hxxp://C[:]\Users\jpcnz\Downloads\260814-gb89bsdn21-behavioral5 (1)

Analysis

user interaction
yes
max time kernel
898s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://C:\Users\jpcnz\Downloads\260814-gb89bsdn21-behavioral5 (1)
Sample260820-dxzegaej21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316698627026886"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{60DCCE9D-12BE-4DCF-B3B1-1EFB28E5849B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2520	904	msedge.exe	86
PID 904 wrote to memory of 3792	904	msedge.exe	87
PID 904 wrote to memory of 3504	904	msedge.exe	89
PID 904 wrote to memory of 3504	904	msedge.exe	89
PID 904 wrote to memory of 4192	904	msedge.exe	88
PID 904 wrote to memory of 4192	904	msedge.exe	88
PID 904 wrote to memory of 4192	904	msedge.exe	88
PID 904 wrote to memory of 2348	904	msedge.exe	91
PID 904 wrote to memory of 2348	904	msedge.exe	91
PID 904 wrote to memory of 2348	904	msedge.exe	91
PID 904 wrote to memory of 2156	904	msedge.exe	92
PID 904 wrote to memory of 2156	904	msedge.exe	92
PID 904 wrote to memory of 2156	904	msedge.exe	92
PID 904 wrote to memory of 640	904	msedge.exe	93
PID 904 wrote to memory of 3552	904	msedge.exe	94
PID 904 wrote to memory of 640	904	msedge.exe	93
PID 904 wrote to memory of 640	904	msedge.exe	93
PID 904 wrote to memory of 3552	904	msedge.exe	94
PID 904 wrote to memory of 3552	904	msedge.exe	94
PID 904 wrote to memory of 4892	904	msedge.exe	98
PID 904 wrote to memory of 4892	904	msedge.exe	98
PID 904 wrote to memory of 4892	904	msedge.exe	98
PID 904 wrote to memory of 4184	904	msedge.exe	101
PID 904 wrote to memory of 4532	904	msedge.exe	102
PID 904 wrote to memory of 4184	904	msedge.exe	101
PID 904 wrote to memory of 4532	904	msedge.exe	102
PID 904 wrote to memory of 1728	904	msedge.exe	104
PID 904 wrote to memory of 3352	904	msedge.exe	105
PID 904 wrote to memory of 3352	904	msedge.exe	105
PID 904 wrote to memory of 3352	904	msedge.exe	105
PID 904 wrote to memory of 4396	904	msedge.exe	110
PID 904 wrote to memory of 4396	904	msedge.exe	110
PID 904 wrote to memory of 4396	904	msedge.exe	110
PID 904 wrote to memory of 2704	904	msedge.exe	116
PID 904 wrote to memory of 4840	904	msedge.exe	117
PID 904 wrote to memory of 2136	904	msedge.exe	118
PID 904 wrote to memory of 2704	904	msedge.exe	119
PID 904 wrote to memory of 2704	904	msedge.exe	119
PID 904 wrote to memory of 2704	904	msedge.exe	119
PID 904 wrote to memory of 4560	904	msedge.exe	124
PID 904 wrote to memory of 4560	904	msedge.exe	124
PID 904 wrote to memory of 3668	904	msedge.exe	126
PID 904 wrote to memory of 3668	904	msedge.exe	126
PID 904 wrote to memory of 632	904	msedge.exe	127
PID 904 wrote to memory of 632	904	msedge.exe	127
PID 904 wrote to memory of 632	904	msedge.exe	127
PID 904 wrote to memory of 1584	904	msedge.exe	131
PID 904 wrote to memory of 4700	904	msedge.exe	132
PID 904 wrote to memory of 1232	904	msedge.exe	133
PID 904 wrote to memory of 4700	904	msedge.exe	132
PID 904 wrote to memory of 1232	904	msedge.exe	133
PID 904 wrote to memory of 5104	904	msedge.exe	134
PID 904 wrote to memory of 5104	904	msedge.exe	134
PID 904 wrote to memory of 3208	904	msedge.exe	135
PID 904 wrote to memory of 3208	904	msedge.exe	135
PID 904 wrote to memory of 2720	904	msedge.exe	136
PID 904 wrote to memory of 2720	904	msedge.exe	136
PID 904 wrote to memory of 2720	904	msedge.exe	136
PID 904 wrote to memory of 4596	904	msedge.exe	137
PID 904 wrote to memory of 4596	904	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://C:\Users\jpcnz\Downloads\260814-gb89bsdn21-behavioral5 (1)
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84a22c188,0x7ff84a22c194,0x7ff84a22c1a0
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,9983104734523640256,740212981654852401,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4032036260021487028,7303170220577717206,262144 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,11041246784380279619,5407867600404888249,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,8563936095108611263,5116855321990631829,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,2487605066178891736,18442988387347778698,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,3169156835393435677,1292295199816311411,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,9933186714879997854,4254410050080377268,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4864,i,1863166416731871919,11911990648622906006,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,15305048200179426248,3814672783781364423,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,13621626454806121222,17168897406416824547,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7667407341217639609,16573817071857312610,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7667407341217639609,16573817071857312610,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6152,i,2133863262408303241,17578114319296923639,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6456,i,2066419257417312417,18432882428715699679,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,3345595710987359810,15755607590046979417,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,4117762964718781723,17791037409533788927,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6954743110683095800,6711630106957365972,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2140,i,9960741267816754737,3065020063950216236,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12207211199310253919,4598853201372494757,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,7253800525632785660,7823432177189364352,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6108,i,17642375863695143977,5640794381886789150,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3920,i,8621532736083798405,3697887347937697014,262144 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,7195243346190858742,16094337742899812835,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,9327937870724777864,16018197480948343722,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,576077364950290395,18070303427595802615,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15772254451471128310,14455295967626946851,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=1304,i,10744678689296377885,16182789949565311742,2097152 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=1492 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,807421950152503557,2412423259673906735,524288 --field-trial-handle=2260,i,2787320801182634631,17809075732417261985,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44ad41f86fc5dfdef9271828918ef29a810e56b8958f687546cd2d840b9240aa
MD5 a5cac29eea53b9fcab74bee9fa34b5ae
SHA1 f8ce725ee9f0504c0c06499e9e661e57b450faea
SHA512 b9b4caa28d7e2513df4fe005dbaadbee5271cc930e71893250588b597acfb3d61d0eac54efc7443d690048513be0217cff1f84fceb1bc7dbb7a69e098a92df54
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1B0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d35929384861d977ce44b1c3eecaa0de45054c404ee2a9beb6a485b6e8598f65
MD5 f01ea2bd54360f8bd7e5b2a86fbb0d34
SHA1 30a81744d385f27c4b73c438a46d51a19317010b
SHA512 df5f128391de3c428b5aeb2c7297e56c02bbe79f5b991f3392896f5acab1d929d88245be61407cfc7ec7b6464f4eff1429c47e6de2eb3556aa87793abf8d9fc0
TLSH
T165E026E546CCC33FDA00F8475268430C82A1370ED2C8E9EA2720CC983442C80E3C3D91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ab46102ac44a7d5cff055d71db502425c30a6b6ae8823c89250b2ee9bf38d606
MD5 315b7e21ae42241a520ff066fbaa365c
SHA1 cc0d83c8426ab0acd3d607ae3bd0aa624bed4143
SHA512 cdb0b5d8e19fcda7f62c45f2933810c82920ae2b5f706b1f053908f823c1550c752c95dfce9dea5cd78d58a4b0fb34059937dc5f74eae912b360cee041eea909
TLSH
T144E026E566CCC2FFD610B987726A570CC2A0362AA2CCED9B9B00E8883081040E6E6590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d6f14ce28e36241574f31a1df37f9b2b5fcfb28d051790820ff6b9c0e46b8e7f
MD5 796930d4857e839573e37ba7170402d5
SHA1 d8005cd834010753656b6d26e3f9972b472ce668
SHA512 10c624bdef07b3392936076015a1c472da1cba3d5413be8105ffd0b1426ac2acfc17b527417da635d951f43afa052175805ab791d0e478efac12d3c34196b7cf
TLSH
T1B3E026A49AFAC1B6D920D487AB58C314C2B1B00BDF8CC8FA3308F8DC2860205C2EC880
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 278fa925b43150f6a37012c95c7badfdacbc898fe3363800bbaf2f4b8c4056db
MD5 794a287c11e2ab0aafb9f3681cadb69d
SHA1 cf93c6840c7a09c9435c37b50dab5c1b9bda7e92
SHA512 bf61e17fa7979dcef31c7ce6c69f47119427cea98003170efc64d72244a590a4309dde29c81b57f6209a14288722d7d00e4c60287ceb35f7ba416b81d448b41d
TLSH
T18D71812875C20401D7371A32E9C0D0363C72A3AE366BBFA096D6B43F05B67EDC874804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5883d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5883d1.TMP
Size 3KB
SHA256 e28174ca8f5722d3b10815607f37c4b41ab04043f63aac11262001f16f13d57f
MD5 3538b9a1ab3c6fcce0b6d69b231d58f6
SHA1 234401c51fb73a3d9008145a4e5d75501d915566
SHA512 d2a73c15ce2fc8cbb2c6cec67010cc3a3c22e911fa5dbe7f912160bb071fb0bfc3f9f9b2d76333b532159decdc643002a88121866d01aa0a29e44423f0deecc0
TLSH
T196718F2875C20441D7371A32E9C0D0363C72A3AE366BBFA192D6B43F05B6BEDC874804
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 0881d10a808ec04be0a2697174bdbd40d22393cdd7f198eeb617cdce7fef03d8
MD5 d1067f1c91c56d09e21ccd9cd92f22c0
SHA1 f923f70075765a6c45446422574bc3fd809b5056
SHA512 9b01a1f07560b40dd4478fa5545d4aa60f56637f977f74d1d8bf1a2f71d2e5e8e2a872ca2609bb7a863c176617e6eac9f0fb33f323b4bc26eded26e21fea57bf
TLSH
T1D4119EF383E1855EC90116F05A18EE2BCE2C0511421C7C1989D4EF27C3E3075E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2e8c40550a5e6843d96616fbc67fbf1f1be7af8e08a5d0f11945cfc42692d238
MD5 7fc072085fc199ba14f81e28cec96c58
SHA1 4a1f607b67f2b850e9cc61cabb2fa3ff566178fb
SHA512 80445cf68522ebb599ed1e25347443ac6aca5c2638a46184c14d8ae334327c48773ff1fa61a1287c8006f5fd905ed3ac645aa2235fd2ea925cf3b2ad30a9e7b5
TLSH
T1B1117DF3C3E585BE891116F06A24AE2BCE2D0605821C7D1589D4FF2BD7E3075E00195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c87d611999f4c581aa953d9f24c32dd1894574d17f0fc2fc31b11cdd9dab0435
MD5 bcfd1b89f5aa330f91fbfe745942e29b
SHA1 589e8169a5006954726cd2bc573efc7056cd0e35
SHA512 823a8d74f68633b1c3476cf747fdbe0bf68d5420fd2912e210ebf9f0dd373ca4af8b19c6f68d71871fb908b344655f0b29d5b9d648009f1786f1b5208205e9cf
SSDEEP 192:sxZTRHyM/jK1Ml8Mky/fCsjWycIdpJkHW6+WNGYwKEpobIgrJ:sxZT7My/fCsjWkiHbGW9
TLSH
T16D42E8116B34697BCCCBD209FA557F53D6F9147292940E84EAFCDA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5a7c21ae94d13fc5fcb4b9d92b3283ac0f22c198c241b9404b2adca267b8fcff
MD5 8e64e33a41e741618861f630563017dd
SHA1 1b84200030d954ca7e89f4af687c2f3e701bab07
SHA512 4118996598b5fdea5a314406f868c43e26dfc9db91b66b099f52654a9a8b05fb1fda3b36fb8845613343a4add6a188533f7cd664c5f45223760498bc681e60e2
SSDEEP 192:sxZTRHyM/jK1Ml8UQnky/fCs3kycIdpXkHW6+WNGYwBtZobIg5AJ:sxZT7qky/fCs3kk0HbGOu
TLSH
T14A52F8116B34597BCCDBD209BA41BF53D6F9547291940E84AEFCCA0C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 584ab03c98de946d83e76018a1d2a46535ae4bc1424d142f0c7f0f879e3e108d
MD5 c25d3ef0394247503cf97266319ebea2
SHA1 2d1f4c6ac47dd90771c5b0ed17ad766045940e5f
SHA512 f6d1508e0387543761b84fd983bf2789e0ee06dbcb92dc95e8cd0e7e1c7083db7471cc388b3c11ca8a4fbd85351d1d5d7ee81af52b0bff71e6a899fc90ae6178
SSDEEP 768:Ul4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d/rohpc0az:Ul4jeXmWvmKLEu1jacPLZQdssj
TLSH
T1FBD2093B280CCB7E4F845E5CED26AF976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2ebe1b192963b3cddfcc9655b39b7e1053ea848de91f9583eb5a15744dbeac8a
MD5 8112ce39eedb359f710dacda36cb63e7
SHA1 bf430ce99580b018d6b6decf0b5b144c67e399a1
SHA512 1bf7e8a7772adb0448c1c45baa485b0fdd4c419c10268cd6ac7fe12d6ec6d738f2fb751e93f63eddf6c6e37edee92bb01c4f1634f0e2dbcaf84ad56a8c945046
SSDEEP 24:KdqfdmXaMdg8Y4IU+LIjCYKi7ha0Y1ECISm2Mf8K1yXYOfhSTaAdUws4EQ+3IjWj:KwjIhKE4svytjIlKsEoAyIfKTyMDyT
TLSH
T119917E1235FE32013CBE6859919096675E923477305CBC7B7FAC60A20EA6E209CFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f81a52cf-1854-4ffb-b175-21d69709c981.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f81a52cf-1854-4ffb-b175-21d69709c981.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 985c018423b3ebae71472979dcf4205837c68b54e09ecbca29de25f01f1b804e
MD5 eae73880cc67181fd13cbd8bff0ce312
SHA1 b6293d18aef9bb547d734169e70b10e284ea3c70
SHA512 ed3dd83874ac6ba81e43edd6d07cbb90410461eda2cb47fd1ca71eb435c03e9c0c515743b9f011456c623f42faab76d1b8694f46ec231e51f4bef95c67e619cb
SSDEEP 384:oZcIhsNAjlBaqoIf+0d2YHRmSFKivpKfoB:Wh/QQhtLKiEfa
TLSH
T16C827D315C786C7719F2E281F4472A174FF890279ACD6FC4E5EDBB2C00E96A9131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b3d401af1db3c59cafbd77c2d1b631ece99dd5396f68c029d645e95c07d4c48b
MD5 2220c71c6e290ec47de0a3ea22d92f2b
SHA1 922aa9340585364de1db0c7b3d2af5df73aaacc0
SHA512 77d76fdd77ca7dc0fa30933d8d3464dfccb681c07777ec7ae179d438578d05106ada915acfba348a4c4bd45a820d1467736d1135401e9f548de663b142b135ba
SSDEEP 384:ViFiZcIvsNA8TUNTUlIl2lBaqoIf+0d2YHRmuFKivpKfoB:cFQvRwguQQhttKiEfa
TLSH
T122A26C324C64987B6DF6AB85F54A26178FF44077C9D9BED0E6DCAB1C00AA5EC130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 85ad5a373dc91fdd40e9bd545b91efabd22b9fc8b761922a09f9919d31d2217c
MD5 e0e93776180af817bc37f4a8d17f59f4
SHA1 5f37f7041d26dd327e97baf4a33ce94d3f09f041
SHA512 3d0518326a27986a7b92aa50e0af94e91a3fc3f6b678689a60c14411240e2b37f03eefa69ac3a0b7a4eb2116f651b0f80ffbb13177df10789d5f6d20f9992ec6
SSDEEP 384:zZcIhsNA2lBaqoIf+0d2YHRmSFKivpKfoB:rhgQQhtLKiEfa
TLSH
T156828D315C745C7718F6E281F4472A175FF8902796CD6FC4E5EDAB2C00E9AA9131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30d8e02dfe655b26d0749319c9393aae5eecab166ada05f6fa62290eaff19c55
MD5 357933e382141cbb858c73eeaed8e1a0
SHA1 137a0c8108f54021c4fa4567ba4bc70467245702
SHA512 cce93446d4bbc537e235f6ddda4a9b8a2206ea15f0bf268379ce56f76947905966211c18b78adffc58f39f0f0d1e6375fb07baced80a5e635f8735ec38989ae1
SSDEEP 192:EONY6hZ0QmiUy8C9pc/+jVx+Fd2YHC5wOZJnU6:EONY6o+pu+0d2YH52xU6
TLSH
T19502DA35AC786C7B8EF2AE45F48737235FE4116BAD956F84DAE81B1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d40373341666df387afd7c4bcd7742e63d198c3c9a000dbddc72e576af48e5c
MD5 8806fcb2783c1472d6b960f24f18d817
SHA1 e30a0be8170dc773b0f17ea6bb5c69b434cfba49
SHA512 a4d7e30baaae6fb5f1d9a2bcfae87a6a92629b34761312979214999f7ae04bb7184eb47b2293cde6e22a9852e38b0faff32e7b2114afc6cf93c597cd209cd882
SSDEEP 192:IrONMw6hZciQmiUy+C9ITc/+jVx+Fd2YH8FEmC5cOq0qMU6:oONR6b64u+0d2YHRmt9KU6
TLSH
T11712FA316868AC675DE2BA41F48736135FE4512BDE897FC4E6EC2B1C00DA6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cd56613-41b9-4944-9054-ce8a04cdf014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5cd56613-41b9-4944-9054-ce8a04cdf014.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c87014a93a282930e9dae7c199c142a020c4eb02c0929a56fa8be439bd134cb0
MD5 b0d44ccebcc2da6da030b1e21594f689
SHA1 c037f4adeb36ef95fb1ba4fac9593c1c21a1923f
SHA512 e77a1ab2d2dcf016a62e89fb60383744a44c798a8e01f40de32ca2991a754f705a3691dd62c90189c490bc3a180f834e094f0b16ef94f3305b46944c4ec879c4
TLSH
T1C0413D58AAF91108B3F36F4B9BF6A96D447BBD773F0AD09D10110D4F0A22A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download