj5kQH:K3IzhW6UafzjtaX9m6yMb
TLSH
T10C928D36BC746CBBA9A3B141E5473617AF74802BD5D53E9095DD9F0E00DB0AC231BD02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5906f942038f68f799898d73761b0fd284493a5439b96b22f24a0d51a436d4c3
MD5 27074240de932ea7d3d1867463c1134d
SHA1 57747b594b22e90b80d16a27563a48f800ddd64a
SHA512 9c5fbb7b744684ee68f321319bec6768cb21ebd7df8f76fa45c23bab87599c000a54cd49aee07b0559573f5ebc1c3868549ed52bff531c4ce9106b27598301a8
SSDEEP 384:RiFZ3yFaeO85sNj8TUNTUlIl/S7ubna99d/Vfitr2Yq9m6BMMj5kQH:4FZ3Izh5Owg8QafzitaX9m6yMb
TLSH
T188C24BF668E7587BD9AE6743A77E2D039E7CC067B4952A50B7884A0DCC870BFD306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e19072b4b82dc4557881937bfe94a6e12895d419e9307a071a33fe3f853f00a4
MD5 50883b85e53bffff9e0d525c9799ab5c
SHA1 629640d8d42dc2b6366edc24f17b5643d3fcc0e9
SHA512 9c8b43a61898526ce89400847dc6e258cbe62224cf9119386e92836ede0c0a0f4990fa751ea6c6877f698773dc1e643458fa90777fa9104005ad0bb18310bae0
SSDEEP 192:qONt6O7+3hQmiUy1QGttb0j+Fd/9UgGg6W8rU6:qONt615Gt99d/9agt8rU6
TLSH
T1D402E7356C786CB78EB2AE45F5872B135FA5117BE9962F81D6E81E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ab796dbb3bec0f1552b827efb3d526682e2984c04098ebb0ccfbf4bee544e064
MD5 aa878ffe019f21187063df2cded0ab33
SHA1 b61ba40ad2d15f0eaa862e324e192e1c0e01b766
SHA512 7ad542a7edb62e7029011d09ef8aa8cdd70979abb1333fa2bfb1eea3494b5fc43b44b6c1835e8c69647855fed660beb9890415beb20d51c3be91bb2e928601aa
SSDEEP 384:I3yFaeO8WsNR/S7ubna99d/Vfjtr2Yq9m6BMMj5kQH:I3IzhWlUafzjtaX9m6yMb
TLSH
T121928D36BC786CABA9A3B141F5473617AFB4802BD5D93E9095DD9F0E01DB4AC231B902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 192fb79cdf698effeb6d90d2bdc687f6c474ba23a333204da23ec36f203b6f09
MD5 6282beda8a6d4d91e5a4bea621fa7145
SHA1 037d9ef056bff40d0e4a7bab5100fcfd3be3937f
SHA512 2e4f08ea5e4b6fa731f99b4416a74168753c3ea75659d14d028c09864282e7db287a8f0a3a3e6d1dc00fc511f2af60f8c535963a9f43784cccfdc0a8abc39ea0
SSDEEP 192:/ON86O7+3fQmiUytQVttb0j+Fd/cQzDR84cNkqCwU6:/ON86PnVt99d/Vf0tU6
TLSH
T1B5121936BC686C6B4EE2B145F48736135FA58177EA8A3F80E5DC5E0C01EB96C235B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 695bff5ecd9fdf1a67b51cb0ebdfa41eabae632b9813b25a0f141f5671b60de8
MD5 97067715d76905a520e34d41fe2c4749
SHA1 c6ad399a9ac23eb02cbc73f46e53b4f99e71c54a
SHA512 aa87be85e06d75033ddf050e3024f772c67f5378c03136ffa2502b56edcfd8329cf7e44f2765ecd037989b3153ec095571dfeb80c344436f7f1d53e10eb9be66
TLSH
T1CCE004145040447FC114D73400C35F103DD0C0040375014457350F5D7D33F403130F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6001c37baeeb2600696da5d91384de72221aa45765b995ea72d59dc60d3cac20
MD5 a082d6d93fc90dde89664d00e64dd174
SHA1 8ce51806926cc389304c1226d75fd570d535c2d0
SHA512 a055d924e64c9c664ce6bb23d080bafcf41cd900fe2cef4a2b369b472752aea0dbde9cc97c05b9aa549fbee7c4ce33729dc1687b5a3854793c142c72f3f21b67
TLSH
T160E00216534044FBC118973400835F103ED2C02403B602455F350A5D6D33B403D30F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 46fbe9267ec8b0c98f0599ef0675bdfbec678abd39248046467b538e57c091f1
MD5 93bdad7ba0f07299477c936724343ebd
SHA1 8d8839ecdd8aaff82b961b09ebaedcb8a34ea372
SHA512 b1a3b002460e4404c6c694c90abcfe7212ade1359e1bc0bfced003329af9b3ae3aae7466b13100a6d7ef3116b8d5037cdc63c21b1cfed5c73a01315334051729
TLSH
T187E00117934054FBC1289B3400835F103FE3C12403B603465F360AAD6DB3B403E20B81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4cbd1b6af8f4fe8e1c8c9822290518681716362495672fbf9097a925e3497a03
MD5 797e4b84ae8c393ee5f86d3f07357b2d
SHA1 e6101521f3866a0b4160397c2718db72a8de5990
SHA512 5db89e95c46004a43a195f9307cf8eac13858b9fad9bbf74d2237ad75ee0527ff0c8bf6acf68725dcc6cae727788cf94bae90267420b27584ea5a198d717689f
TLSH
T1A8E00117534044FBC118973400835F103EE2C02403B602465F350A6D6D73B403D20B41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5956d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5956d1.TMP
Size 392B
SHA256 8c493e20a932520f91935799876497db84be6abc3725e49ee7c5105d6a45fe09
MD5 178535e18fdd079a989374a6ad579adb
SHA1 ce187c936b27103ed0d77a68bb3cbcd2232c27b7
SHA512 d7d5b96faf9908345566abd2df23cc5ec1ce4d67c0ab8a9c969bb1ae94ac131743635ab8935724b2eb9960c4700036b64e095a37a29623974cd0b66d609bc399
MD5 SHA1 SHA512

Submit Download

0a717e2a-55de-48f2-b148-13d217a50f32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0a717e2a-55de-48f2-b148-13d217a50f32.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 82243155278fa147671a1febec481adcf6428de72c815d02023bf4d72a8a95b0
MD5 56acf1cc6f5fc0880b541d04964d0ddf
SHA1 3c3064ca2cf0af7e0c4e17ed0b1098e265204784
SHA512 ca76c3d91549de55fb0f43e423b9c4b0a11ff33e582b7d0e9f77d1d40bbb604ccb89a9baec4314330bd02e819cc88bdc67742de1f3c145ef0a63df26886d68b4
TLSH
T178412B58B6FA1144B7B77E1AABF664AD48BABC772E06D45D00110D4F0A67B40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download