hxxps://ci3[.]googleusercontent[.]com/meips/ADKq_Nbc1rwbUWS5kjJ1psah6Jm4sMHDiz3MEpFkLSOsqQGGsdckwyQ5vQ07uM3BTU_hjTqEIfq-xf2gBuTXHTUA4sA3wpqzbgqyMGpLylAnmAqWWBlXJ0WpHjt13W4wW3l_9txGWT0U0ggptdaPPOmmz9yG_yb41eKPT9aPmbDivrOJdYENr7JN6QFlp7BXarzl13tcmr-koaJhEI3Tvs2CBnto9AC9z0gCIWJ1NbRCuLV831qClDlItBlyq0IHk398OgnYvJpZSluV-LyVLv4HzEqDaDkGVwCi_ZO3GyQr9auy-tg-qT0oxI62zsF6quOnNUUw5d9-jDlPq0BzmwEOCqJOObpvBTO4d2-jEAs1j1oERuQZQB5YAdd3R-yyEWPWMoWvZRElUV_gtkjXStDjISpehUjxLXJk_3JyvPZoNoqhcaglzEv_ipKmcuCCiG9txMlBIPG2HgZB1OxrwixI5bFXvsc4Krw2Yi-j5cfy566QeS_r8C4YESj8eOxPsTNvOyKgx0zlzsxIk7ls2xDfMaAZoBQHTOnLdC3MAZWqz8Y3YUpQ533qN634Dyil8LOLZwPj4TOIcofDZTaBtBb-22nZYqfe-0a8UA0HPn0E5_zWUYceyI9Z4yQVVvvG0rYUJzvvseVH6iSoL3fmfcbfUV5kO0l8Sj4qYjwTbMVSgIPLy2LGQ9XmyuFb4RqM_ijdyAkDQuPnzsWDXz44eMRdl-Tf7ZYheAiOmJWtwKwHWvlz2rhsUysr5lWOgdeqVBXae-WrR1nIhhULhPBldDk6mxmLpWeIVXPxv42rnguLi_W7EvuEnejOCDjencAQ6BqR-AEshxF2TfqmZ9_4_LHWU-VAuQa-m0SVddm5PAIwxSg6PBu2wQm-q1_Dfh7oDRBRNBZnzi9vUzXAqjE-hgpzTw480R_LkM6azAulDDDMe4t9_yDgTNGArs_xepg3kiMj_Kze3av9iM0i4WHHUKG73u7NzAmanMF5AIHx6bDRTTWc9Tt8VhktMg2JlJOvKNSHiKPlS59qClF1_SmSjOO1vXX0D3G6iMeR4GqIPfm9KmVuiDKH2LtDmZ75nQK66VfAewNu0ODaLKZKw7totH3ajvo4-gDkFNMVevq_K3EVRbhVTtSKa1WzNxLHQHa3_l4EDRwwR6KZV-Mj3_kxZsU3wcmUUv4Gb7s54SmmmtASOTUPCMp3uLzTHXOTUTcbuAHwqJJiHfZqW4KUtZK2S46y7ubY79W2ZJ6-JAs3HOrnGxURWvpfMRaHWkqvm-flZIXP7TkraDZf3BDYyAozCpHdgZxLCeeLwH6ValfaIB0UuZAk3MeLm6_4Zb8wbKO7il3MRdW7EZFkyJGEUzz4TojlT88c31UTrDFlJwV2GulXVn_d4_ScwfqgMZtl82x-XUFikYCQN9SgTPPM3kjXqm0yY5JpOa-HPe8Y0KA9On8wYF61tMomrkioYGtSA5OSwcbHjzfTamZ80wbZbGtwK_izKD9iS-2Pu4oAJAloB4aiNiOyh31y20RMybEVmZmFVLVtSnCpEKt32a7JbSIwyWCJ3OxyeX9lKqkg4mPwfh_MO45xxS-0zlG_vBtd__KJssac8tnyxWreSggcJSo9kkreVdUCC-N_3jgK2TQgvdHe8Ar7byBxmkHV_X1ed1Us4bJ6uYZDw8qGjm_ztBNZxECk16t8J_gudbkVpU_p1x05uKW87fA0rmFcktkK62NF-6gRFzZDcR2UV-4Fa2o7TVoQAxFLBnl6vg5IZBtyqDfOlXPu3ohC39I8I_e9Ye2PJJFkufPjzjtzKBrLWvFWNJ-PteiIdJ4VY2kYRa5i8-ChWzFEnVQOCXN-D_ndviD8ECbx65SxjfTVO005bSED7d6zkVzmoDtHpXSa9-axZYDZUPZ8lnJhpSZ33gN6ij3aknjpvgdtW4SpxxZiRMIqbX3eZnCHbVqrmto_w_FqNnECif87LCgGsq9bURY0z3G87M3uI2C_O5hGXPy7h3j_3Wyr

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 15:32

Sharing

Behavioral task

behavioral1

Sample

https://ci3.googleusercontent.com/meips/ADKq_Nbc1rwbUWS5kjJ1psah6Jm4sMHDiz3MEpFkLSOsqQGGsdckwyQ5vQ07uM3BTU_hjTqEIfq-xf2gBuTXHTUA4sA3wpqzbgqyMGpLylAnmAqWWBlXJ0WpHjt13W4wW3l_9txGWT0U0ggptdaPPOmmz9yG_yb41eKPT9aPmbDivrOJdYENr7JN6QFlp7BXarzl13tcmr-koaJhEI3Tvs2CBnto9AC9z0gCIWJ1NbRCuLV831qClDlItBlyq0IHk398OgnYvJpZSluV-LyVLv4HzEqDaDkGVwCi_ZO3GyQr9auy-tg-qT0oxI62zsF6quOnNUUw5d9-jDlPq0BzmwEOCqJOObpvBTO4d2-jEAs1j1oERuQZQB5YAdd3R-yyEWPWMoWvZRElUV_gtkjXStDjISpehUjxLXJk_3JyvPZoNoqhcaglzEv_ipKmcuCCiG9txMlBIPG2HgZB1OxrwixI5bFXvsc4Krw2Yi-j5cfy566QeS_r8C4YESj8eOxPsTNvOyKgx0zlzsxIk7ls2xDfMaAZoBQHTOnLdC3MAZWqz8Y3YUpQ533qN634Dyil8LOLZwPj4TOIcofDZTaBtBb-22nZYqfe-0a8UA0HPn0E5_zWUYceyI9Z4yQVVvvG0rYUJzvvseVH6iSoL3fmfcbfUV5kO0l8Sj4qYjwTbMVSgIPLy2LGQ9XmyuFb4RqM_ijdyAkDQuPnzsWDXz44eMRdl-Tf7ZYheAiOmJWtwKwHWvlz2rhsUysr5lWOgdeqVBXae-WrR1nIhhULhPBldDk6mxmLpWeIVXPxv42rnguLi_W7EvuEnejOCDjencAQ6BqR-AEshxF2TfqmZ9_4_LHWU-VAuQa-m0SVddm5PAIwxSg6PBu2wQm-q1_Dfh7oDRBRNBZnzi9vUzXAqjE-hgpzTw480R_LkM6azAulDDDMe4t9_yDgTNGArs_xepg3kiMj_Kze3av9iM0i4WHHUKG73u7NzAmanMF5AIHx6bDRTTWc9Tt8VhktMg2JlJOvKNSHiKPlS59qClF1_SmSjOO1vXX0D3G6iMeR4GqIPfm9KmVuiDKH2LtDmZ75nQK66VfAewNu0ODaLKZKw7totH3ajvo4-gDkFNMVevq_K3EVRbhVTtSKa1WzNxLHQHa3_l4EDRwwR6KZV-Mj3_kxZsU3wcmUUv4Gb7s54SmmmtASOTUPCMp3uLzTHXOTUTcbuAHwqJJiHfZqW4KUtZK2S46y7ubY79W2ZJ6-JAs3HOrnGxURWvpfMRaHWkqvm-flZIXP7TkraDZf3BDYyAozCpHdgZxLCeeLwH6ValfaIB0UuZAk3MeLm6_4Zb8wbKO7il3MRdW7EZFkyJGEUzz4TojlT88c31UTrDFlJwV2GulXVn_d4_ScwfqgMZtl82x-XUFikYCQN9SgTPPM3kjXqm0yY5JpOa-HPe8Y0KA9On8wYF61tMomrkioYGtSA5OSwcbHjzfTamZ80wbZbGtwK_izKD9iS-2Pu4oAJAloB4aiNiOyh31y20RMybEVmZmFVLVtSnCpEKt32a7JbSIwyWCJ3OxyeX9lKqkg4mPwfh_MO45xxS-0zlG_vBtd__KJssac8tnyxWreSggcJSo9kkreVdUCC-N_3jgK2TQgvdHe8Ar7byBxmkHV_X1ed1Us4bJ6uYZDw8qGjm_ztBNZxECk16t8J_gudbkVpU_p1x05uKW87fA0rmFcktkK62NF-6gRFzZDcR2UV-4Fa2o7TVoQAxFLBnl6vg5IZBtyqDfOlXPu3ohC39I8I_e9Ye2PJJFkufPjzjtzKBrLWvFWNJ-PteiIdJ4VY2kYRa5i8-ChWzFEnVQOCXN-D_ndviD8ECbx65SxjfTVO005bSED7d6zkVzmoDtHpXSa9-axZYDZUPZ8lnJhpSZ33gN6ij3aknjpvgdtW4SpxxZiRMIqbX3eZnCHbVqrmto_w_FqNnECif87LCgGsq9bURY0z3G87M3uI2C_O5hGXPy7h3j_3Wyr

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

150 seconds

discovery

Report Analysis Logs

General

Target
https://ci3.googleusercontent.com/meips/ADKq_Nbc1rwbUWS5kjJ1psah6Jm4sMHDiz3MEpFkLSOsqQGGsdckwyQ5vQ07uM3BTU_hjTqEIfq-xf2gBuTXHTUA4sA3wpqzbgqyMGpLylAnmAqWWBlXJ0WpHjt13W4wW3l_9txGWT0U0ggptdaPPOmmz9yG_yb41eKPT9aPmbDivrOJdYENr7JN6QFlp7BXarzl13tcmr-koaJhEI3Tvs2CBnto9AC9z0gCIWJ1NbRCuLV831qClDlItBlyq0IHk398OgnYvJpZSluV-LyVLv4HzEqDaDkGVwCi_ZO3GyQr9auy-tg-qT0oxI62zsF6quOnNUUw5d9-jDlPq0BzmwEOCqJOObpvBTO4d2-jEAs1j1oERuQZQB5YAdd3R-yyEWPWMoWvZRElUV_gtkjXStDjISpehUjxLXJk_3JyvPZoNoqhcaglzEv_ipKmcuCCiG9txMlBIPG2HgZB1OxrwixI5bFXvsc4Krw2Yi-j5cfy566QeS_r8C4YESj8eOxPsTNvOyKgx0zlzsxIk7ls2xDfMaAZoBQHTOnLdC3MAZWqz8Y3YUpQ533qN634Dyil8LOLZwPj4TOIcofDZTaBtBb-22nZYqfe-0a8UA0HPn0E5_zWUYceyI9Z4yQVVvvG0rYUJzvvseVH6iSoL3fmfcbfUV5kO0l8Sj4qYjwTbMVSgIPLy2LGQ9XmyuFb4RqM_ijdyAkDQuPnzsWDXz44eMRdl-Tf7ZYheAiOmJWtwKwHWvlz2rhsUysr5lWOgdeqVBXae-WrR1nIhhULhPBldDk6mxmLpWeIVXPxv42rnguLi_W7EvuEnejOCDjencAQ6BqR-AEshxF2TfqmZ9_4_LHWU-VAuQa-m0SVddm5PAIwxSg6PBu2wQm-q1_Dfh7oDRBRNBZnzi9vUzXAqjE-hgpzTw480R_LkM6azAulDDDMe4t9_yDgTNGArs_xepg3kiMj_Kze3av9iM0i4WHHUKG73u7NzAmanMF5AIHx6bDRTTWc9Tt8VhktMg2JlJOvKNSHiKPlS59qClF1_SmSjOO1vXX0D3G6iMeR4GqIPfm9KmVuiDKH2LtDmZ75nQK66VfAewNu0ODaLKZKw7totH3ajvo4-gDkFNMVevq_K3EVRbhVTtSKa1WzNxLHQHa3_l4EDRwwR6KZV-Mj3_kxZsU3wcmUUv4Gb7s54SmmmtASOTUPCMp3uLzTHXOTUTcbuAHwqJJiHfZqW4KUtZK2S46y7ubY79W2ZJ6-JAs3HOrnGxURWvpfMRaHWkqvm-flZIXP7TkraDZf3BDYyAozCpHdgZxLCeeLwH6ValfaIB0UuZAk3MeLm6_4Zb8wbKO7il3MRdW7EZFkyJGEUzz4TojlT88c31UTrDFlJwV2GulXVn_d4_ScwfqgMZtl82x-XUFikYCQN9SgTPPM3kjXqm0yY5JpOa-HPe8Y0KA9On8wYF61tMomrkioYGtSA5OSwcbHjzfTamZ80wbZbGtwK_izKD9iS-2Pu4oAJAloB4aiNiOyh31y20RMybEVmZmFVLVtSnCpEKt32a7JbSIwyWCJ3OxyeX9lKqkg4mPwfh_MO45xxS-0zlG_vBtd__KJssac8tnyxWreSggcJSo9kkreVdUCC-N_3jgK2TQgvdHe8Ar7byBxmkHV_X1ed1Us4bJ6uYZDw8qGjm_ztBNZxECk16t8J_gudbkVpU_p1x05uKW87fA0rmFcktkK62NF-6gRFzZDcR2UV-4Fa2o7TVoQAxFLBnl6vg5IZBtyqDfOlXPu3ohC39I8I_e9Ye2PJJFkufPjzjtzKBrLWvFWNJ-PteiIdJ4VY2kYRa5i8-ChWzFEnVQOCXN-D_ndviD8ECbx65SxjfTVO005bSED7d6zkVzmoDtHpXSa9-axZYDZUPZ8lnJhpSZ33gN6ij3aknjpvgdtW4SpxxZiRMIqbX3eZnCHbVqrmto_w_FqNnECif87LCgGsq9bURY0z3G87M3uI2C_O5hGXPy7h3j_3Wyr
Sample260818-sysqmswxes

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315407553681727"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BC66C6A3-1B10-4810-B341-CDDE1DA30C44}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1048	2800	msedge.exe	86
PID 2800 wrote to memory of 3528	2800	msedge.exe	88
PID 2800 wrote to memory of 3184	2800	msedge.exe	90
PID 2800 wrote to memory of 3184	2800	msedge.exe	90
PID 2800 wrote to memory of 4108	2800	msedge.exe	89
PID 2800 wrote to memory of 4108	2800	msedge.exe	89
PID 2800 wrote to memory of 4108	2800	msedge.exe	89
PID 2800 wrote to memory of 4760	2800	msedge.exe	92
PID 2800 wrote to memory of 4760	2800	msedge.exe	92
PID 2800 wrote to memory of 4760	2800	msedge.exe	92
PID 2800 wrote to memory of 1588	2800	msedge.exe	91
PID 2800 wrote to memory of 1588	2800	msedge.exe	91
PID 2800 wrote to memory of 1588	2800	msedge.exe	91
PID 2800 wrote to memory of 3792	2800	msedge.exe	93
PID 2800 wrote to memory of 3792	2800	msedge.exe	93
PID 2800 wrote to memory of 3792	2800	msedge.exe	93
PID 2800 wrote to memory of 1840	2800	msedge.exe	94
PID 2800 wrote to memory of 1840	2800	msedge.exe	94
PID 2800 wrote to memory of 1840	2800	msedge.exe	94
PID 2800 wrote to memory of 2400	2800	msedge.exe	98
PID 2800 wrote to memory of 1216	2800	msedge.exe	99
PID 2800 wrote to memory of 2400	2800	msedge.exe	98
PID 2800 wrote to memory of 1216	2800	msedge.exe	99
PID 2800 wrote to memory of 2716	2800	msedge.exe	101
PID 2800 wrote to memory of 1844	2800	msedge.exe	106
PID 2800 wrote to memory of 3552	2800	msedge.exe	107
PID 2800 wrote to memory of 4464	2800	msedge.exe	108
PID 2800 wrote to memory of 2148	2800	msedge.exe	115
PID 2800 wrote to memory of 2148	2800	msedge.exe	115
PID 2800 wrote to memory of 4908	2800	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ci3.googleusercontent.com/meips/ADKq_Nbc1rwbUWS5kjJ1psah6Jm4sMHDiz3MEpFkLSOsqQGGsdckwyQ5vQ07uM3BTU_hjTqEIfq-xf2gBuTXHTUA4sA3wpqzbgqyMGpLylAnmAqWWBlXJ0WpHjt13W4wW3l_9txGWT0U0ggptdaPPOmmz9yG_yb41eKPT9aPmbDivrOJdYENr7JN6QFlp7BXarzl13tcmr-koaJhEI3Tvs2CBnto9AC9z0gCIWJ1NbRCuLV831qClDlItBlyq0IHk398OgnYvJpZSluV-LyVLv4HzEqDaDkGVwCi_ZO3GyQr9auy-tg-qT0oxI62zsF6quOnNUUw5d9-jDlPq0BzmwEOCqJOObpvBTO4d2-jEAs1j1oERuQZQB5YAdd3R-yyEWPWMoWvZRElUV_gtkjXStDjISpehUjxLXJk_3JyvPZoNoqhcaglzEv_ipKmcuCCiG9txMlBIPG2HgZB1OxrwixI5bFXvsc4Krw2Yi-j5cfy566QeS_r8C4YESj8eOxPsTNvOyKgx0zlzsxIk7ls2xDfMaAZoBQHTOnLdC3MAZWqz8Y3YUpQ533qN634Dyil8LOLZwPj4TOIcofDZTaBtBb-22nZYqfe-0a8UA0HPn0E5_zWUYceyI9Z4yQVVvvG0rYUJzvvseVH6iSoL3fmfcbfUV5kO0l8Sj4qYjwTbMVSgIPLy2LGQ9XmyuFb4RqM_ijdyAkDQuPnzsWDXz44eMRdl-Tf7ZYheAiOmJWtwKwHWvlz2rhsUysr5lWOgdeqVBXae-WrR1nIhhULhPBldDk6mxmLpWeIVXPxv42rnguLi_W7EvuEnejOCDjencAQ6BqR-AEshxF2TfqmZ9_4_LHWU-VAuQa-m0SVddm5PAIwxSg6PBu2wQm-q1_Dfh7oDRBRNBZnzi9vUzXAqjE-hgpzTw480R_LkM6azAulDDDMe4t9_yDgTNGArs_xepg3kiMj_Kze3av9iM0i4WHHUKG73u7NzAmanMF5AIHx6bDRTTWc9Tt8VhktMg2JlJOvKNSHiKPlS59qClF1_SmSjOO1vXX0D3G6iMeR4GqIPfm9KmVuiDKH2LtDmZ75nQK66VfAewNu0ODaLKZKw7totH3ajvo4-gDkFNMVevq_K3EVRbhVTtSKa1WzNxLHQHa3_l4EDRwwR6KZV-Mj3_kxZsU3wcmUUv4Gb7s54SmmmtASOTUPCMp3uLzTHXOTUTcbuAHwqJJiHfZqW4KUtZK2S46y7ubY79W2ZJ6-JAs3HOrnGxURWvpfMRaHWkqvm-flZIXP7TkraDZf3BDYyAozCpHdgZxLCeeLwH6ValfaIB0UuZAk3MeLm6_4Zb8wbKO7il3MRdW7EZFkyJGEUzz4TojlT88c31UTrDFlJwV2GulXVn_d4_ScwfqgMZtl82x-XUFikYCQN9SgTPPM3kjXqm0yY5JpOa-HPe8Y0KA9On8wYF61tMomrkioYGtSA5OSwcbHjzfTamZ80wbZbGtwK_izKD9iS-2Pu4oAJAloB4aiNiOyh31y20RMybEVmZmFVLVtSnCpEKt32a7JbSIwyWCJ3OxyeX9lKqkg4mPwfh_MO45xxS-0zlG_vBtd__KJssac8tnyxWreSggcJSo9kkreVdUCC-N_3jgK2TQgvdHe8Ar7byBxmkHV_X1ed1Us4bJ6uYZDw8qGjm_ztBNZxECk16t8J_gudbkVpU_p1x05uKW87fA0rmFcktkK62NF-6gRFzZDcR2UV-4Fa2o7TVoQAxFLBnl6vg5IZBtyqDfOlXPu3ohC39I8I_e9Ye2PJJFkufPjzjtzKBrLWvFWNJ-PteiIdJ4VY2kYRa5i8-ChWzFEnVQOCXN-D_ndviD8ECbx65SxjfTVO005bSED7d6zkVzmoDtHpXSa9-axZYDZUPZ8lnJhpSZ33gN6ij3aknjpvgdtW4SpxxZiRMIqbX3eZnCHbVqrmto_w_FqNnECif87LCgGsq9bURY0z3G87M3uI2C_O5hGXPy7h3j_3Wyr
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa062ac188,0x7ffa062ac194,0x7ffa062ac1a0
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,13958076219834292194,15550040921108388367,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,8761664750871416036,2389702958129316929,262144 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,1180056553399486649,6463741097191282399,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,18304713476938015420,8772882323856839737,2097152 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,10500036952428144790,5810787973319892279,2097152 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,9831498165205190979,14429512454538555454,2097152 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,18374216750753622279,5532153946626824656,2097152 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5353779902500132188,7008181442965364684,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6012014801987298472,13803943800146340096,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9568774046987816629,8761332437605428358,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9568774046987816629,8761332437605428358,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,14451214897110910658,13568534163565145732,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,10522960122877866848,12052131890854194525,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,5836771844269487468,9243409979189705544,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,5113866886272703154,4052596479411406469,524288 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,6229235507698675434,12958237036489080624,262144 --field-trial-handle=2296,i,15506978345011319111,4534407453017680926,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 52896e41ee2999fd56045a4941dee340d8a16f9b46be0e1eb78ef18e2f43b3c3
MD5 3cad734d04c4c8c5758e50c5f8050c7a
SHA1 5270b4b071808218a3ae741219aca5de48f626bf
SHA512 0a98df4f7aa592e98b638b237638e00c82f41979d9481d0ee6fbd0716548316e2683f8b8f96ea83315e45be9433aa9f65a9cb2d29a733c655b919c52577351ef
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7t:fwUQC5VwBIiElEd2K57P7t
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 81ccf5a9a73a2b9f72d195b587a44437e85926e5c8db2c0f219b54564886118c
MD5 512be75556ba4dd350d181958f87c73a
SHA1 b6fe127cfc51c4eafa1c5be271e65326c24f18f7
SHA512 64b9cc2c63379cb37670ef54f8e2c348c255fb9e54b3f249a086c099d471333f26af126202c66f49e90fb552dd587a6ac78db045ebb68ac5309654c19b18f7fb
TLSH
T100618069934208B4CF63167EF3E0531138F2B4E8350BCF62115079BEB11276C8D3B408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5895d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5895d2.TMP
Size 3KB
SHA256 3d4b4f33da03fa7e15d48174b5aae581916d6276958c97393d5c5f8bcca8d73f
MD5 d32121c693e3bff0b80164d0be30c9bf
SHA1 4b3a73b3f4879e62b19a9ebd7683341958d6c103
SHA512 484bfcdaf269a7af036f8eaff2c9deae2912ba84d9c3938d0262bf0042690d4ea1c2dbe0230881766ed20d5e219d470c417c07a830187dae02d5c0b48a4fea45
TLSH
T1EF616F69974208B4CF6316BEF3E0531238F2B4E8391BCF62159079BEB21676C8D7B558
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2a5868f03fc2ca033b55dbf154d39b0f1df7fbbe6437d7aea93082531e799a16
MD5 018a450fc1ac9de58d25e115335c6f97
SHA1 59cdd0b85367e7c423351b5a435ea66b0ba3cd6a
SHA512 323130453524640351a65508f7b4284e9b7ba958bcd423988f96e7431160754fbe65d0d75f6293ac0ab9881e617ca19ec0875daaa9eef62a218731755e08604b
TLSH
T13731A0FBC6D9816E88415AF0AA28AE1FCE2E061552187C1DC8E8EF2B93D24B1D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cb158787112508f18f1a7fbe9a592d8c9273c085cf1dafe27137b382e0017224
MD5 7ec7f073627c4e2a721b2e4b1c14753d
SHA1 440f38e89324a7bfc883b4e2ae120117b1b04ca4
SHA512 9fe8d2c6eb5e21ef274b6ef193a611014bea412e137af3a0a44c7c236ffb1d03e5547d61cb3db57a4cfa4f123e479ebbdbe97c9639f7bda691ac62813a5c3f42
SSDEEP 192:sxZuRFyM/jK1Ml8MkP/f5svSKIdp1nHW6+WNJsK/YwgD1P4IgrJ:sxZufMP/f5svSDVHb5/l9
TLSH
T1E15209126A34A977CCDBE309BA51BF53D6F9453292910E44ADFCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 08ae2389bcad339011c2a79937d35a3b2d0a6413a2bdf17cd6e74517d3305aaa
MD5 febd2f042975d15f120aa23234ce3cd5
SHA1 47ea1bfc2f58286b0f5c864a9b00d7da7de3e57d
SHA512 3d5851d8a0a141b2e33f9d2582e6d05e95e9038c4ad34420c03b664701cf8c1266c288b8c042bfceb1251b51bb480dccce9fd295896d9c314cb04c48f0b5f51c
SSDEEP 192:sxZuRFyM/jK1Ml8UQjkP/f5sczKIdpvnHW6+WNJsK/YwJfQNP4Ig5gJ:sxZufqIP/f5sczDPHb5/DFG
TLSH
T1FD520812AA34A977CCDBE309B951BF53D2F5443292910E44ADFCCA1C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 01b3593058872ff09cd7841bc6bcc9c1ce42a24284bbba103a3eca560f7e9562
MD5 1107f82c7a2385b22e946d4c8c761756
SHA1 ec73b50c1f47b8a5f39f8f8a7551be16a4b79fe6
SHA512 5b42515f9ed2c2b7a6ba3669af4cbcee8f5e89250a441a0e6dc7ada3145f44266aab73261da963fb35ecacf8429a1f789f73d3c6ecbfd89e4bd5a991340c21fa
SSDEEP 768:4d4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dHrohNcZaQi:4d4jeXmWvmKLEu1jacPLZQdUsq
TLSH
T1A1D20A3B244CCB7E4F844E5CED2AAE976ED801CB6A584D5047FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66b96fb435c219469a430ee48054c962a7acaac6d80b70c30990f4566f85ba2d
MD5 0210c07a51b57987238dd9230135a720
SHA1 007c8ed6a19f2b5b4aa529da5f358abc5ec6b483
SHA512 7d97f756acf47eb44179bc7a2ab8878b9000f2173d1ef75b7ab4010c6e5b5f1ff8ba2e74e3ddcbfdfd17eb2c116bf02ef49b0f75ccba1024a344171a9880968f
SSDEEP 48:KNOfCuD1IxKuEkDylrIBKsIMMzIFKk0YryW:K41KKuE6mrmKsIHz6Kk0W5
TLSH
T17991888A75BF16213C7E295CA194871717417A637118E42BBBB910B20EABE341CFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca5a811a-8f16-4801-9a49-9c76b6c3f76a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ca5a811a-8f16-4801-9a49-9c76b6c3f76a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4604c5e182eb6acc8b45531790cf534ac72f28143a457793e6284dc045c408a6
MD5 583d16a575d4fc44099daa3f657eace9
SHA1 95ddd0f4410476469ca6250d8edd119097c31ed9
SHA512 f84e3a558176bb1b8cca640705b638f03a510d13e4eb7c20eb09c2851c8ee4ad98a49a43335a5423674ab3438f765739da4dee66e82548842f0ee1a078f81991
SSDEEP 384:TZcIhsNQRmJjvM32f+o8eHXokFQOOPrXLpe8C/6Bs:LhGY2x3oCQOi9P9s
TLSH
T1AB929D72A87CBC275DE6E781F49626034FF85527F7C56B84A5ECAB0D00D96AD0317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7f2e862eff8ba3540d6015420bda14cf520aa4d55c4404fd255a051dd3303c37
MD5 fd8eb553fafae4f45d28dc8184abc373
SHA1 75adde8ef29668a7c7d9f2057b7d2935618c6df9
SHA512 2a66f8420a6af3b0b4472a2800fc5bcb4a17aa85b329e4d7c5af26b10a512f92ac9251b2c835c33b45973a1ef64e86dcf62201e6a9b8b30144f4282384c56d9b
SSDEEP 384:liFiZcIUsNQ8TUNTUlIlgmJjvm32f+o8eHXomFQOOPrXLpe8C/6Bs:sFQUNwgp62x3oYQOi9P9s
TLSH
T127D22AF258DB9836D9AE9B43A77D2D028EFCC167F5816684B3D85A0CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b207fb94bb475cca160ef2bd7d9eca4e10b779c34c0953a4a782c5d46b1c46b
MD5 1dea71ad9f6e42389fbf2d781438c2e4
SHA1 dd759443c79931a2a6c5154535532e59417d802a
SHA512 58c5a54da90787e140f639ff7053a07a3b01eb90dc8381c43d66e947fdd71e322eb863a0e408661a767302ca34e36427ad8e4c1986523fff6cdccd214aeb9283
SSDEEP 192:EONG6hZ0QmiUyv+pc/+jVSjzor9oZ5wOZtaU6:EONG6oBpu+o8eg2kU6
TLSH
T11602D83568687C678EE2AF45F48726139FE8116BEE966F84D6F81B1C00D779C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3380e49c9f3d3aebaf4c2fefdceabd19de7c7d5484757d10964d755e58fe3c78
MD5 bcc6f9c6b0cd09cbd06faf1d339e2c83
SHA1 bf6d4a8a8fd4b934e6ad338b97a8f74cd45969b1
SHA512 bd28e3d2cbd0fe1980d68174a137f0b50a33a275503b64ed9b17c8b21cc6bbb8d7b54ee363b9a65459120ec08a6598d52219db6d9ebfb58dd0b2d0014a8fb281
SSDEEP 192:bONp6hZeQmiUyR+3ic/+jVSjzor9oHXLEF5cOqRqjBU6:bONp6+x3iu+o8eHXog9QU6
TLSH
T10112F9366868BC675DD2A685F48735138FE9512BEE867F84D6FC1B1C00DF6AC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1a556c3935ebd72ea5506cd061f27477545579d7870b010e1f140c5155a81e3a
MD5 bfaf37f08a232e19bdaafa2ba8d1460d
SHA1 e7deb01abe82d1b571920d98526517b313c91f85
SHA512 59e33e9dbb36464b60028fba54163d5929d99c0721ea170d2eb91a042d1e973ceaddcd97599274f1716693bd51e6f6742a8872bfa326a53951de0fc0f8e2578e
SSDEEP 384:jZcIhsNQgmJjvM32f+o8eHXokFQOOPrXLpe8C/6Bs:7h7Y2x3oCQOi9P9s
TLSH
T161928D72A83CBC275DE6F781F49626038FF89127F7C56B84A5EC9B0D00D96AD0317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90bc1acd-dd43-4def-a972-c6c2863e5476.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\90bc1acd-dd43-4def-a972-c6c2863e5476.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ace2bdd59995efa070e5cb5faa897fd606ec9293dfca415d19f63a65d793df97
MD5 4b02812b2aae40fad581c5b4e3228888
SHA1 7cc0ba2838b110c6a4a43a20705dc64696e85e87
SHA512 2caea8b0d1389fd1c2c1df0fc159c4cf7694146d02b4cf0b547b731b84a34276da8e6c4bda49b21d7430fd9d31c8aa28ec5e5a8e37552ca713d3c63f605944ef
TLSH
T11C412A59AAFA1148B3B72F4A9BF6A86E447AB8772E0AD05D00010E4F0B67F40C861737
MD5 SHA1 SHA512 TLSH

Submit Download