hxxps://url[.]uk[.]m[.]mimecastprotect[.]com/s/z1uyCqYRgtOjgEVvhYSKphEc_RI

Analysis

user interaction
yes
max time kernel
209s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://url.uk.m.mimecastprotect.com/s/z1uyCqYRgtOjgEVvhYSKphEc_RI
Sample260827-ns7kdstepf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4364	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323044495685111"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{6C476CE4-F216-4D4A-825B-D58387BE9680}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 712	3820	msedge.exe	86
PID 3820 wrote to memory of 4364	3820	msedge.exe	87
PID 3820 wrote to memory of 4480	3820	msedge.exe	88
PID 3820 wrote to memory of 4480	3820	msedge.exe	88
PID 3820 wrote to memory of 5044	3820	msedge.exe	89
PID 3820 wrote to memory of 5044	3820	msedge.exe	89
PID 3820 wrote to memory of 5044	3820	msedge.exe	89
PID 3820 wrote to memory of 1704	3820	msedge.exe	90
PID 3820 wrote to memory of 1704	3820	msedge.exe	90
PID 3820 wrote to memory of 1704	3820	msedge.exe	90
PID 3820 wrote to memory of 5704	3820	msedge.exe	91
PID 3820 wrote to memory of 5704	3820	msedge.exe	91
PID 3820 wrote to memory of 5704	3820	msedge.exe	91
PID 3820 wrote to memory of 3272	3820	msedge.exe	93
PID 3820 wrote to memory of 4464	3820	msedge.exe	94
PID 3820 wrote to memory of 3272	3820	msedge.exe	93
PID 3820 wrote to memory of 3272	3820	msedge.exe	93
PID 3820 wrote to memory of 4464	3820	msedge.exe	94
PID 3820 wrote to memory of 4464	3820	msedge.exe	94
PID 3820 wrote to memory of 4568	3820	msedge.exe	97
PID 3820 wrote to memory of 4568	3820	msedge.exe	97
PID 3820 wrote to memory of 4568	3820	msedge.exe	97
PID 3820 wrote to memory of 5812	3820	msedge.exe	98
PID 3820 wrote to memory of 8	3820	msedge.exe	99
PID 3820 wrote to memory of 5812	3820	msedge.exe	98
PID 3820 wrote to memory of 8	3820	msedge.exe	99
PID 3820 wrote to memory of 4928	3820	msedge.exe	101
PID 3820 wrote to memory of 5640	3820	msedge.exe	109
PID 3820 wrote to memory of 5640	3820	msedge.exe	109
PID 3820 wrote to memory of 5640	3820	msedge.exe	109
PID 3820 wrote to memory of 3240	3820	msedge.exe	111
PID 3820 wrote to memory of 5684	3820	msedge.exe	112
PID 3820 wrote to memory of 5472	3820	msedge.exe	113
PID 3820 wrote to memory of 4992	3820	msedge.exe	115
PID 3820 wrote to memory of 4992	3820	msedge.exe	115
PID 3820 wrote to memory of 3372	3820	msedge.exe	117
PID 3820 wrote to memory of 3372	3820	msedge.exe	117
PID 3820 wrote to memory of 5968	3820	msedge.exe	118
PID 3820 wrote to memory of 3836	3820	msedge.exe	119
PID 3820 wrote to memory of 3836	3820	msedge.exe	119
PID 3820 wrote to memory of 2608	3820	msedge.exe	120
PID 3820 wrote to memory of 2608	3820	msedge.exe	120
PID 3820 wrote to memory of 1476	3820	msedge.exe	121
PID 3820 wrote to memory of 1476	3820	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url.uk.m.mimecastprotect.com/s/z1uyCqYRgtOjgEVvhYSKphEc_RI
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,9246280549521689068,12626606989141866225,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,9996748040043634570,13352774877437455410,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6072222298521485381,11481704969605863066,262144 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,16871790843738258596,17254915292021692760,2097152 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,12711004844587016678,15039441553108439189,2097152 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,18243983333502418802,7282730790792897646,2097152 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,8881784311087882103,11633640628085701409,2097152 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,16592427512332176353,9576109928767140362,2097152 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,9329906383244736289,3992815312558014847,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5067904259928782830,7151475879788568540,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,5279046123586141077,13334112377440034061,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,5279046123586141077,13334112377440034061,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4524,i,3143765110088537670,4886648001723354820,2097152 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7575500997640996775,12373130230497746385,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3168302877716172658,7918300213901238965,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,859367538958129096,3796255143874729650,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,2155022017143510254,13614498170028151152,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10723907058681806852,12966874913447333663,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3752,i,3728444462155238145,12792782843799461584,262144 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,4353541607728500475,7186970692170424737,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,12504871486143466336,10184604370004508232,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,11133186637476844203,508157816445394874,524288 --field-trial-handle=2328,i,15594080617248952463,9129388078656729633,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8f38031739f791af29784e55f093e5e48bb5a4e71d07b148ab99118fc535da73
MD5 e87e0504bcd183dc5d44a407a4dd2d80
SHA1 0ffd2a7de5f33236d765f56545cba24e018d85df
SHA512 c7c7ad14df6c8e11bc38925cffb618a2041672f2a12ecef1a0979d16b07c1106492873564e2542074a1e3793b13fa403abd02e0f39a1756dbe1fb91a86d0258a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T12DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7213de9010ee649715b9d2ac8bbf2aa4b642b3d7ad0dad72da062bd3ac303b18
MD5 0a10a08f17342ab06390e5e6f62b7c03
SHA1 4b8820ed9fc9bdb4dcbb7a18c448876ce2d6df59
SHA512 f411c2d84257b85bb3f1ca70cf559dab413dee4d0fa01f883b460c626a6df8557d117358f3e54eb1747c2e1476d3305a2dfc552ed42005c3cf0aab4e3acd5fb1
TLSH
T1BBE07D8407CAC3AEDF0CE4875374430CC2A2B64ED2C8BD7E5F2085983101C40EBD2590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a70fd271c1686c38a17f2a467d44f56ffd14594316a7713f979b4be33f14a231
MD5 35e13bbe377ee2d241510dcdeafb0350
SHA1 42b4549c74f739f3d1440fafe6b36118e215e75e
SHA512 4dea7b68283a4b58fef642de60b89a210d6f1b1bb96cfe379581853eaa1e539fed6778bf947a30d0ccadbcb94ad058be1f899f538593e9ad199e63eaaf6163f7
TLSH
T146E07D9407C8C36E9A68E45BA368630CC2813A5FD2C8B99A1F10CA883581840EEC27BD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a6fc56c36c49a8d29b0d5ba044ccc3c45dbb2af4d21f562f707385b425dddd87
MD5 19edc3f109926c0c0f9f32aaa5554e13
SHA1 88539172b3347a63b6d0274d6aa2e7319f4ab036
SHA512 da6aa9bcfbc3addca6155fb346fdb5d23a6cf94e9a27a5d3697d9a8e7421f95d24292dd96d6849c894ab24a21fa5df998eabd52d61a76ad0ef0bb33debc26980
TLSH
T1FC616EF8414D0CC1EFA21230E8D1DE0AF4F29EBA99770FC5E55896BE2505B60C14B334
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec99e44e9faac6838291fddafd4d1fc512c6a32c249e8746e5e142826191e939
MD5 d1c1f4ea0619e1dea07c74577532cb4d
SHA1 695982733e17f67e1b9ef0188e2bcc3b5d71ccd8
SHA512 ae70322784e08043c8789413ebc7be91b288c8c2cc5e49d5e017dfc2a5645ac70b1bd0ad007924ac94a21fefcf5590583c0369a656ddef666ca11dbbeb7a4ee1
TLSH
T1977171F4458C0CD0EFA102B0E8D18E0BF4F2AEBAA9770FC6D54845BD280ABA0C14B370
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58533c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58533c.TMP
Size 3KB
SHA256 e657c18b62f4fc54132a31937074e182e6a35a930860a604f8e1ea19a72ab0c5
MD5 bdfdc52485d39336ed59420d239d47d6
SHA1 f5388d9d11332f8ae57424e4e2456497aca53702
SHA512 ec8397bda588c7444ecf46832765a26830c25d43659d61df3acb987866e698b53b4ce7ee80444609074b4076d943962b9f5f1f9c182198621a5e977beea79264
TLSH
T18C616EF8424D0CC1EFA21230E8D19E0EF4F29EBA89770FC5E54856BE2505B60D24B330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 081b4540bd0e4e4a475f79efa29afb00f6a6f3b78c78a38ed0b6f6779694329f
MD5 e733e95be0aa6ce8e67b27f22660f4c4
SHA1 0681137ec9abf873121a5d31e4bb241ea5e7f589
SHA512 864be2c099c75be7db70d4ef3caf80f27a26bac6127b3415397f13daa6784ead7cc112422663a84f296bdee1fadba1bfc587942481b44900b7e0a210bcbf5c68
TLSH
T18D81BEB7C3E9C75DCC0692F4AA146E2BCE1D0515432C3D55C9E8AF9BA3E3470E10964E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 859d57012a347e1c292edc19097cea7c0ff6043ff841c29a68484eca83a55620
MD5 7a581428759ea2507b000a3caf682de4
SHA1 ee19567e0cbf7b908ff0955f6c31efdf1b33f50c
SHA512 3f8d8c62b5be25c69baf8c80ac04b2201bf1159631aba7e4ed7b91d8cda25d8d019bd4ea2aca24a17cf144d648f8a84677d9ab6454fdbcdb6943cc3744328d89
SSDEEP 192:sxZxR5yM/jK1Ml8Mk+/f7s/nLIdpqVlHW6+WNraw/YHD3LRIgrJ:sxZxDM+/f7s/nUiHbZ/O9
TLSH
T19752F8127A386977CCDBD209F951BB53D6F91473A2901E44A9FCDA1C04E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d353514b6d15dfccfdb97ab19541c12a3a61c38c1634c399088ca028dd681f8e
MD5 5b8b2276c0264539f6abf3294bf413d4
SHA1 602d76a68ae9fb4db1ccd241174358bab28cce0d
SHA512 f6cbb386f98b4d82b117d4d6e77b4f6a4afdf51d11011580c5d32a378a6c75651927c61e92f5e54e377e968791376ce4fe09a84bfbae080573386d62d7748197
SSDEEP 192:sxZxR5yM/jK1Ml8UQxk+/f7s0C1aIdpoVz6HW6+WNwfs1+kQXYHHoGxRIg5DJ:sxZxDqC+/f7s0ChXHb3yXwRH
TLSH
T18F62D6527A345A778CDBD219F951BB53D6F5147392A00E44AAFCDA1C00E6BED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c8c9cd0d6e57a6df2a6b9347ea0f4614c5f40760f2b72028ebc5545b146b5e3d
MD5 f9477d9dfa5eba8350fc889e14e52bad
SHA1 267224a0e6db00eb94b9c9bd55b6ebbe70dc3aee
SHA512 b1d3a3a26898d3dbbc6c11ee25a3a0f600ad109d94b502714580f7a5386efd5eba115a89143135fe897e29b80dacc5228434936ef87780a563b7025b09428294
SSDEEP 768:sbUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RTroVd0S:sbUZYTMWvg0Pou1ja7eLZmRgkS
TLSH
T129D20B2B280CCB7E4F844E5DEC2A6F963DD801CB5A984D5447EA884C03CB3EF112B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 25d79d962360b0d754261c4395d40523eb8691ee1dba6a68a64626df507c6eb5
MD5 d3f56425e99c72e334c0dfdfc9f4750a
SHA1 42687a7e9ec73834a87e6bef2c221e031ccd2f93
SHA512 c4ad06ab46ee68599c4f8bfc62c9586926dd65c59be78d11044e8346b45ba4e94cfc6aa1d02f1884cd2ed0a10cf0963e17835b11f2bbd54779d5fa59c97fe166
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLajFo3DFC:E0VFFjnEFo3DFC
TLSH
T161D1171632B602013C3D2A0C86D597AB8E8272637019646B7BED00B5DE67E21DFFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f1ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f1ed.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cb3ba87e02ce15a93b7550f476155289647efdb274269d7b89bb621b4ac1dcf6
MD5 0073a0ec4b5c3c17391d062bb843a25f
SHA1 c669c5fe3dd65be94491deacb2c670191586c6f1
SHA512 bc7e4c37531d0e2d330100f6e38ae0ecb26b64d1a033daf3cca329f5e4cfd7665bc9b1570c83d0a36c4ddad7d39f07a81bd72cbd1ee13b0ad15d3d0dbb80a614
SSDEEP 384:CZcIhsNwuxlFFKzX5od+V8ykVVX9tJrOIg6Sv9qmhhHIOoD6en:whMeOD1/hOIg6SBXk
TLSH
T113827D72A8747C765EE2F19AF84731139EB890739A846F90D2FC6B2D009A568131FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d989db77ac0ac1cd0f2e29d4cac2f3ce7151c5773f39ae12ec908ac0884438e1
MD5 d846ab6efcf1d19b2f236b4c29fb0464
SHA1 f40fbd838ba3cf375bd64b94e84dbbb54442766b
SHA512 e1c394f70e09580b72394acb5cbf391fa5b5789e38a6e70b92db8ab41081d4eabecb97fa365723774aec09a45920cd8dba1f46515b8c0809d859ad811ccf5b25
SSDEEP 384:diFiZcIPsNw8TUNTUlIlTxlFT+oqKzX5od+V8ykVVX9tJrOGg6Sv9qmhhHIOoD6g:UFQP1wgr+oqeOD1/hOGg6SBXk
TLSH
T182C22BF254E7983AD9AE9757B73E2D138EBCC063B5446A50B3E85A1CCC5607FD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48956dd92c2d5642473d1c8ecbec9d4048db5795d978b51fb0330e7fdf23fc67
MD5 6c83b6d4c76a25f1290f50358f6cfc80
SHA1 ab8b4d9332aff5bad7ed16c93716a858cbdba234
SHA512 22a4ba02531fce2fe260dc447af6e64bc6bb968f68a542e83a017d14b1264f223418df6ec1b9a9a9557af6d0df00b2664ce91de17a3edcded7584be84c8eacd8
SSDEEP 192:yONL61VWQmiUyengGX5Obd+j1jzorykaoX/agR315U6:yONL6WfgGX5od+V8ykVCgL5U6
TLSH
T1FF02D935A8687CB78EE2AE4AB48737135F95206BEA552F84D6FC1B1C009765C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72a3edf8be6e7e081531c607eb03cf39d6288d0d8725e625c1af5d48c62e3299
MD5 9ac97aca0d817a55bd69637eb505c7b2
SHA1 641aab207b38a34def8909ca9b3a4bff1d6d8898
SHA512 636eb11c141d28867e7acd1634f3820cf6e0678b4f110d66703ac0747274cfdaa8cb982cf0309b821c55dfaa9e317f028be1b55f26517bb54ee29c5f73be1fdc
SSDEEP 192:aONB61zWQmiUyfnWGX5Obd+j1jzorykaoVX9ySJrOsjJglqDU6:aONB6M0WGX5od+V8ykVVX9tJrOEg6U6
TLSH
T1D1121936A468AC675DE2B585F48B31139FA95127EA496FC0D6FC2B1C01EB69C130EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0504baaadd171ec1249f57a03181ec4fedeb95aa6f5b35e0a5eb1fb8cc136567
MD5 9955d6baa8d992366d76461f106dfb6e
SHA1 b8e33e19a7707f1c357dd3504281b5d66e27281a
SHA512 a1cedac16d0299dbed8302fe1306f18000728135b73745a3a9e589200ad656ca03da4bbdc50f0a32fdaa11d34284a6c799af8608170e417bb2c0d85e2424a765
SSDEEP 384:cZcIhsNwTxlFFKzX5od+V8ykVVX9tJrOIg6Sv9qmhhHIOoD6en:KhreOD1/hOIg6SBXk
TLSH
T18E827D72A8747C765EE3F19AF84731139EB890739A846F90D2FC6B2D009A568131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16c034a8-7c95-4706-8b78-28cab733762f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\16c034a8-7c95-4706-8b78-28cab733762f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6bf54031f55d9c5694ca13fc809fd8fd94adc3e40defc9c610b978168365ce15
MD5 bba642454fafc77f1fb6e8491bc4409c
SHA1 79495f112e9786649a8f826185e730d6c6011a44
SHA512 65b913d6fc592365b01c95999034dbdbaf0f10c39c7ef41fd276a32cda5f83bc46b0754dfe5bd6d3c8e8b5ceb228c36c695b894a2da30b8b987b54edc5ddcd7f
TLSH
T163412B5CAAEA114873737F5AABF7B46D087BB9732E4AD45D10110E4E0A63B41C871737
MD5 SHA1 SHA512 TLSH

Submit Download