hxxp://gemini[.]google[.]com

Analysis

user interaction
yes
max time kernel
1798s
max time network
1787s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gemini.google.com
Sample260910-t4yphssejg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335318652586791"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{77A252FE-39C5-44BA-B17E-2B0853F3575A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C021BA9B-D7F5-426E-8747-856F5D8F5D16}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1936	2280	msedge.exe	89
PID 2280 wrote to memory of 1928	2280	msedge.exe	91
PID 2280 wrote to memory of 6032	2280	msedge.exe	92
PID 2280 wrote to memory of 6032	2280	msedge.exe	92
PID 2280 wrote to memory of 6032	2280	msedge.exe	92
PID 2280 wrote to memory of 2536	2280	msedge.exe	93
PID 2280 wrote to memory of 2536	2280	msedge.exe	93
PID 2280 wrote to memory of 6108	2280	msedge.exe	94
PID 2280 wrote to memory of 6108	2280	msedge.exe	94
PID 2280 wrote to memory of 6108	2280	msedge.exe	94
PID 2280 wrote to memory of 5872	2280	msedge.exe	95
PID 2280 wrote to memory of 5872	2280	msedge.exe	95
PID 2280 wrote to memory of 5872	2280	msedge.exe	95
PID 2280 wrote to memory of 2492	2280	msedge.exe	96
PID 2280 wrote to memory of 2492	2280	msedge.exe	96
PID 2280 wrote to memory of 2492	2280	msedge.exe	96
PID 2280 wrote to memory of 3332	2280	msedge.exe	97
PID 2280 wrote to memory of 3332	2280	msedge.exe	97
PID 2280 wrote to memory of 3332	2280	msedge.exe	97
PID 2280 wrote to memory of 3052	2280	msedge.exe	99
PID 2280 wrote to memory of 3052	2280	msedge.exe	99
PID 2280 wrote to memory of 3052	2280	msedge.exe	99
PID 2280 wrote to memory of 2384	2280	msedge.exe	100
PID 2280 wrote to memory of 3064	2280	msedge.exe	101
PID 2280 wrote to memory of 2384	2280	msedge.exe	100
PID 2280 wrote to memory of 3064	2280	msedge.exe	101
PID 2280 wrote to memory of 4056	2280	msedge.exe	102
PID 2280 wrote to memory of 3076	2280	msedge.exe	103
PID 2280 wrote to memory of 4056	2280	msedge.exe	102
PID 2280 wrote to memory of 1036	2280	msedge.exe	105
PID 2280 wrote to memory of 5312	2280	msedge.exe	108
PID 2280 wrote to memory of 5312	2280	msedge.exe	108
PID 2280 wrote to memory of 5312	2280	msedge.exe	108
PID 2280 wrote to memory of 5996	2280	msedge.exe	112
PID 2280 wrote to memory of 3496	2280	msedge.exe	113
PID 2280 wrote to memory of 4064	2280	msedge.exe	114
PID 2280 wrote to memory of 2992	2280	msedge.exe	115
PID 2280 wrote to memory of 2992	2280	msedge.exe	115
PID 2280 wrote to memory of 5844	2280	msedge.exe	117
PID 2280 wrote to memory of 5888	2280	msedge.exe	118
PID 2280 wrote to memory of 5888	2280	msedge.exe	118
PID 2280 wrote to memory of 4856	2280	msedge.exe	119
PID 2280 wrote to memory of 4856	2280	msedge.exe	119
PID 2280 wrote to memory of 2148	2280	msedge.exe	120
PID 2280 wrote to memory of 2148	2280	msedge.exe	120
PID 2280 wrote to memory of 4936	2280	msedge.exe	121
PID 2280 wrote to memory of 4936	2280	msedge.exe	121
PID 2280 wrote to memory of 5620	2280	msedge.exe	122
PID 2280 wrote to memory of 5620	2280	msedge.exe	122
PID 2280 wrote to memory of 5768	2280	msedge.exe	124
PID 2280 wrote to memory of 5768	2280	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gemini.google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd1e07c188,0x7ffd1e07c194,0x7ffd1e07c1a0
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,7594588237251241756,6931902959002903588,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,844147975925228127,804523019682691520,262144 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:2
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,13267206280988566650,4033716801436860101,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6282188925245262317,4008091642441994479,2097152 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,10805806384666031600,7266862520755405889,2097152 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,18349688909278819811,5919863029751875336,2097152 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,2180894350350727328,7799335387264365117,2097152 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3728,i,5175536745204272165,13100385096527591732,2097152 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17099202843004825110,351814403171679582,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,15447449046090081805,4051602998421434988,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,9673558988243599744,2675728059020755739,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:12
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2207476815958170489,16570544938634519557,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,14242876643451535099,14458322270873279499,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,14242876643451535099,14458322270873279499,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6848,i,8589999384780506650,6681667979056035330,2097152 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1084,i,2057279855832317220,10322832250918892855,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,3656092280461089859,702227534219781415,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,6548775835218296095,9290151675662456500,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,16326577455315706397,8502461154101871546,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5656,i,5160153950785400166,18279519715613274698,262144 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,452970948809573953,1200473947393115235,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,17341100170944301565,650479174298932794,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,7685777385167163001,13704347624467540983,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,17828587438156285766,15219794660852343613,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,9570712780933176706,2751289830304569567,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,7321576976405882926,16911568061203788162,524288 --field-trial-handle=2804,i,3845700998037453663,9134755107796649129,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
  2⤵
  PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2456

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

841af932-80c1-4cd7-af58-3ac278a24710.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\841af932-80c1-4cd7-af58-3ac278a24710.tmp
Size 14KB
SHA256 363914d302aa78bb6b5fffe0389f95c1b1455b900607d9a56491df5176d69e66
MD5 455724113b0910c0447d228ddb0ad00f
SHA1 fc263863b0a6cea588c1688668e5e5ef232c0e08
SHA512 09fcf2535eeb7291d382c9a1f8dd2dbbeb19390980ec1340d1027291a32e5f9a686da54d22b1a8f1eb2bf176b5f966ca073f3def9544f17b29518dfabbe96abd
SSDEEP 192:sxRhhRAyM/jK1Ml8wbq/f4sMprQ5BzoA8p/P5/g6+WNZNC/Yn3U9hZGcIgIJ:sxRHelq/f4sMjZ/52/ie7s
TLSH
T1B962D9166A346D7B8CDBD21DFA55BF93D6F85173A1941E44AAFC8A0C00E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3b41af298858264a238b144cd0d4db3ce9c23f0145c479634927dba01461ed10
MD5 d959d72aee3b4164707dde160dae3527
SHA1 92e48126d36a164a750c13047bd802ab664fb578
SHA512 bd2062c4410cb4f142949652d61455ead8fb66d5da3a95b8477ceb22844d65a03cdd138c0e072a1ff0bd8360c50f73b530bf61f7c92542bc51b6a1ecfffe140a
TLSH
T1F3E026A507CCC32EE24875A7416C5B4C8F823B4B93CC6F6E17048484F4C3344FA82690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1a3fdfb477b53a567b6344c0d6b89873528a4934ea6be9353c71ebc6851967f9
MD5 a818d484706f4abf8c757fe7171d7b63
SHA1 e991e8a6679ded8f96e1f053825fb9d422dcb3d4
SHA512 4c403f98d6e57ae9c8c40f711d4f6f51edd0585806ca6d476ab840b15cb8e38bb7ddb65b5977a423db29559ac106996d5b13c3b81f4db8a8d9dcfe58859bcb59
TLSH
T185E020C816C9C25DE154759745B8574CC3813B0AD6CCAA151704848471416546B87DE4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 60KB
SHA256 5e7cfecaa53f4f65a313fe89b0f389548126544a78fad8489510c70ae641a4a1
MD5 ad634768c54f6abbbec10908b55884c6
SHA1 a5e60ad13bcad32c445051a045b83ffc639c2dd2
SHA512 e238c3f4e791040b81a361fd91f68a92ecfcc67a5c623f80025b6cf8705f2adfb877e1e792b520625b88f461a1d9691174905fbb254d5c9ea18dde6a1d054620
SSDEEP 768:/+Tx5GhlVxaHn1bcNBSPgHACDG6QFA/30d3P7X64zH+CUpufOXXufYr0y8VukZ8p:/RXVxaHW/+wAcAFAH4CCLfsohip
TLSH
T15653021307752B91FA38DB3309D0EE3B63CAB68268DD261CCDA05B7B1D9764805DD42E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 202KB
SHA256 6bc3001f8874bbb3f9020dd3d19b9a5671f5bd25b6bf607174e8ea7aa3203070
MD5 81d5044943df1af3e9969ecaf0487e3f
SHA1 1b739fb76254ad010fe65dfb4f974c6e72bc37ab
SHA512 8d4fde018994842d7ae02c70706d3f372cd30d7be8bfa336c908b3a601bcde111e65b53d2f0bf2f807c0182ed5c74c77927eab7a67bd1c9058bacff4c749011c
SSDEEP 3072:bo2d5zfd1Lt4ROp8Ku6menrecUroJwMQqesTzp7z1+07soyQAAeDYtSu4BEIRSQ:bftVDl+J6L6cIsfp7z1LIXTkSptR5
TLSH
T1B214230E8AE10DECEEC7A3375D7A92A818A9071F9E15621090DE45343F76CECD9746B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6b06e46c8046edeebd9ee21afe2edb93a323626e6a45560d182313dda1a83bb7
MD5 05c558ab4802d192e4c4d2add2f11191
SHA1 83bf931e23083fbaaa9e0ec653b3b9f035de96f8
SHA512 127fa2d2c46d347e4745bd1b279f31a03e082d1f5caf2e0244fb8d5744036ee590475a830aa2b3f317fe08f7d6058a0c2ad961a1e1d19e7331a3ba8447350d24
SSDEEP 96:e0G2By04s4lD19snEXtf0eQ+HX4gspb7mMHM04sZ54UVyCey4TDwba4/Bd543G0O:oTgmD1Gnc39cbtMrcb0GVeisEkupWQHB
TLSH
T1A6B10D1887E8A99CC76909F1BCF0F5983679D8ED634B4E2590D4DFFD1A433971980287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a8e86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8e86.TMP
Size 2KB
SHA256 bb01a5f75d1e0d273456f4240293072f449edfeb588bfbe87ab53d4e9d5ef556
MD5 0f7a8aea6d6b1c62d025708236505583
SHA1 946bf052a8fc6c81cd2277f01804a6ab3d7e93dc
SHA512 3954fe7d220ba61f755d63e572599dec3020f707991fa801eafc93247bdef9d9261896461115da510a319d47ce9b308e659f5743e5bcb7d0642677e071f36838
TLSH
T1AA411E5C833CDFCDDBA449B1BCF0D6847ABED8DE0707AE50D4A41BBC4A06B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 61e34d6346dfbe83fc6cd866a3aa53e4e011b50a60806800017057afb2505301
MD5 34ad094a1b1293d614fca62753a0371f
SHA1 2d788ef950f63670bf7122e9d115ab5033052cdb
SHA512 dca89e48cab98e475f162c8142e20fa657d7a85a8f1f48979fa317d5d49e654a96656ecee12b631244cc4257158c6425bd01ca8b6e5d7b9b7840c36c56bcd952
SSDEEP 192:DWtturzEW+NegCdKLP+QFrebVaaiZ1j9FQhRAwVRqdDuTKkZk/Gj44wGNB0UQGQ6:DWtturzEW+NegCdKLP+QFrebVaaiZ1jg
TLSH
T1DB127AFB83E5822DC91156F4DB15AF1FCE290614432C387AC8D8AE67D3E2472E11676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 1c5a65cc0eacc14817746a5fd305a58a64c3b718d5e0465e67129982cd584053
MD5 b5fc9c55b4861ca306325b83da680003
SHA1 eff4656f930f5d4925f3b448c39a1f35d9e4160b
SHA512 9456ae670db0467d6e0d897118a21a2f304b622cc6d4336ab9c9809409aef20b107d53cbdb755bf9e21f30e239f546aebaf5df5e6b1fc9c9bb0abadd79bf414e
SSDEEP 192:DWtturzEW+NegpVfveCdKLPWVaaiZ1j9FQhRAwVRqdDuTKkZk/Gj44k+S0uEqjmh:DWtturzEW+NegpVfveCdKLPWVaaiZ1ju
TLSH
T1A1127AFB83E5822DC91156F49B05AF1FCE290614432C387AC9D8BE27D3E2472E11676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e329f2da322d9fec93a0e1e0d78ad30f36b9287a23d33ca694c52e19e2130f13
MD5 4f50219d68d816e780a3c9c14955f350
SHA1 8efe501a373a9b2b48a45f248c7a011f49e2b824
SHA512 307bcadae2ebd5dfee04bdfc1537379dfbc21bf8774b28f5fc758f9b020e5722535407ef4a52001333d539c655bf75c1a4949b4ea595c0d621d311bc83dcecd5
SSDEEP 192:DWtturzEW+NeCdKLP+QFrenvVaaiZ1j9FQhRAwVRqdDuTKkZgGj43IXDj5otmu/W:DWtturzEW+NeCdKLP+QFrenvVaaiZ1jS
TLSH
T19F229AF7C3E9822DC90156F49B15AF1FCE290614432C387AC9D8AE67D3E2472E11676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 c525dde7eb2d3793db88c8e8311b71edf17f6f63e83097f05fdb193a41a228af
MD5 c174fba44ebe02de98b3549dc64552fc
SHA1 5e0318d6e7c2736216f556a8509386cb68ac0a52
SHA512 4e614269ff39565d92a8857ae2187671daba15a62769a53a78639e845a39fd27268fc5a692d1c4e12cffe2327bfd656df88be23f652ae8d7f94049956c247776
SSDEEP 192:DWtturzE+Ne5dKLP+QFrenL9yqVaaiZ1j9FQhRAwVRqdDYKkZGj43Izj5pmu/0+O:DWtturzE+Ne5dKLP+QFrenLEqVaaiZ1K
TLSH
T1CE228BF7C3E9822DC91156F49B15AF1FCE290614432C387AC8D8AE6BD3E2471E11676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 29b59f5b3b4a3ae153fe2ac8c59785215de296c329846ed29950088c10f5bb87
MD5 59cfffafafa48b4aa2dd3abf866dde71
SHA1 84270ffaf9c076149a3c49082e10e25a28b7d93d
SHA512 6e6b312970bcde193b3ccb35c13585dfd38eea5344ca8182f1edd151810317d38ebed81896903c64edfb7b4f303ac375ed211beabf6d4f2a92107e9f70f8ad6c
SSDEEP 192:DWtturz+Ne5dKLPK8FrenLgQTVaaiZ1j9FQhRAwVndDYKkZGj43Izj5ymu/0+NqP:DWtturz+Ne5dKLPK8FrenLgQTVaaiZ1E
TLSH
T113228BF783E5822DC90156F49B15AF1FCE290618432C387AC9D8BE67D3E2472E11676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 6fc513de519b9e44896b6ea08fe5d085836cb62f44567bc9e1fe283ed7394226
MD5 4f2c89b5106f76ef62aaf3cbb8b9562f
SHA1 88fc99652b54c2960e2a1268397e77f516f4ec8f
SHA512 ba6d4f796be9b70ff1a09d31cfbe649bab0cd931c3499835dfbdf871845f22812ea8bf3553e9f77dfd88d73c878ab2b3bc995544993bbb728c0b11c0acbbf98e
SSDEEP 192:DRYcKPwjs3kh6BevbbLx42VaaikmGjFF/hyAwV+GqdDVTKk5yG1BpKf0MuUHgWG:DRYcKPwjs3kh6BevbbLx42VaaikmGjFL
TLSH
T1673289F7C3D9822DCD0156F49B15AF1ECE1A0A18432C382AC8D9AF5BD3E2471E21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 21a773afa59e87bda26bfa59027c205d59f3dc802d60ca1046edb115419cc345
MD5 52b1c6ccbf115af99ae84478e71f2d3a
SHA1 2cbb529c5a1a9b03bc247bc35c4998a05c3d8d09
SHA512 a7a2bfe6983d105551e18c7067635b3c1ad9fec77da7d7ebc90526cf0a53a6816d7e293671fefb4ebd636acceb1cb5c3663f4ff29d82c04f47996a89ff583f8e
TLSH
T101316867827EA86720390CF70E05B84569BFAC324281A8F8CBE7836C60905F70B27857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe6c2890.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe6c2890.TMP
Size 1KB
SHA256 7b42b0793cd7922f1ed9635d5a938c296eefb4b353d2e21cb8f49b4eadb89020
MD5 e36d2042e47045d508e1c75636e54e24
SHA1 81283549dc06017600f53d6e51fc3ff89f5ac8e9
SHA512 28bdeee7b1e70e7ae95d6f5f3c9b28c21ac14e7b54c673e381d9219daa0e29d1d6a12bb26730b2b58babb77ad644b6692f62c57fa251de67e6fd941cb0b2cedc
TLSH
T186314867827EA86B20390DF70E45B84569BFAC324281A8F8DBD7836C60905F70B27857
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 265895f967217d571fe48a074b7aa52b70add430124808582fe8199d5e18034f
MD5 3218c2737608c0e655895c8737a1e85c
SHA1 9fb982fb9f0f14df12586ec5e579869ab8ff86af
SHA512 b287258998ceba0daf1efe11a61b6c01057e2d540757397b3d026f665e62164ed23f3ddbb0fab3c2a88169c66571bc6e2de9ae15028c24d36cfb83393b4c767c
SSDEEP 192:sxRchRAyMojK1Ml8UQfybq/f4srHprQ5zzoA8pFwtDNSvVI8g6+WN1HT27I20XYT:sxRklqcq/f4srHLm0/5mmX5L7c
TLSH
T15972D71665345E778CDBE21DF951BB97D6F85062A2941E44AAFCCE1C00E7BDD210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3cf12b885bee69f3fc00cb37c7300b1d5c5d53659def99bc4ddf2c06a4009ded
MD5 9e6cdb0d79655c1691255fe2cde63171
SHA1 5dac26f49a934d8e59e9a5bad45bc6257a8f114c
SHA512 a3c92d210fb96ff22fbdad0e019f54e7389e5689972b35e2aca4e8019740968301ccc2e645eb2cca2046d9dfab3c50e5d3603ed79f4a097bd5dbeb8d11305c35
SSDEEP 192:sxRshRAyM/jK1Ml8wbq/f4sxprQ5ezoA8pWdPk/g6+WNAiNC/Yn3UNhZGcIgD2J:sxR0elq/f4sxuD/50/iw7e
TLSH
T16262C8166A345E7BCCDBD219FA55BF97D6F85063A1941E44AAFC8A0C00E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f5192160ccbb68116d9473a161344dd0c74e809ba7ab182a9404ee5db40f1be9
MD5 60a3e3f081b99a13486aa2e9c46c5bc7
SHA1 8d2a5b2d91c3945dd5c8903b1344290de672fed2
SHA512 19da791821971893d391df4cd87ec98af8be05ad1fcc3384517da73523d3148dd0bb590e9aca5af891f83da10e56fb25af2a2130f4e67eae6c6a948340795a78
SSDEEP 192:sxRchRAyM/jK1Ml8wbq/f4srHprQ5zzoA8pnwtDNSvVI8g6+WN1HT27INC/Yncjo:sxRkelq/f4srHLc0/5mT/xL7c
TLSH
T12972D71669345E77CCDBE219F951BBA7D6F85062A2941E44AAFCCE1C00E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 742b8eed07e6895c744ab4e75b9fd9c4d3a6430d208011aeacceceadd88265a9
MD5 0bb6fd1efbd0c60c4bf59441d6a16cde
SHA1 5db2173610f5196a5b12addf1093bfc05fd71667
SHA512 761873953321c5e8d4ab6ef7f9d4ff509ca694687dc86670cc570cb2d3ab20b79f3c2b2f4ecc4fce4d337bdc0711809df4c3209c4893ee5e47fdec86b54a6c97
SSDEEP 192:sxRchRAyMojK1Ml8wbq/f4srHprQ5zzoA8pnwtDNSvVI8g6+WN1HT27IxOZYn3jo:sxRkllq/f4srHLc0/5mPZ2L7c
TLSH
T12772D716A5345E7B8CDBE219F951BF97D6F85062A1941E44AAFCCE1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8376d63e38156aeea15211c58bf4547549c82366852f3eac8ba51ab2262d4cd5
MD5 3b98f7d48794067bb9614ef82983b649
SHA1 374da93c56ab43ec3043b5b0dd869ddeee8bd8b7
SHA512 f71b65f2a5710de9da409f6bff8efd94ed646ba5a939ccd316f9ad871e42468d54398a406b630adc3371592a2676c1e3d9823ea4e098ec8257b0cc0927162d25
SSDEEP 768:wGedp6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YfroSh8a5p:wGedp6WgoufDMu1jatVYMwP
TLSH
T170C20B2B640CC77E4F844EADEC29EEDB6DD801CB9B984D5447EA890C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 72B
SHA256 79bf64ff2f71477b78727601c655626082e56341dd9b1177ba873f10876ed15c
MD5 f3480859647ee937c827f0f58e152007
SHA1 5336a95d86d5dee2a4b370752e8bcbe9a47ae8ee
SHA512 63142dc425b02a8acab3740fa1dfe76872ba1d97290ebb634c08dd66e04a1269294e71d470493386d425fcac4a17ea195aded1fb08ed7a09fb3b2dd5bbe82b6d
TLSH
T114A0021147D4589ECC41A6B419A3E548121758681C10C75750D8505D8892155D1D2040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dde5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5dde5c.TMP
Size 72B
SHA256 acb27dd268fa4edc5962b793efae01915f404a2abeb84cd37f60a6dc1abd1de1
MD5 9fdb162cb2288dbf8426676d24b41109
SHA1 f984730875de799ffcf0531ccf649557a1b54cac
SHA512 e6f762454597b349670d9e63eb90ab9b53799e40c9874e5af218fd258a71e0f8f30d6e37eb0e784ad7c70ecace2bbe983d2c2630ebdc74e5cdb24208ba2e1902
TLSH
T1D8A0021143D00CD0CC81F1B02407C78813C78C240415C34F61D8505D8D92190554110C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 24931821b747cf87f116959ea139371e9c7886805ff7fa5fa72c50220a64b613
MD5 197d77863c2a615789896b5193c823de
SHA1 25d69b00bb6e3ccff27404037d4946fd3e6bc865
SHA512 8b38172ed7ad8eba84be2f2bb02001a57195defb0f9f6fc287ec56bb274252ef2ca2d548d8fb08ae5473517d0757f8bfe5bb50a772663155a1b25bfbd12ae2a8
TLSH
T141E0207B3EFB2804ECEFD7DA183264510550B468844DBD4F7815E2D714B235434AAC25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9eaedd7211b3e217966a811035f48d8b17fdc736a0153c2c7e58a0cfb37d41c8
MD5 382ed3d298a13c38ffd1b82fe26038bd
SHA1 8dbd8bd138045f3958748a7561e92c35b5cc4d64
SHA512 10dfdf2af46750ddcdcb14df91cdaee8ed9b28db58b7675dc19d897be0e6dc1b2f2b32ee2b6bc2553c4e012f6257efa38794723e8809733d75a8fcd90c167256
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm35:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhN
TLSH
T18191CF55317E02403C7EAA0981F9991EA3C178E23564B42F77E902E64B66F038EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0c3f8240-18c6-47dc-b9e8-2f14b660451f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0c3f8240-18c6-47dc-b9e8-2f14b660451f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bdf24d6726351783594b4b05f74649789d02245e1eb9e5114507d9a910b08934
MD5 d91105468f6e12f42b967d0544a974a9
SHA1 248f91299da93a1a11fe315fbb411d436b720449
SHA512 13c5c33cd5f9b37b4bcd76b23141daf4cb145cb70b5110a7f193093a1acca5e9b28624dfa9edaba452a2c209f9b73a6f6ec9664424043c6ceb8b3853920db977
SSDEEP 768:erv+4UNbdr3CHDZIO0WhTHNzc4ReyIsPBLTJ:ebsb93AHtc44bsZL9
TLSH
T11603BE32F828D977ACE66685F10B35437EF8511B82C91A90D9DD2F4C468B1EE131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3aad31f43ec6003a2501d2675e6ec18934d8edc1e818e62869dcdc6b2d194109
MD5 2fe0e7f074abbf98f65e6fb5fd42fd06
SHA1 4cea8119dfddb23c32120ee742c0f957339589a1
SHA512 87a7ce405fb19e03cacf6713401e4447e5a54b97d8f8cf1c0cf442c54a878230317c1c4bddd8e9e333dd2516f43b9244c2aeab8c749f34db6a004e1dcfef6158
SSDEEP 768:grv+4UNbds31dDZIO0WhTsNzc4ReyIs2BeVH1S5D:gbsbS3tstc44bsWEH1Y
TLSH
T15003BE32E868D977ACE66686B10771537EF8911B82891E90C9DD2F0C4A8B1DE131F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d25aa81411d25d85be4e87fe78abdf586d7013c0fc5987bb86b9886328ec8dcf
MD5 0635875e1bfad3797eb5179d88977241
SHA1 60b5f09b63b285b30ee1bfddf8a4633fd8a95430
SHA512 b561514078312c0bcddef6e65c0b8e39f2e6080d3ed4f02ff15939950eb4d4e13daf12a6c4be0917146ce14e2f6af3aa17832b7ed9e85c721ac2f4b801e8579d
SSDEEP 768:fFQmP3pwgeHDZIO0WhToNzc4ReyIsPBMgEs8:imP38otc44bsZMgEs8
TLSH
T1B7134AF298D78976ECAE5783A73E2D41ADFCC117B1886950B7D85A0CCD461BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3a391cd30f5f627d5cace198e7b9dd444001d96ffdcc3ebfb062c131331a3199
MD5 ff8c64c05a64392b911c36612d2875c3
SHA1 2a54343e98231705bfa598f953b1396d771c0b0a
SHA512 5a62059dd040da7dd313c09fa712e8850b994586877be61b2d93244e2350e7b0539930ef903b72492a4152931a7c6d03fc13dd5aab36d11324b03fd366623518
SSDEEP 384:0ZcIQ38N6xNBiUOy9uCJDZNfNoXOVSUUWXnFLXoabbETRzcoXfK86sfxEZxxsIjV:yQ3jHDZIO0WhT0Nzc4ReyIsPBMgEs8
TLSH
T156F2B031EC74DDA7ACEA6386B6073242BDF4911781CC6E948ADD6F0C05872DE135B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6e3ae495d70ca7dbea99217e5974ec17d87d7792cce7735a2ec72ce51e1960ba
MD5 affdee32616f63dec07c828403f0bf43
SHA1 21663967ab02022713760f2c9d474e8edbde4610
SHA512 48c1937c8ccca84d6fafd48e7d07ebc589d1af0ee7757f15e7b833ad9378f0f00b0f30de452270bba0c6e23820dd3871e27481056210b51f6711a6332a2c5417
SSDEEP 768:6rv+4UNbds3/PDZIO0W/Nzc4ReyIsX+eVH1S5D:6bsbS37tc44bsOEH1Y
TLSH
T1F303CF32E8788977ACF66785B50B76533EF8912782981B90C9DE2F0C4A4B1DD131B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 25c31350757bb3a6a4efa33b2a79d630b4339f4574d7166d47a03df45a497695
MD5 cdb85f176c71de38345e58f2df08cb5f
SHA1 2b17d65791d58b7559c456f7fa7e46919f0153b8
SHA512 4b36b6562e2a10a5227f225e46da7d304500e40d6f024b6482307f32595f5d30a8c0c31a238ca8e9b7ff6dfb5d01d9426613970c77b85580bb7093b93dcfc3bd
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59d42e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59d42e.TMP
Size 392B
SHA256 805b3378224da49a1329708284a0b4118144698d8a532428e24675cf88dec791
MD5 40fbc90af9a5403fa9fee55897030cb6
SHA1 cdbe97114dd4ee53a6a0646134554250321c20a3
SHA512 a16616817095af5a88035e5c92f49c50490cdbb58e30e1f081928b8a87a38cb59227e1f521cc990122013c8a620b8976a1458dd23219fbc2724531817171abfa
MD5 SHA1 SHA512

Submit Download

da5ba733-913d-4635-9b59-c80b575116b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da5ba733-913d-4635-9b59-c80b575116b3.tmp
Size 33KB
SHA256 5983da82e3d26d7ed1f9f57733ace16f75d196cbcefb3cd71428e3779f3f1ed2
MD5 18934a403e427f1da67772e6e180728f
SHA1 a245266b61e2204706cfd219a2019e11fc779a2b
SHA512 5c86595e975d7f48ce98a09fa24d4257156d3687fb62437a5392992991cc73335d74f79ebb3228403a8080da702a00eb5a69b11f427071af179aae924715bce1
SSDEEP 384:LZcIQ38N6xNBiUOy9uCJDZNfNoXOVSUUWXnFLXoabbETRzcoXfK86sfxEZxxsIjV:TQ3jHDZIO0WhT0Nzc4ReyIsPBMgEs8
TLSH
T10DF2BF31EC74DDA7ACEA6786B6073242BEF4911781CC6E948ADD6F0C05872DE135B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download