hxxps://keydifferences[.]com/difference-between-cash-flow-and-fund-flow[.]html#google_vignette

Analysis

user interaction
yes
max time kernel
598s
max time network
557s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://keydifferences.com/difference-between-cash-flow-and-fund-flow.html#google_vignette
Sample260826-vbamnasfqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322367857529833"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{704233F1-DB62-4A91-99E1-D98D16905A72}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2212	556	msedge.exe	85
PID 556 wrote to memory of 4716	556	msedge.exe	87
PID 556 wrote to memory of 1988	556	msedge.exe	86
PID 556 wrote to memory of 1988	556	msedge.exe	86
PID 556 wrote to memory of 1988	556	msedge.exe	86
PID 556 wrote to memory of 3296	556	msedge.exe	89
PID 556 wrote to memory of 3296	556	msedge.exe	89
PID 556 wrote to memory of 3816	556	msedge.exe	90
PID 556 wrote to memory of 3816	556	msedge.exe	90
PID 556 wrote to memory of 3816	556	msedge.exe	90
PID 556 wrote to memory of 2780	556	msedge.exe	91
PID 556 wrote to memory of 2780	556	msedge.exe	91
PID 556 wrote to memory of 2780	556	msedge.exe	91
PID 556 wrote to memory of 2020	556	msedge.exe	92
PID 556 wrote to memory of 2020	556	msedge.exe	92
PID 556 wrote to memory of 2020	556	msedge.exe	92
PID 556 wrote to memory of 4884	556	msedge.exe	93
PID 556 wrote to memory of 4884	556	msedge.exe	93
PID 556 wrote to memory of 4884	556	msedge.exe	93
PID 556 wrote to memory of 3432	556	msedge.exe	97
PID 556 wrote to memory of 2228	556	msedge.exe	98
PID 556 wrote to memory of 3432	556	msedge.exe	97
PID 556 wrote to memory of 2228	556	msedge.exe	98
PID 556 wrote to memory of 2324	556	msedge.exe	100
PID 556 wrote to memory of 2276	556	msedge.exe	103
PID 556 wrote to memory of 2276	556	msedge.exe	103
PID 556 wrote to memory of 2276	556	msedge.exe	103
PID 556 wrote to memory of 2372	556	msedge.exe	104
PID 556 wrote to memory of 2372	556	msedge.exe	104
PID 556 wrote to memory of 2372	556	msedge.exe	104
PID 556 wrote to memory of 1060	556	msedge.exe	107
PID 556 wrote to memory of 4428	556	msedge.exe	108
PID 556 wrote to memory of 768	556	msedge.exe	109
PID 556 wrote to memory of 2916	556	msedge.exe	110
PID 556 wrote to memory of 2916	556	msedge.exe	110
PID 556 wrote to memory of 2916	556	msedge.exe	110
PID 556 wrote to memory of 3652	556	msedge.exe	111
PID 556 wrote to memory of 3652	556	msedge.exe	111
PID 556 wrote to memory of 4528	556	msedge.exe	119
PID 556 wrote to memory of 4528	556	msedge.exe	119
PID 556 wrote to memory of 1872	556	msedge.exe	120
PID 556 wrote to memory of 1872	556	msedge.exe	120
PID 556 wrote to memory of 1872	556	msedge.exe	120
PID 556 wrote to memory of 3888	556	msedge.exe	121
PID 556 wrote to memory of 3888	556	msedge.exe	121
PID 556 wrote to memory of 2420	556	msedge.exe	122
PID 556 wrote to memory of 4188	556	msedge.exe	123
PID 556 wrote to memory of 4188	556	msedge.exe	123
PID 556 wrote to memory of 4188	556	msedge.exe	123
PID 556 wrote to memory of 3016	556	msedge.exe	124
PID 556 wrote to memory of 3016	556	msedge.exe	124
PID 556 wrote to memory of 1220	556	msedge.exe	125
PID 556 wrote to memory of 1220	556	msedge.exe	125
PID 556 wrote to memory of 4028	556	msedge.exe	126
PID 556 wrote to memory of 4028	556	msedge.exe	126
PID 556 wrote to memory of 4932	556	msedge.exe	127
PID 556 wrote to memory of 4932	556	msedge.exe	127
PID 556 wrote to memory of 776	556	msedge.exe	128
PID 556 wrote to memory of 776	556	msedge.exe	128
PID 556 wrote to memory of 776	556	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://keydifferences.com/difference-between-cash-flow-and-fund-flow.html#google_vignette
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcf9edc188,0x7ffcf9edc194,0x7ffcf9edc1a0
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,14718357662049406929,9322339484776856719,262144 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,10709246394213662545,7506145071743218468,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,15083070039349710707,17354341799092711850,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,4141821800714747060,12268110418273004628,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,5514474984350772301,11764297919560595867,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,6758286712297945540,2797765155456998821,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,17404512938363293335,8652497603782555701,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,17077497315089704870,9117327382205646969,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,676814209616556310,14556055547960284215,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11162739627886373309,2674300499122824915,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11162739627886373309,2674300499122824915,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5948,i,7004851787834269730,8159792534864948968,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4692,i,111813711828014037,77015106568982633,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,10896744341257977711,6111442981317018181,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10433337749400265742,13795812667063217510,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,803508015888137007,7739935330719778786,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5916,i,13135438943326203386,14444290346168905489,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,16331592157628798545,10540938522944567937,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,6497540052266444956,5731298163907062228,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5312,i,6201588989028939146,15347729384344202761,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,2849449434256593924,4444957059831046869,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,4358754214756980641,15853487464658568440,262144 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4944,i,7280158960531588862,6264132784687896345,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,781583179928355534,15170168081215248489,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5094096194385771228,11855393598137150231,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,18026236855432506263,7518735820493766868,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,18408560905323004483,18308770513991856832,524288 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5832,i,9357681723817754036,5734787518299396923,2097152 --field-trial-handle=2464,i,14700990494509544267,4034469248388426909,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 aedccf1cdb003ee84d6226c2256b99251ff38a8f6fbbc44b7f8a3dcaa95a9eb7
MD5 8698c7ccc07d924e1ba46b6f2bf69833
SHA1 de755e523d11b54b3d8b32734784fd8d25962f0f
SHA512 e75e523209b5936babceb8931a98694bb2e8ef99f9d47c2634862f14b558e61319a27a34e821bad6aa7e9bad395f1342917aa5760e4b052c4770e302ce2ab1b9
TLSH
T176E086A805CEC26E9718B4D791E8634CC290370BAAC8A95E1704DDC57243954A7A2798
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2bc529b489ba628951b856240036867e7d527d8913ffe00f8deb5b3ac53c2595
MD5 741e88387fdecdcbc74e1b443d5d03d5
SHA1 9996941dc6211202f6eadf61834b80bbdc26f531
SHA512 4771ed5ca3e355ff1bedcc243a8bfdd8d661042f61e45be61fdd050f88c8c955b12c3e862724a8438caa340fcd25f9faba030d865b1ba8dfe9cb5d05759650b6
TLSH
T169E026E514CCC2FEA728A587527C530CC2A0370BD2C8A91E1B0888943203988A2B6791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 8fc6a7dace5cb95a872ad7070e2dcabdc390ab03009881c11e4e3b5aad0440c1
MD5 2f021bff8bc2a5380663f20dde1bef5e
SHA1 7f56bbe0c62f231b2e5fd8fa438ffd36892a01ea
SHA512 fdbb9a978969a4580756ed6112f7f2aa582af45751d6cb6092c40784916bc0dbcec96f0d6495fd83db181f93102475d8bcb0385fd7d1be638f2588065f52cc0d
TLSH
T186F02B6952E8C2F54B8BA1C791DC7619A050B319EFCCD9EE330874847521C41E1957DD
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 539647fdfa03024a4a6c64fa5ae3c04ec4d224ce474de9f83321a1edec885ade
MD5 fab0c662b5467a3f90e2b692c882d9f0
SHA1 d167b091c54f8f3bb5e450f61f23c04dc0f917c2
SHA512 6cc13684e9ae1d2a755247f96f80f018440c84876b2e1338cc01dc98a9a9f547f1c9586e818bb89a0c01579b40187b7b50512c31426bf6cc27f02a7a5404596f
TLSH
T15E81823311F3C3A2D7D1423062D2607DF9B589EAFD3BDEA6515005766E38389A715B18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589100.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589100.TMP
Size 3KB
SHA256 997b84cf4d9077a269f506e485707ad03a8c9a3fa4184416840673ead3773e43
MD5 5c0154b4b51bd359f59a049cc2b9e763
SHA1 d91a2054dcb1193abe78d0f83dd3245785aa7691
SHA512 8cb791d0b88437573bb8d55d900fb4d19fcd2877866d4869ee26639721ab1acdc3f0b7ae4271acae968605194e4519c6eafd7a561b363fdd058720fa0ab7d640
TLSH
T11981933311F3C3A2DBD1423062D2607DF9B589EAFD3BEEA6515005766E38389A715B28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 3579dc4ffe1168e2a9c21901c74f4464ef28525e045399ff8e47297b47a29951
MD5 edf9019ba42d67ea88d7bbac4ff53192
SHA1 f6ab5b8aed84eefc9028b32d76148e1dc7336834
SHA512 67817fcf1b1431e07e0079e9b31eecc4c3d9dccb9562d61d960e66821c492dd7f51caf5e15c51fb0220a093cf8505830d0bb5a345572c02cf75bae6e673561fe
TLSH
T16F11B1F383E1929EC91116F09A24EE2BDE1C0506431C7C2985D4FF27D3E3035E006A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 311c9ab3ff98284960904f31ca6b0d1eb396c5ce5417d0013908e62807fa3c5b
MD5 0b3cd0cc0142926540d06211381cc8df
SHA1 fe88f7fc8088376002ed7d2551fc11fc35afbd15
SHA512 8394a6c451ff2a3560add00d45f3ef7c18018f53d1fd8de6ef1538751e497b025b0a97fa7cff1e0c17ee42ea623bf23cd8988f936327b0be4a0aa302e35b8e5a
TLSH
T152117DB3C3D5956E890116F0AA24AE2BCE2D0506821C7C1986D4FF2BD3E3075E00555F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7a27ff741b029a76da5b0adfbcdcef8b76366ebfe5b41edaebf9739c68252171
MD5 3d580e1d77d4a779f3d3cc7e27587325
SHA1 972c4992bf701d7e5869ba090e1b5cf84e9fa1f9
SHA512 3615308bcbd10481024aadebc19b176dd2690ae5235c12891d46c8dc9d3233e4fa91c23ce23c3b9b9e5e9e349cf7b9eaedd8428a98517d4cf5886be14ac19ec7
SSDEEP 192:sxZMRIyM/jK1Ml8Mkp/fhsCr0EIdpJHW6+WNGYIw9xDIgrJ:sxZMqMp/fhsCwdJHbGk9
TLSH
T12042F8116B346977CCDBD309FA567F93D6F91472A2940D48A9FCCA1C04E6AEC221B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 28a2e2d31adf6b8d1dc6d83477201dbbb2b27f3aead3f45590abda7f46ea83dd
MD5 eae1e7ddabd0d5c59d57ee003ed37b38
SHA1 e4cb1f4fd47c422d4f80cea453a0f7b0afd87973
SHA512 67d746803ae3ceae729a293f0406ac828009227bd3f6112b7197986b9388393748b87457a2061b50afe50da1e71fd30bb9266533d4eabd9d3706d54b66f00beb
SSDEEP 192:sxZMRIyM/jK1Ml8UQ+kp/fhsZrqdIdpvGHW6+WNGYImTMhDIg5OJ:sxZMqqVp/fhsZmeOHbGnY
TLSH
T16252E711AA345977CCDBD209FA567F93D6F9047292940E44A9FCCA1C04E6AED221B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 56635f23400b4061ca40bb7940c24faef49af7d278a9fb9fc50931bb370d018e
MD5 43a747f3465b89b84e7eae7da5652f6c
SHA1 9e760e5d43567ae43569371891d124700c07368e
SHA512 7dbd47fb5311abd522f51390139469d74315dd48473a82ef993e9c71537b29cfb00c17d2a069b184bc4a3a7b4e959889b638265ab8073bc9dd05275b9e2b4c70
SSDEEP 768:FVsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9+rorQfM:FVsqxXlWvJD6Tu1ja54LAs9VrV
TLSH
T1A6D21B3B694CCB7E4F840E5CEC266FD76ED801CBA6988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c93dce69b9a43a1ffa594e00a6ddd44686c5c7648c894b607a129b0fcfd37dac
MD5 ee0872f35155112da1ac60cb887a5f1f
SHA1 b05d3a41c56445be822070ce91522775bef8f09d
SHA512 9d7a4ff48192ec539abea86b1ad24f67d7b7cae5ffcaa122f702e1170028c0f94e046675f96fda957e29878e22d9aa001b2cafd05d31e12de78bd291d723f5b0
SSDEEP 96:KYbaKYIKOj+Kg8KmFyKecx9OKe4KuBuKK4+:ExJNRfxVn
TLSH
T10CE1E311723F020238BD295CA2DAAA379E8175633418E4FE7BB950A24D66F214CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3692572d-dd20-4627-9b68-d62be67bb08c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3692572d-dd20-4627-9b68-d62be67bb08c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f308c858593afc689ac6c720341bc843e3b9a2b45feaf86b7d1161b4fa9287df
MD5 c8d1aebb9e5c3f95f37d6fe6606abff1
SHA1 a4f5fba6876a9d38ad65c130fe3a96ecf4506c51
SHA512 8d4c189e03dfa4822ea08c21fb064bd726b1902138ad4273ed6394ddb4fd18e6eaddbbb7ff55f3315aff2436ad83a08ec36e31ddc8aaba2ab1b8d292f7ce290d
SSDEEP 384:2ZcIhsNWQfFbj1dVRNZO5s9Bo+HBbsP4FtoO:khGnDHZOG9BogLvp
TLSH
T1E2828D726D789C775DF2A445F94736134EF88067ABC82F80D4ECAB1C05DA699130F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e84aa45a84e4289124dab2729400f66c7955b8af3d6086c36593d603ffcdae55
MD5 2a10e7d500d21731555ffd714ae6300b
SHA1 11dc669b3a52df197d0b0aa30907c430b086a814
SHA512 7838a87ec8ecf61b8bc12b4585d9beff5a8186ea873e0e18f10b89e5fa27e5700b5ac65743b5dd4e68a1a560f054d56e1abda57723ecd72c2d49139d9b3f7f6d
SSDEEP 384:+iFiZcITsNW8TUNTUlIlPfFbj1dVRNZO5s9so+HBbsP4FtoO:VFQTzwg9nDHZOG9sogLvp
TLSH
T1F7A26E735DA4CC7BADF69A45F94B32138EF84067DA886A90E2DC9A1C01D71DC130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e4020ab6a5576bb75a8ad06f2c2f8d312e971ac2e3935795b785079d81c02ab
MD5 7d220bb52784eaaab6813e16237d6c22
SHA1 fc511b1faa29d7376bec2dee7ab0f2ab48c341ce
SHA512 1650dd6b901987a92decfc7b83507919fe7612fc142c60223a101f0eb554eb3afd158c2a50ef5759bc2a4642972925c19cbaa06b66f4b0fecf6b3586f0532a1b
SSDEEP 192:tONc6JkRtQmiUypPW+RNZOmCMh3Z0RkU6:tONc6Ur2W+RNZO5cBU6
TLSH
T18502D7357D382C7B9EF26D49B98B27175FA4206BF9952B84DAE81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 90edbdf38d39de30e4b9872b379c8d68347416ed6e4889c55aabd0084319bf0d
MD5 679b6b308cdb566f5fec5da8a916c74d
SHA1 52eb07cbbfe590fe020a917d5516be424a9c562e
SHA512 eff72bf4571b9da3968dc8ab789a44c11f2e704043446bb7537378ab3321cd53cac0c9ce5a6e6ab70a4ebaacb601aa63a07b79195887ee9f966579045eb389ff
SSDEEP 384:KZcIhsNWPfFbj1dVRNZO5s9Bo+HBbsP4FtoO:ohxnDHZOG9BogLvp
TLSH
T136828D7269789C775DF2A445F94736134EF8806BABCC2F80D4ECAB1C05DA698130F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0ebd93c136b7277bc99460948d153a96f51868cb4e94a2a57e2fbdd06082d55
MD5 0e23468fe3754db5a1fe3dd337cca7de
SHA1 fc462424e7f260a03adb789ad421e7a544dea80f
SHA512 8d73c0abcd68ff8ac0338d48c77d429a8aab338a3b9958aabe26bd071bf03a32dc2129ce78e5db4ba93bd05fe4a75c831004c904fa9243585a315be77901d2ae
SSDEEP 192:EON36JkRxQmiUylP/+RNZOmCJO9+bVcZKqoZU6:EON36UPM/+RNZO5s9poU6
TLSH
T12012F83269386C7B5EE26845F88736535EE8512BEA897F80D5DC2E1C01EB69C130E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fdc4b1aaf77747fe8607a879e521752f68068ea4e82b29e74fcfa96b9fbc0994
MD5 ed7582c399b2b9fd7e7b680227eaf151
SHA1 28ea5854a0fa91fd8e10be2ccff9d691965f07bb
SHA512 adda98dc19109958534f6109fbebf1d82d4fd39d30c3513ec1301520d3afa45f12872cbcd57da0bb48428ad5ba13e2789f27870542e73d0e5b38cad5545dd81d
TLSH
T10241F858AAF91148B3B77F5AABF6646D587BBC772E07D45E00010D8E0663E40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download