hxxps://calendar[.]app[.]google/mfQWVQdDvKt9br9e6

Analysis

user interaction
yes
max time kernel
388s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://calendar.app.google/mfQWVQdDvKt9br9e6
Sample260823-eraplaserc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319318076728761"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{214F2C0B-3075-45F9-B816-AFDBC6BF6D93}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3448	4696	msedge.exe	85
PID 4696 wrote to memory of 2056	4696	msedge.exe	86
PID 4696 wrote to memory of 1084	4696	msedge.exe	87
PID 4696 wrote to memory of 2056	4696	msedge.exe	86
PID 4696 wrote to memory of 2056	4696	msedge.exe	86
PID 4696 wrote to memory of 4352	4696	msedge.exe	88
PID 4696 wrote to memory of 4352	4696	msedge.exe	88
PID 4696 wrote to memory of 3564	4696	msedge.exe	89
PID 4696 wrote to memory of 3564	4696	msedge.exe	89
PID 4696 wrote to memory of 3564	4696	msedge.exe	89
PID 4696 wrote to memory of 2732	4696	msedge.exe	90
PID 4696 wrote to memory of 2732	4696	msedge.exe	90
PID 4696 wrote to memory of 2732	4696	msedge.exe	90
PID 4696 wrote to memory of 4592	4696	msedge.exe	92
PID 4696 wrote to memory of 972	4696	msedge.exe	93
PID 4696 wrote to memory of 4592	4696	msedge.exe	92
PID 4696 wrote to memory of 4592	4696	msedge.exe	92
PID 4696 wrote to memory of 972	4696	msedge.exe	93
PID 4696 wrote to memory of 972	4696	msedge.exe	93
PID 4696 wrote to memory of 1656	4696	msedge.exe	97
PID 4696 wrote to memory of 1656	4696	msedge.exe	97
PID 4696 wrote to memory of 1656	4696	msedge.exe	97
PID 4696 wrote to memory of 3936	4696	msedge.exe	99
PID 4696 wrote to memory of 3936	4696	msedge.exe	99
PID 4696 wrote to memory of 2180	4696	msedge.exe	100
PID 4696 wrote to memory of 2180	4696	msedge.exe	100
PID 4696 wrote to memory of 1036	4696	msedge.exe	102
PID 4696 wrote to memory of 1052	4696	msedge.exe	115
PID 4696 wrote to memory of 3468	4696	msedge.exe	116
PID 4696 wrote to memory of 1792	4696	msedge.exe	117
PID 4696 wrote to memory of 2332	4696	msedge.exe	119
PID 4696 wrote to memory of 2332	4696	msedge.exe	119
PID 4696 wrote to memory of 2644	4696	msedge.exe	120
PID 4696 wrote to memory of 1264	4696	msedge.exe	122
PID 4696 wrote to memory of 4524	4696	msedge.exe	121
PID 4696 wrote to memory of 1264	4696	msedge.exe	122
PID 4696 wrote to memory of 4524	4696	msedge.exe	121
PID 4696 wrote to memory of 3496	4696	msedge.exe	123
PID 4696 wrote to memory of 3496	4696	msedge.exe	123
PID 4696 wrote to memory of 2992	4696	msedge.exe	124
PID 4696 wrote to memory of 2992	4696	msedge.exe	124
PID 4696 wrote to memory of 4788	4696	msedge.exe	125
PID 4696 wrote to memory of 4788	4696	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://calendar.app.google/mfQWVQdDvKt9br9e6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffe6e63c188,0x7ffe6e63c194,0x7ffe6e63c1a0
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12707714582077495403,12848383978919710485,262144 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,12333392352275123094,6974748344417859154,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,16139293885363571674,16922268479894917745,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17584913775174964076,1598802501513296895,2097152 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,17273954713298953073,15360877550578797766,2097152 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17632469941165017262,12802602540603214518,2097152 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,7009479025122654154,3691709458835525993,2097152 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,8451371558780942324,582611630762474829,2097152 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,11639089529562358635,12962292563132220670,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,559056293786895480,7777645228839052833,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,14513066637624486833,10894851798594417511,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,14513066637624486833,10894851798594417511,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,10500447017021157194,6048492004239957693,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,11799578946853632145,4751459473822686315,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,10055073513056768408,5717209651728760604,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5389571559100856688,5023669732867700297,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5848,i,7952321449116077072,7077389959532195799,262144 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,10371730582134376637,11217317257240840656,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,16882361383400584650,6891425599883126001,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,6275639929810322972,8699141826866594251,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,4801462872941927070,1601813028552838434,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,2884310242473920090,835822221798752358,524288 --field-trial-handle=2144,i,76872871858471831,14983157070269019299,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c9af86544c53d7df18a55a79e9a684a30b8097dd01be6cbca1c7a9e466998d17
MD5 b649778ca596fab57f87385779576e08
SHA1 e1afd8b69d7f2f94d1080eda6e0396c3e4298191
SHA512 12e67db458996f2f21fe508d12f5a96ff1206406c6845cc0db339a762988ab5c79f469565dec61b6e84298da9ff4ef2b7fed28324a46d0dd2bb311bb6b276a3c
TLSH
T183E0268909CCC22F96C0A44B56E8530C83847A0EA3C8E9CA1B00849E38010A0E3C2598
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 591725231d271f5a47f5d527674bf42ff7267a9f09340b0c06909a36902e77fc
MD5 94cd723e8020f604e34b86c31b7a1b99
SHA1 32e8a3733bc31e26fd741332b6080488e8b1b325
SHA512 f81a933a919afec335c7098db1f9c70921c113119965f6fa76c8b4fa784fb58b1e16c99169a45bb23baaa302f0969ac54c3429cd20e4a27eca7fd1ab8b5ec764
TLSH
T182E02047DBC4C1E746419787A95C43964E73F005FB4DDD5A330670CE3C60891CBC4188
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc9b2c1f8cb2114248475544757c8b0a4151dd03b4197f5d638e5b7acf8c8377
MD5 5e7b65eef34ace5eeb638cc36b3d15f7
SHA1 4523192fc5227445bdfbdeae0b6c36f5a24c5eb9
SHA512 ed2b4673a3322643c355ecdfb39b4f387683cbd8af967639f9f51515985ef8f64bff118a4d048c6804150637b2a98565b4f83cd2319e8021d4217b26aa6584b2
TLSH
T1D881E9F596C50894CBCAC3B0E1D20100FB3B72EDF81F7EC28C541AF86A07319A6C8206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91ebb52235ea21e1bfb239444fc9b4629fe8811e20da53a7cb031a0614f30842
MD5 eac4b935fde80e673177381d4e74f7ac
SHA1 5b94c715ef966385acb2753b11ee2785f41e27b5
SHA512 2a5256e767afbf9ec6c593ce9b5876ed806abc6fe9c69df281564f8ef89bdd4d21fa706e9c300b801161188c6679b47a32b13bfcb1e2155448ea132919a5f560
TLSH
T1DD81E8F5A6C50895CBCAC3B0E1D20500FB3B72EDF90F7EC28C951AF86A07719A5D8206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b7d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b7d2.TMP
Size 3KB
SHA256 6abb0336e719e7d69dc549c586ea82503603b3eb2e523b053d1ab76048e345de
MD5 29656b520f181156ac55dcf6e83efafa
SHA1 ed7cb491bea130cc2e010a6b520cfe349c6abd4d
SHA512 1b3d8dc6221414705fb86d637f5815bdb8c96b4c6c477395fbb8ef74a1845dc889c08638b56a32aed946f1dd2bf0f339fc65db460c4c47a586e32ed17ac35f1f
TLSH
T14371C9F4A6C10894CFCAD3B0E2D21100F73B71E9F90F7ED28C941AF45A07315A9D8206
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 600ab09994f758cd5b59f4e341f78c80756c28395667abfd80bd8b894d612adf
MD5 cc3a58f26f0bb8f44354737ab1ab7633
SHA1 309db9648629ecb0e9bee75569bc1181d266cc4c
SHA512 9d205671b47d88138cae1324534e39d05ba561a46ccbaa38a21e6d064d38529b8121098bfc39b6a706275bad259932560e1ac8a4d2a569f28ddf5e2c38b69a47
TLSH
T15F7186BBC3E8852E891156F4AB15AF1ECE1D0A14432C3C2AC8E9BF5B93F2431E11565E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f7f3af81f88cff0999fad22db6dbbea5802931e9cb6495350918c4b8b648a5fb
MD5 e395de7780f0084df6a41bb043c90356
SHA1 cbd2f83920cb7d4ca96e24646e224d0a9b9e0b1f
SHA512 a3d588a75c9b3033fa7c558e89b11f8185234b6459fc987c7a8f2edf54dbe9a458fc1d7ffaf025a1de6036f2b0d7c7be7a6115cc3f5cfe7f52514ac099ceee97
SSDEEP 48:YALlNaOhfhYh8hTht1htwsgT5sHzEsVFsXiBKsm4sktsvZ0BwEsOFsvCKs72a:D4OpKmhX1XITAzZdGkkZ0BwK405
TLSH
T1578167FBC3D9852DC85156F49B15AF1ECE190A14432C3C2A88E9BF5BD3E2431E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3c3c73387375e4fb15b586c2ae8a8ce2dda63491fcfce7cd5c0443ac3c0a5b0a
MD5 4e662712465dd27b59c53f4451eac08e
SHA1 43b8e347d2f25532f6cef6e11a0916ad7760f914
SHA512 8dacf12efa0dd10bff0c3c723fd8ca96036f9e034bcfe5cb8e9ee9d62846514c66a265803ac84bbb838fe632405f40d7082b4a1b2a62905bf153fcf366dd65a8
TLSH
T1BE7176F783E5822D891156F49B15AF2FCE290614432C3C7A89D4BF5BD3E2431E11676E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f37c5581e3662b33271261669de8fde97c6ce8f90116f0cf46d8996dd1f44dc6
MD5 ef97105152a24f3bc8e4333c11d986bd
SHA1 c98a6c41721af766a46796e82a006807f2bdd4f0
SHA512 a5dd958e47f75069464dd006d8818c49b3ecaa0b7ea9efcfb5f06b8abad3f7da5c31cf326e34cb6b63c51306a0185b3df94d2f94218b612edd65af30744f7b8a
SSDEEP 192:sxZ9RkyM/jK1Ml8MkQ/f5s8V+5IdpDTO4HW6+WN4w//YzjdfDGIgrJ:sxZ92MQ/f5s8VzPHbz/8q9
TLSH
T13C52E8126A34597BCCDBD209FA50BB93E6F5447392A00D44A9FCDA1C10E7AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 30f818a1235dde7d1eace8a384cf569022e0a6910c7a3db75bc0e9b725975b3a
MD5 ab07ea3c3abc6d33154f155f8cfc13ad
SHA1 4512648df8e3eb81e249f4bb0d7b584b7bea96c9
SHA512 affb0dab01f0f3f2ea1732036ffd0c372375154f1d3bf454aa86ac440240e557fc404f6586a0b663bdac0be74699112d096590c52bdacfd664b7c7ad04fc3d51
SSDEEP 192:sxZ9RkyM/jK1Ml8UQZkQ/f5sas+5IdpVTO4HW6+WN4ynZYzh4fDGIg5KJ:sxZ92qaQ/f5saszFHbRZpqA
TLSH
T1A152E7126A345977CCDBE209FA51BB93E6F5447291A40E84AAFCDA1C10E7BDD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 60ca47eaf5d06b2496772a0996ff7a69185a3179252f7a542add72842afd7cdf
MD5 764ae4eb9966edcee91b2acbd5035dde
SHA1 974699a55762a1ef8f7544afa58bcb3d34c619a5
SHA512 41ad5d03da254e97b187273ec2d85b442bd404fadb43b6085a067ea5a9ceb503f21accee824fb105cd42117cee2f91affd9ddd8ce2b2665b8ad1293e95d2aef5
SSDEEP 768:QbW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjnroIY+igY0:QbW7kf0Wvqidau1jaa5LA3j0nh0
TLSH
T131D20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\temp-index
Size 1KB
SHA256 6cc4b135658043a26a5ec84b5b2814f16459ec8d680d950ed2f33ca636e92436
MD5 34d84462a3ddff13719f7fa4b02e7e7b
SHA1 2298a85c769829a18d8567ac782d0663efad0c74
SHA512 26fa387b8143bfcdf2b60b1c71519eb40d9075d0e81d788f1824f9444aa71dffeb1fb083aeb7899772c034c3ad0f267387186dc170882530acdb5ec6faf46ad3
TLSH
T13C31F3488D908D5FE99481B215B7B5A4737185DD5311B3A3583C32313D167592A4B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce0f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5ce0f1.TMP
Size 1KB
SHA256 51ccfd9013b3f0b80a868509bcda4ff9febe47782a0a843d06c37eee75287286
MD5 a5c264325dc3ae60dfd8ddff262d1192
SHA1 ad45e8b9171ca963d553cd2c053e0954acedaaa2
SHA512 9849fe358558afc96072a605825426feb21812426c0985ca5586285452461e14f94f27cd5e224f2c2abfe911ad06ae72462820a2bb3db09002fde0436cfe7446
TLSH
T18E31324E46918E0FF884417B19A3B4F8733588009321B3D3A47C22395E21B8E2A4F0CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8580becbe56acab544eacc277513adc602a9b6f130e8703f0b95374d48d3c45c
MD5 e1a92f44447f2b34f3740399a2d5a8ad
SHA1 02193e516f554326587a2b2fa482ee82954cb838
SHA512 14305b6ac0b33b58a021ada0abb9c9d4d2de8e93b3e72c6374125f9ada81722358d33dde00296949f971065b614bed10536ad39ab7b3fa7d74dab004f74333e5
TLSH
T190E068BB2EFB1920AC6F87C138B154A08185391CC504FC0E3027A28730F2751240AC21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d9919a867819975b88679b13accb6ae9c7c820a6c1594a31abd6199051e10dd4
MD5 198527f75972f807009ce09dc269abee
SHA1 c18c4e54af2e82910adc1f72f98771ecb107b348
SHA512 6b946b59d7a8d90adfe98fb856c350237d25c935c5bc7ebfdf5d666299edd5d5c93be77d8eb16b87b3f5c36512655f1ffa2395a0a5b7bae92181e2b40735b6b5
SSDEEP 96:KIbCKcXfGKAIG8pUtJvPv693CJrZ6KDPr76/JhqTFeEK7il:s69f8e
TLSH
T117914202747F46413C7E2818A3668A764F82B593381868FF7BB844672D66E520DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592cd3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f27e41cbda3bc10045bb98a89ab02f32f2bd1107e3166927972437d1ed30f589
MD5 00b1a87c2466b86f77fa71ee19bd273a
SHA1 7a355804e17a18fc9a716015501783651257f21b
SHA512 41535a2b5d66799f98ed883ab5c43ce6e1be3a9b3b0f6bd19b27a5d988bb475f6b5715ecc1c5d878e810da0c1d1f0ae634e4308221bca72334a02aff55a5f3fd
SSDEEP 384:bZcIhsNNm74Eb/ttxd5ml+2PRkOViv7+a6oY:Dh9ZLgleOVijl6z
TLSH
T184828D715C789C3759A6F145F54A36075FF8802796C86E94A9EDAB2C00EE7E8230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 967f88ef56af14f1099f6ea263978e25a3f40e165ad813c1b06b8f4b24e52021
MD5 4b4a56610fa0ff4e8e9d2d2e92b1616c
SHA1 2378411ab6fe379d319d742b7ba9094276fe87e1
SHA512 7691e6b49f6f6ac6570642fbe395bf0144f1c7a385c201a797e6cf8d29e4a2a59c95d902e717816a391e432836f45198043b4f50b69518c31f3a7080ed4db40f
SSDEEP 384:7iFiZcIpsNX8TUNTUlIlb74Eb/Vtxd5ml+2PRk1Viv7+a6oY:WFQpKwgzpLgle1Vijl6z
TLSH
T12CC23AF248D7883AD96D9743E77D2E035EBCC067B5846550B7C89A1CCC9A2BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3de9517ff2b764f901d2fc0157bd5df552eabf30f364087f3a35fefe9e6d398b
MD5 3f9484f126a32084d22deb9b73b46914
SHA1 16998833e0e1c49b8a40900ce6a1dedafa8eb3d5
SHA512 038a83af19ca4207fde4ca5d3edd9fcd0172fd3b5fa7586b659447d725746e26234dbed8844814590db7ebf12dfc517cfaaae31fb175d12dca95ca859aa01bf5
SSDEEP 192:MONC64BAQmiUyhY1xW5GBPKZX+FdGumWaDHTU6:MONC6eAt7W+d5mzzU6
TLSH
T1A602EA34AC787C7B9EB2BE45F58637175FD8112BE6942B44EAE82B1C00D765C234782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6a10dac6d5358e8abe3d9976039562c3d8772f450860c606f421747697cf5503
MD5 5ecbd78e29490a75bfcc7684e50a0617
SHA1 a78f83ee115be17dea10b4f1dbd60b90f3a82e30
SHA512 d6927eb81b378c3a74b3da9a6ce5bb972bb1030f71a4ee08c126405aa91ae65b1ddc580adf5b751a24587da93a4b9aec12eeb4b62329c4113475acb2bfe41466
SSDEEP 384:7ZcIhsNNb74Eb/ttxd5ml+2PRkOViv7+a6oY:jhEZLgleOVijl6z
TLSH
T1E5828E715C789C3759A6F145F54A36076FF8802796CC6F94A5EDAB2C00EE7E8230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71ee9972daf2d0601e8a3425a69fdc61357f9d093f0da21fb993730d3345aa4b
MD5 f53acebfe1ec6d2a132ce08277cfdb7a
SHA1 8222552956ef4f10cec1524b33d2f4eced79ffec
SHA512 102da35a2ef9ccc440881e36c1881388031e2c1e17024a3f3ac9f814d1f92dc0b8b736f95f8d44a84b554e0a42a7f89fd6c4ac8b1022a9c7a64c99902da9ab7a
SSDEEP 192:VON464BKQmiUyhjxv5GBPKZX+FdGumHqK+2PRkWWwtqIU6:VON46eGSv+d5ml+2PRk0VU6
TLSH
T199121B359C74AC3B5DA2B545F48736075FE9812BEAC47B84E6DC3B1C01EF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9e0512afd62f3e66b43e96af98cfe143ffeb79150ed6133fdcbbfdeeb9b6fa20
MD5 8fdcc72a28328c4edb51f9b522a9fe1f
SHA1 3ed353bd2c35d203328032284ed51b790a5a1d14
SHA512 c4474f3042c7ca840a1bc8957c48d840a6f39be7a5892139ae5db496382469839a54e14862e5c54e837f66ef5783ae61e3e0695a44329b29976c58b9a58d998a
TLSH
T13E412B58AAEA1108B3B33E1AABF2A56E587F78721F4B945D10010E4F4B63B40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download