hxxp://google[.]com,

Analysis

user interaction
yes
max time kernel
1049s
max time network
727s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com,
Sample260910-m2x7msvyft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335115023304303"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{D4A26C1B-0867-477B-87E7-8C3C8A071216}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3700	5076	msedge.exe	87
PID 5076 wrote to memory of 2392	5076	msedge.exe	88
PID 5076 wrote to memory of 5092	5076	msedge.exe	89
PID 5076 wrote to memory of 5092	5076	msedge.exe	89
PID 5076 wrote to memory of 5092	5076	msedge.exe	89
PID 5076 wrote to memory of 3400	5076	msedge.exe	90
PID 5076 wrote to memory of 3400	5076	msedge.exe	90
PID 5076 wrote to memory of 3148	5076	msedge.exe	91
PID 5076 wrote to memory of 2712	5076	msedge.exe	92
PID 5076 wrote to memory of 3148	5076	msedge.exe	91
PID 5076 wrote to memory of 3148	5076	msedge.exe	91
PID 5076 wrote to memory of 2712	5076	msedge.exe	92
PID 5076 wrote to memory of 2712	5076	msedge.exe	92
PID 5076 wrote to memory of 4008	5076	msedge.exe	94
PID 5076 wrote to memory of 3864	5076	msedge.exe	95
PID 5076 wrote to memory of 4008	5076	msedge.exe	94
PID 5076 wrote to memory of 4008	5076	msedge.exe	94
PID 5076 wrote to memory of 3864	5076	msedge.exe	95
PID 5076 wrote to memory of 3864	5076	msedge.exe	95
PID 5076 wrote to memory of 780	5076	msedge.exe	97
PID 5076 wrote to memory of 780	5076	msedge.exe	97
PID 5076 wrote to memory of 780	5076	msedge.exe	97
PID 5076 wrote to memory of 2948	5076	msedge.exe	99
PID 5076 wrote to memory of 2948	5076	msedge.exe	99
PID 5076 wrote to memory of 2948	5076	msedge.exe	99
PID 5076 wrote to memory of 3312	5076	msedge.exe	100
PID 5076 wrote to memory of 3160	5076	msedge.exe	101
PID 5076 wrote to memory of 3312	5076	msedge.exe	100
PID 5076 wrote to memory of 3160	5076	msedge.exe	101
PID 5076 wrote to memory of 4132	5076	msedge.exe	103
PID 5076 wrote to memory of 3520	5076	msedge.exe	104
PID 5076 wrote to memory of 3520	5076	msedge.exe	104
PID 5076 wrote to memory of 3520	5076	msedge.exe	104
PID 5076 wrote to memory of 4428	5076	msedge.exe	105
PID 5076 wrote to memory of 4428	5076	msedge.exe	105
PID 5076 wrote to memory of 4428	5076	msedge.exe	105
PID 5076 wrote to memory of 2272	5076	msedge.exe	107
PID 5076 wrote to memory of 2272	5076	msedge.exe	107
PID 5076 wrote to memory of 3244	5076	msedge.exe	114
PID 5076 wrote to memory of 2676	5076	msedge.exe	115
PID 5076 wrote to memory of 1068	5076	msedge.exe	116
PID 5076 wrote to memory of 748	5076	msedge.exe	120
PID 5076 wrote to memory of 748	5076	msedge.exe	120
PID 5076 wrote to memory of 748	5076	msedge.exe	120
PID 5076 wrote to memory of 4524	5076	msedge.exe	121
PID 5076 wrote to memory of 4524	5076	msedge.exe	121
PID 5076 wrote to memory of 4524	5076	msedge.exe	121
PID 5076 wrote to memory of 4104	5076	msedge.exe	122
PID 5076 wrote to memory of 4104	5076	msedge.exe	122
PID 5076 wrote to memory of 3928	5076	msedge.exe	124
PID 5076 wrote to memory of 4560	5076	msedge.exe	125
PID 5076 wrote to memory of 4560	5076	msedge.exe	125
PID 5076 wrote to memory of 1096	5076	msedge.exe	126
PID 5076 wrote to memory of 1096	5076	msedge.exe	126
PID 5076 wrote to memory of 1144	5076	msedge.exe	127
PID 5076 wrote to memory of 1144	5076	msedge.exe	127
PID 5076 wrote to memory of 4176	5076	msedge.exe	130
PID 5076 wrote to memory of 4176	5076	msedge.exe	130
PID 5076 wrote to memory of 3412	5076	msedge.exe	131
PID 5076 wrote to memory of 3412	5076	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com,
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffd954ec188,0x7ffd954ec194,0x7ffd954ec1a0
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9900708339026287847,797583593570634224,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,2828722482500697522,12441190732568419955,262144 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,16753175283234989182,5462370132368529565,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,2534899378965666132,2852120937281838700,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,14529068616325501301,17803996501457791003,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,4422950990110192125,18036670696204578398,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,16936111175414656529,17865183051080815294,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,9493445947869550820,5659408836769873239,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4980,i,11608132747048277260,1020197996693119301,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,5335712017142915624,2554009373549749055,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,15291179683010122664,3153214784884935643,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3774043103871825064,2701411007807689221,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3774043103871825064,2701411007807689221,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6224,i,13692813163479806781,6639772220016085255,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5244,i,13827354685112458654,8868958454189985528,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,1361171334466688302,15605164311189649575,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,7969163280518568165,317956727388416162,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16981445803774964708,16399401545562322710,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,17780389004337404789,409153885156671227,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3052,i,11279452749541151913,5841459995224915574,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3720,i,5847866341897188804,13298671886078773373,2097152 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,10303033945613232925,10430875813011656964,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3768,i,14479788613932893290,5585620696281092195,262144 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,18098695017676199691,14335154672298178315,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6842528499042374351,11916939608288658015,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2179391345310284721,653279259656706663,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2379280037909852441,3630561106025436070,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,669371381746506793,11203397120014670380,524288 --field-trial-handle=2284,i,16153971834497340016,573841274272051397,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

057cbaa8-f3dd-492d-a8fd-453e1aa124ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\057cbaa8-f3dd-492d-a8fd-453e1aa124ec.tmp
Size 14KB
SHA256 0e4288f9e4f9f0d89e63c303fe03cd7b5c6f26e31496d4018c51a6eae2580b97
MD5 f2b8c5497981f33977744645a2e52b88
SHA1 81e6c3f08cf9131bfc797acd9a395b60e6b49bf8
SHA512 402faf85f368068873d54dfc54d45fbd137a72881cc3bfaac6d66df8031c8688a8b59673d926d307b1ea4c4e7c5ad6df31b42bb7ae12808a9059cc9d22fa17e3
SSDEEP 192:sxZVQUnuRhMO5/fDXsgEWdbXrdp4ncHW6+WNcvUqdF/YGfOyHXIg5k/Sk:sxZ9nuwO5/frsgHpHXHbHI/3X8R
TLSH
T17A62E742A92499778CC7D618FE35BF12EAF85072DC951E4CEAFCC51C08EA6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bf26ef5f1eda9da2a469ac53367b3f3c118c115a5bcc7e896d4a09ae2083f625
MD5 bf6e0593c64ccfe6eb2191a28b34cfc1
SHA1 338e60f1feeef9375cf46e460f2dbe1007266b17
SHA512 c162dbc8270d69eba0825bd4c423ab724b497256c2678fa25474830a461be218f364e6ae9f86d1c8b66c35ac303f8285f1700bc9f6fd00863175ddace84d63da
TLSH
T1F9E07D9C57C8CA2EF3847647837C670CC2C03B4ADACC7A5E170084C87449B90B6D76A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3e354668d3cbb7a177a199ca72b0bca2032d40e3810b65612455a57c2687a23c
MD5 50c0c649028a0693a629349eb27ec948
SHA1 2a9bfe6b17d8ec07a1b54f086daa12f95b6bee88
SHA512 11969f7eb89efd54350ca08ddbcfd698363d3b467cfdbb1f977837d3920556ab654f2a1db429c30dc0f710c2678e9c967f136c1d1acaf9de1d3444f580c7090c
TLSH
T185E020D945C5C77DD14074874174BB4DCF813B1F9ACC6E161B40988570817447791558
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 72KB
SHA256 fc886667b90ffad1b0229b102c340d9c93c8250aee944f4df3f35d8833811b04
MD5 2a55cd14779a918e614e873501c38d05
SHA1 4a59f4c5582092271e6c87e69d06d092d722fb44
SHA512 8c3523bb283d22d6ac7e65811cb0e17eaf879368210c26a20fd553204df2e06cb9cf58d4c19fe3b1dead430907fd186d87bb9c9a7afb09fd389d69cc9b39fecc
SSDEEP 1536:kNS2AXW7axoDItayH1pEPAfFzELcpceTwoX0eskqoMf0PHKi7+XF:JWktnHwAfJEL4ceTV0c1HKG+1
TLSH
T159730227B008563A93A0C78C371A48359FFAA0FA1B1452BFF1DB50DBBFE450635589DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 408KB
SHA256 7a50cff2ba27964e1dc892708f201b97f5513ecfedfc4e7e82ecf6c1246f6132
MD5 42af94577490c2f5dc901ea2d3e2e4a3
SHA1 8c93675968611faf7d148c12c1b2170c22075770
SHA512 273d37acb003a2626c57183301d729164bc310d682f159493c63f51f56ce1424e8367db630cfffdf452451011996a79e492c8f78c0ebe75765e1b1f3a94e5515
SSDEEP 6144:CCPRy65+Rj00vSwG8VeWXC8WSMLJI4U1HWUDjfK7PROSLw10UXiA7fg1wfN4kZiQ:LxUAa1d7MLHpU/MQCwqUXiA7LekM5ZY
TLSH
T1C39423D0B157AE489DD980FC00E12ED0CD16D2AD6A077FB61490FA9ED5AE7AD0C891CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c903df97be88284d1ce7af6fca5babf48c0f5de44dc3017d323bd227a4e739dc
MD5 9bdef1d6d56f72faa662862eb5a98217
SHA1 dea27191e8fdbb5665d91bb75802e0dc2b9d2970
SHA512 fc0a6d69b24797c6baf250bb4ccf53ace8e1e3cb9b15b06157233b1b3e134db51695a73765991d2f7dbfe2720da54a04ebaf5757942cefb3f47475708e7b0c3c
SSDEEP 96:9KA/Cyr6rjRYk4ltBQXhv9R5bDdN1W7cP0r00DS/8kDtuL:9/7r0FYkgtBQXhvfBL1Evr1GUZL
TLSH
T1BBC196FB81D1C1A3FF6C0037D89108F730AD64D5F7826B6A199DD8F93A0769882B5768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c9cf611b1ed620623f1e7f14ca626fecfb76fc363ef45fa3f934f95dbd5dd95a
MD5 67db58236faee6968e64382a17d834ad
SHA1 294fa872af3e360952e34d9474c1954ad649c357
SHA512 f5e4fc52fba3feb91c07f5a18f7fcce9497e7ab2112955b0c7a189f79651f63756943e7474b7be50e97badeae43e1bcb0a9dc4be1f6f5561a4eb5cdf858c074d
TLSH
T14771ABF2C3E6822DCA1196F09A146F1BCE1C0552436C3D4D89E4AF5BA3F2471E152B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d43ab86f3511eefa9915552e7e30fcc2d2cdf6d0b1f6ec1a63cee3e817bb3b4d
MD5 242d52f07b05ee45bb8dd3a061e5f9cf
SHA1 f014bf85666f418e37f7f5053a6f9249b482e68b
SHA512 f8dab8820ae85d31b727dbebd20b917bf1c80a807098df8725020c57a4caec60648b24e2af01c8b75a7bb3b3bc568ba90a61f095bcc272c25bfaaa8603b3d213
SSDEEP 192:sxZlRhMO5/fDXsKi5dpscHW6+WNcvU/YC/FQHXIgrJ:sxZlwO5/frsKiJHbH/yX9
TLSH
T14522B851AE38A9778CC7D21DFA15BF53E6F9503295951E48FAFC861C08E6ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 398cec2f7ebc4b1263bf4023ce1955c87f5956f3ff98af5414c828eee2f6f644
MD5 0ff038d7b95d926e4afb9e543642bee3
SHA1 17762ed85c8afc9e4a1d6255f2bc250f4ad2235e
SHA512 3e3df708eff831c9df85af956c560b9bccba69124bcfaca9619c88dbf31b6b4c413e6bab49eda85c9319e288997cfcccf374af0284350cb65ed51a5938f04879
SSDEEP 192:sxZaRhMO5/fDXsi1bXSdpmicHW6+WNcvUqdF/YG8FQHXIg5O/Sk:sxZawO5/frsiRSGHbHI//XKR
TLSH
T10F52E942A92499778CC7D619FE35BF12E6F85433DC951E4CAAFCC51C08EA6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b272f68746e05089e549651985d594dbfc9edddfb35e54d4f6c6395cced331ad
MD5 0965fb6b5d1db8664557d3d7ad237d22
SHA1 e7ba8925b3f75e8cc5bd0e2b03e3364ac37e4ef2
SHA512 04177ed84399c432f300bb92170c8ba0cc86a96d07b0328ddf3f2e1063cc8b0f4b2aa52aaa6c425b249d40fe8cace98dbc669f7d46a2b10516d8ec8116ee200e
SSDEEP 192:sxZaRhMO5/fDXsIEWdbXrdpmncHW6+WNcvUqdF/YGy1QHXIg5k/Sk:sxZawO5/frsIHpHlHbHI/DX8R
TLSH
T12552F842A92499778CC7D518FE35BF12E6F85073DC951E5CAAFCC51C08EA6DD2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 434f2c34b971a5766f1f4a4c16d2a29198a5b236994b3221562f2b7ac3a744e2
MD5 20f9109f08c1f43d4338b2807354e8de
SHA1 73238be81f7aab7da792086f241ca0d5438f54f3
SHA512 5b835425ace9bd45eb6cd50ded28cf9c2e29475e75390e87b6931a59735a3fbe8ccba7184d114932c9c6cd5f86492e09b52e6f9285e5df39ca0ae7c47e8198c1
SSDEEP 192:sxZLRhMO5/fDXsgEWdbXrdpmncHW6+WNcvUqdF/YGy1QHXIg5k/Sk:sxZLwO5/frsgHpHlHbHI/DX8R
TLSH
T1EF52F842AA2499778CC7D658FE35BF12E6F95033DC951E5CAAFCC61C08EA6DD2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a825e3444e3432a0f179951d5808d0b26105fae218a0221dae3c988491c6bc5e
MD5 6997b3979b1c700eea2338f245603b71
SHA1 0ce98a673d2a0427adb1a3fb5674abedec061575
SHA512 3a4a8c1e6d3b0eb8c8628e3abbed94ae144e17c4aa20918c8e443670a5b417d9f323d112ab1a784532a37df38f747c47c44af9304c3245d3226eaa2c27fba427
SSDEEP 768:71qbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrBroX:71qbUj+WvSCs6u1jaaZLbWr6X
TLSH
T127C2D83B240CCA7E4FC01A9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 f1bdaec50106b3c7273ff42e99b904fc441991a6796ddeaefacf39717a3cff7d
MD5 1ef9950db0a319ad7aba300e7269d91c
SHA1 4c76b48c4463a9838bd676fbb450e2d580e067c3
SHA512 0d567c5c7ed396ad6d5d220cb432e7980fd979a2b52ee73795e6b5bf80324f0af410280576a6e11682da318b7316d529f905a5a69d968a967aba10214e169472
TLSH
T119A0025907C40131D50362B325AA2E652316C9500311130753EC52C4CD505454D8139F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 8c506bd7ef4c6c82b2cce7fa53e0784e2717d830539d5a66ac2509bb81bd4f63
MD5 3862aba099f067ab665288e57d1f2699
SHA1 6843202d399c5242b83f1efe924c9d90a9a57e47
SHA512 4f972256afe9ca386de6d7558466bc3c7a3a5b84480a432a42c9405f7120d777ff68f79e7a988f89b2d657adec383c9402ab7fc943d7363472d2aa8d794d250d
TLSH
T162A002910380400BCC1211B125D312925F04CA543140975740914894EC964D14D6110C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\temp-index
Size 360B
SHA256 ea884ca0c7ff11680dd4df4876d4b49493c842875d61cff929764d3372065f1f
MD5 f3a940a907e63b935471a808bcf41b3a
SHA1 0303cde9b2ffc98602581a2c96a29b69c20d58b1
SHA512 9747ebdaaf09ff5780d54acd65db5e93a0f2378582e362792750d1e8d20594e228f3e1411686b2af9523084a4b34a2b7303e6adfe263c0817f1e0ecf3dcaeb67
TLSH
T122E02B214ED1083ADA200F71147211D5B3B04CFCB611994A647DE56F2C5634854562DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 a8df9a86b39f32c68de81b971aa209b0fb4f15deef39f0e77c0b75b913f21e83
MD5 4ba32a66d5761f19eec19bf41e7890a4
SHA1 d6c20d361f3f4e68769562b5bdaad85bd08cf8de
SHA512 14a210d9e03bbcf600576bb0995dc1ebf1328b20935e4faa368168557ee536c7978c8959f823f1aa9fd2d187600d4c16ab35e0496290055515c3c1f7decec800
TLSH
T17651E74E4E474F6EDDA8127118B50490333416CC1378190BA6FEC138FC87B182CD5BA5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a2a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe58a2a4.TMP
Size 360B
SHA256 caa0d78d400013a6e48ccb1f06373073981e10f2423c2c958c808fb1afd78ab8
MD5 952205801ba436a832e38ce5aac19a09
SHA1 ebb0c6ffd347e7059fe2ca3d44b750f99ff275c1
SHA512 60cfd1f5d039fee3191011d8d19a9f77d70e85d1bb77702c220346b3c8c4bff1f9554e56c282f9168492355c5a024beb3009313d413133f134ce0d992f64f604
TLSH
T1BDE0954987420422DD500577186154D6F374CD607671FA86347CF83E2C7578CD5922CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 d45d70e1f8c9b238652bbc1eba1620df3347cd7397bfeb546356511b222b77c6
MD5 21465fb69c2643587b429ba364f62a14
SHA1 8e778fa5ba0ac0a410d57fe2c85ba646977d91c6
SHA512 67d8a9cd3606ab37cb5d3d72479e511a8709ed324e31adc81d887127c52f813b5177a4abd02c85c3b72ebed39a3763fe3c913a738f213d9c34e2ef88108697f9
TLSH
T1BBE068FA29F72860BCBBA3F5247008E0024A7988C946BC8E006AA1D750F33612856C60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d2101217a75a80e10660315b18bf0daff49f5c8181c020d2ef9f5472fc0b96ac
MD5 173d3355342f027f04788f97e972f73b
SHA1 d990ad2a86c51f42d387136d3fad4650044c52ab
SHA512 4e6366b15dfb91ba736259ed3ce06e3dbbafe7b08751cb1eaa9b7b3802f114a27041e0c10cb2745c18b862f5a4ca1e92e1ecc32191b19583bcfcedfe2f870a4c
TLSH
T198A00254B9BB901DC940167450B95D5573A068DE02453201C4DCE1D8CC9124155CD901
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f98e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f98e.TMP
Size 48B
SHA256 f2d96d40fb487818cbafbe7f026313b5bb30f459010805414a5aaec98cf2d08e
MD5 b4f4a9933944a8d22d028bad5e6400dd
SHA1 42a5f3539885aec100689217cebc31a56bb74e6b
SHA512 83472fead05de9ec31376c49aaa9f7e690260c1ceba66f7c3b9e449f8f624992884108fa719cbf47d7e4f6075eb8c58e8481f24087ed3947fc466606162bd236
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a6163490e534460db4fe250e38e7297225f804b50c512144d976674d657eb309
MD5 9147768192694a8921e8c25367d09c94
SHA1 36276765f3cb5ab1e3d78c1df80f431e448713c2
SHA512 27f30c21b2708dc710b26fc95f87be28fbc87c5ecdc433597d4cf87d4567258fcd7a8cd4182cd6a61304c4426ab341096b2572240b1315f8475ba4f269c0d731
SSDEEP 96:KcaEK3qu2FGK2gOcFgseaug6C/zUUgKs1UWgQkUv28t+k:y71j9N
TLSH
T175912105317A8A2138FD744DA1A1966A5E4272733018F66F3FB863664E7AE110CFF8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5955a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5955a8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c376a21ff02a52f0c29eb6be0310eea64cf4e76d13a867c8e14e8d24ea4a0ab5
MD5 d3be4c83d0307283bc550211d7825fc2
SHA1 91bc203053f4d547c27a2742f5933efe820dcd81
SHA512 235dcaee56f57fe34da05d569936e41238cf3ca297ca0aeaa72b168279760b8ba27b672a37342e350341cf4f3edcfd96c8c2480c72b13bf32bd4cebd0d9b85ca
SSDEEP 384:QZcIhsNzG0rf6OD/e2Ea+Rdrg+2zThxuvzxV+MhdpUof:uhSHDelasdglzTh4184pUE
TLSH
T10E827D316C786DB65CE66144F88736079FF490679ECD6B90D5DCEF0D00EA6A8231BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 de008754f565d0c9ca551f8b1995cd622e836db72d08e21d0da66696d24a3f8b
MD5 eb20a2cbe5312abc12635ef26b901c99
SHA1 aef2ac69c634bd6c8451c615e1427b807274cd96
SHA512 6909a1dbddbeb9addabeca444605293f5423a2c4e2b5bc9ee984b6d18a1d727b4e53c4e8b8f6631e17872a14346446697691927091424db97aa5bb21e6589f2c
SSDEEP 192:vON46Db6QmiUyFtHBa+j36+FdCuRgZvU6:vON46uWHBa+RdmlU6
TLSH
T1B202F93968782CB79EE26E49F48737275FE4207B99962B94DADC5F0C00D764C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7bcf2577231687ab73712374532d5cb1c748a7c35af3211e642130af04fc1032
MD5 12691c5b7413bbd37383099a3ca4eca7
SHA1 97dfc7d594abd1daaaae2594753ad0f6b7468e40
SHA512 32fd599f3d3aab70e42138e1502fc638d68b5a1be5fb05914494706923b001ab5ada571c08815d7b37161d292cedc9f45f5c01bf8b61e30c76f3815bccd343a1
SSDEEP 384:1iFiZcIdsNN8TUNTUlIl/Tzrfs4JEa+Rdrg+2zYhxuvzxV+MhdpUof:8FQdwwgJ9CasdglzYh4184pUE
TLSH
T102A26D725CA89D7A9DE75A44F84632079FF48077CED9AAA0E6DCDF0D00A759C230BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0285d0f2ffce8c0ec7fec68ab93ddb31d7ed568a37c43cedbb4061319ee0e40d
MD5 851bb2db0ca4b26573c8684c6381e90c
SHA1 9f2c76c63b490100b8fc16e11c74a8fc7bb218ed
SHA512 29cbcfdce873caafe33b6f840e434f51795d11467dc9ef557114c1d217a40b3a03abe314719a9245bb9c35d98d9f8c149f36cb70df561f97a7409c9f1c218b96
SSDEEP 192:EONW6DbjQmiUyftHBa+j36+FdCkQ60+2zARNzEq/U6:EONW6dAHBa+Rdrg+2zehU6
TLSH
T13D12093668786CBB5DD26940F48736139FE45127DE8E7BA1D6DC5F0C00EBA6C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 658ff2d725576d866f145074e77ed62b6118b7055c983c61dd3d8366844d30f0
MD5 7d4ebcf498dcabc34eade2d89b5bef80
SHA1 00a2923549437e9418c47c1747f2588916fa17a3
SHA512 58d348809fc062de580bdbcfff27c5deb6b82c5eb1c11f10a1b2dad9d8d50df139a5b05453d3f4c7d16dc8a698eb8a0f8055e3ba4674a29ea8153d38a1c8a7ab
SSDEEP 384:0ZcI0sNz/Tzrfs3JEa+Rdrg+2zThxuvzxV+MhdpUof:y0I2CasdglzTh4184pUE
TLSH
T1EE827C316C786DB65CE76144F88736079FF490679ACD6B90D5DCEF0D00EA6A8231BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1c5e1bdfede0b44936c275b587ffae11e59352ad9591f66f8781c2d1d6a40e19
MD5 3a589daa1a63b92d0f7907832945ee47
SHA1 b01b53924f1083dde28897e4883e85f8d2041d51
SHA512 d904710190c11920a5ea24db66a384869d580c0effaa8fd5693f0b1c574629e4655af09aeb1739075b6576e1335cb738584dfe62e2d775d81105bbd98b961c00
TLSH
T1D541179CA7ED1158B3B77E6AABF6A86D447BBC732E06D45D10110D4E0A72B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download