hxxp://attachments[.]services[.]syncromsp[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://attachments.services.syncromsp.com
Sample260910-xbd17afm8y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4180	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335392352455647"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{77D79659-021C-4D39-A76C-4C3701947044}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
652	msedge.exe
652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 4180	4772	msedge.exe	87
PID 4772 wrote to memory of 4368	4772	msedge.exe	88
PID 4772 wrote to memory of 4368	4772	msedge.exe	88
PID 4772 wrote to memory of 4768	4772	msedge.exe	89
PID 4772 wrote to memory of 4768	4772	msedge.exe	89
PID 4772 wrote to memory of 4768	4772	msedge.exe	89
PID 4772 wrote to memory of 1308	4772	msedge.exe	91
PID 4772 wrote to memory of 1308	4772	msedge.exe	91
PID 4772 wrote to memory of 1308	4772	msedge.exe	91
PID 4772 wrote to memory of 3828	4772	msedge.exe	92
PID 4772 wrote to memory of 3828	4772	msedge.exe	92
PID 4772 wrote to memory of 3828	4772	msedge.exe	92
PID 4772 wrote to memory of 1820	4772	msedge.exe	93
PID 4772 wrote to memory of 1820	4772	msedge.exe	93
PID 4772 wrote to memory of 1820	4772	msedge.exe	93
PID 4772 wrote to memory of 1640	4772	msedge.exe	94
PID 4772 wrote to memory of 1640	4772	msedge.exe	94
PID 4772 wrote to memory of 1640	4772	msedge.exe	94
PID 4772 wrote to memory of 2144	4772	msedge.exe	96
PID 4772 wrote to memory of 2144	4772	msedge.exe	96
PID 4772 wrote to memory of 2144	4772	msedge.exe	96
PID 4772 wrote to memory of 3008	4772	msedge.exe	98
PID 4772 wrote to memory of 1056	4772	msedge.exe	99
PID 4772 wrote to memory of 3008	4772	msedge.exe	98
PID 4772 wrote to memory of 1056	4772	msedge.exe	99
PID 4772 wrote to memory of 2592	4772	msedge.exe	101
PID 4772 wrote to memory of 3512	4772	msedge.exe	105
PID 4772 wrote to memory of 3512	4772	msedge.exe	105
PID 4772 wrote to memory of 3512	4772	msedge.exe	105
PID 4772 wrote to memory of 4064	4772	msedge.exe	106
PID 4772 wrote to memory of 4064	4772	msedge.exe	106
PID 4772 wrote to memory of 4280	4772	msedge.exe	107
PID 4772 wrote to memory of 4280	4772	msedge.exe	107
PID 4772 wrote to memory of 4280	4772	msedge.exe	107
PID 4772 wrote to memory of 2748	4772	msedge.exe	114
PID 4772 wrote to memory of 3664	4772	msedge.exe	115
PID 4772 wrote to memory of 1224	4772	msedge.exe	116
PID 4772 wrote to memory of 4228	4772	msedge.exe	122
PID 4772 wrote to memory of 4228	4772	msedge.exe	122
PID 4772 wrote to memory of 4228	4772	msedge.exe	122
PID 4772 wrote to memory of 2616	4772	msedge.exe	123
PID 4772 wrote to memory of 2616	4772	msedge.exe	123
PID 4772 wrote to memory of 652	4772	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://attachments.services.syncromsp.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x28c,0x7fff9d66c188,0x7fff9d66c194,0x7fff9d66c1a0
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,7253606361047743613,9661445124302316660,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,15089729854705796771,9345227918513774499,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,1313258964567894806,3064267897592182478,262144 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6931361386879881146,18335174009665559742,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,2696748039785868630,13096481817873917052,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14407617217430525792,7337438344682411672,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,8935744651511755954,9729037218255815603,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,3854601273526297977,17536285678949789428,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,2646962457068216909,17871053712399290185,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,10931270146763857482,17446303249579037850,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15201665775413245279,9480254021624972435,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15201665775413245279,9480254021624972435,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6200,i,12215935105086961984,9294981491153238983,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,12605325487210134136,18276286815684570759,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6812,i,13457147569393634423,6166446671295206755,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,8512583356015109101,12927600895121431384,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,13510269221329593502,13821316274623350261,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,2773447060488880368,14562395818160857733,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6936,i,12755647337182548989,10818578820298882123,2097152 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,9359793219246881355,1280063698043442257,524288 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6944,i,16337021531923195643,12836024679852065851,262144 --field-trial-handle=2412,i,4267830909952892464,16839275764942382567,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 603613ee3edfb2714be104a31101e3169f4a622bfb155f5a41a0cf2abd4ff054
MD5 c45b446b675294ebeb2cd7c9c1965957
SHA1 e56793d6ffff6c0e7e71e33923d6f8e0ff886782
SHA512 f1c685c3833c3d8a7ae0313b4e9fea43a7139debffa3ab98580bf18d0d9d06280630b0f92ecf49b850882ebcff92b8a7f34ed67f32caff9ad874207a3fcf1f71
SSDEEP 96:QxkANz40UN4mnBo4+5fa95ckTyIxL7FsXWAfpbu+QJRxU3l7:URz40UN3nu4+5I2Cz3KXnfGJsZ
TLSH
T1CDD10BB321855970FF9409F0A09C892C277545DFFE4B6B8225A4DA38E707BF262C0DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 59541709d055c36172713c9483ad5a39b69344eb5ba086e44dca5336ea6a3060
MD5 1445e2f65e82d7deed14d684042335db
SHA1 d5c84b33c64cbc34a01d485d8616cb8ab8c8f63d
SHA512 539dac39a7af4571f4a2b52899cabe43362254a84dd586020324a5ff44b8fa7fce2617f61e512092c83d7fda3b48431c36ce4a886c09f18ff98c9c03f5132f06
TLSH
T18661DCF2C3E6422DD91192F09914AF1BCE1C0552436C3C5989E8BF57A3F2471E121B9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f2a6cf11ae5907ffae72067a8a38d4e1ffd43d4e4c78834e8097802238193140
MD5 fce069bc308087165cc43869a3c0d566
SHA1 5b593bba68112ed7f41e9f6b9995438bebd7d4b7
SHA512 b58ad2028faef0c88e25ec899f23241088feda9f807d19004d786f391a1c21501813bdf5d2f9a31f929d4f5fa68a746a897c58f96c76767b46e8f7bf404e8ae7
SSDEEP 192:sxZ+RYyM/jK1Ml8MMO2/fRs46VMIYaWf1pmnulHW6+WNdppFqrg/Yvahs+4IgrJ:sxZ+a0O2/fRs43bTNHbLd/+39
TLSH
T1F452D851AA786A77CCDBD209F945BB93D6F54472A2940D44AAFCC91C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d390975585344d63bf46b046ce4020aa15ec0269827803c9044faadc76927381
MD5 38f8708c22ad7fb16ae60dd75299c2de
SHA1 6f9eca77abee185862f195495cda9a6eda5c9bad
SHA512 5dcc2baf69e7b5610532c556a7f0d30503b5dc6b12ac82d9800bd98206d89644a982a4baf8ced044042da7ab9913535b15e551d0db0943f86288c07f84677b3c
SSDEEP 384:sxZsaqZ2/fRsyIR/r9aEbTZHbZdlp/i33:sUlZ2/fLIR/r0KHbjin
TLSH
T1D972194269741A7BCCEBD209F801BF92E6F4506796844E44ABFCCA1C04E7BED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3d4a1f06f88aeb62bfa9a2a026adbbb62498f2f6b6010bb8b328223b1284539f
MD5 3301792491e850993d3da4dd75b956c4
SHA1 d0cd5745507f4eb4946a468af14f0be3096d6adf
SHA512 ff2277b1916391018a7e0bb67d16a1655d48bfe714a95367e9b19a3489718aff1f9286f0dfac6ad282d4492caf65b7fa081f4701d15f2cbc62a84b5b0565e901
SSDEEP 192:sxZsRYyM/jK1Ml8MMO2/fRs16VMhR/rWbmaVdYaWf1pmbulHd36+WNdppFqrg/Y7:sxZsa0O2/fRs1ZR/r9aEbThHyLd/+3R
TLSH
T1DB6208057A745A7BCCDBD209F941BBA3E6F84422D6940E44A6FCC91C04E7BED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 caee23e4e987e20cf12be5f6c0c35f338ea399ce42ed7f3661f2244ae8d6d390
MD5 bc8c95b7eb80814335bff4990a2160f7
SHA1 b5127745a5360ec427cbb617f268e4bf774a905b
SHA512 4d1d836789a06741f4e59e49241d790c07a0dca5cec00fba213c4d8a0e78e5c5f8f9ce04b99d821f4186f06a5d8ca818a572688bb6828ef98467fcb459af46be
SSDEEP 192:sxZsRYyM/jK1Ml8MW2/fRsy6VlR/rWbmaVdYaWf1pmbMBHW6+WNCbppFqrgAtK/Y:sxZsau2/fRsyIR/r9aEbTfBHbGdl/m33
TLSH
T14972090269745E7BCCE7D209F941BB93E6F8506396944D44AAFCCA1C04E7BED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4bcd51012eddf451893bf03322aea0277f2fd4cb615b0e5803954ae420dac655
MD5 e6f42a46c93a386cdcc68a46723c522b
SHA1 138e770ff0fccaca0194aaee4a27f73192303bbe
SHA512 b2a351d1292a1a57e184479b51eb58db46469952bfba18fed5399eb03a5b73ad7d1d81b1787519f6b8beacb45bec01e1a06ffe95eec9d8375075d606f20f786e
SSDEEP 768:NdseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppkroob:NdseJ3xWvhfynu1jaVcL88pvk
TLSH
T119D20B2B280CCB7E4F844E5CEC266F966EE801CB67984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 8ba2eb21587bee0915d3164a50498953b213d959b1b86e3a74c63db1891d52ae
MD5 d74d143cdca3885959cc945f618acb4c
SHA1 7ef32f995cce61229e797bd73f263e260f638bf5
SHA512 f596ec601ce231436c2691b5dcf4204f3d3dd89c35ab15b3d9a54e30715372c0061354e78ac1a35ef036716f5d4b977ccb97763ee9cd240ad33571a1886f5ca2
TLSH
T128A002149E921511C08227B02D9B35A52310C9200311130755D29046DD729456E4D01C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 5f3b24f576c88a050580caea69b752be17a37e73e1e34badff595d16e3482791
MD5 0b96b1d35769e86c10062cf655bf6aed
SHA1 631da935fbf8efbfea2f5d98d3318a9f3067f6cf
SHA512 7260914ed9a23be318aa18dc9780ddc06542b0ec27d8a42ba69e1265e226b0ba62923097190737b36980d231279b86059d68e9c6ae8a0ac11814142cc816154c
TLSH
T197A0021603811046CA7211F11A5622416300CE203200D75B41E11068DC724C44D4105C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 42df785fe9d37a0652d2e0ec2113fde00d5b01391b8883a61766ad6a5db932a0
MD5 d36f8597ce94161c873b5d5e40d14a83
SHA1 8e6e15e42f1fd55568bdaf697b60d51568f988bc
SHA512 5ccf78bd7135b0226f9fb258f17397f4714fc20beaca49440a77bfd362102cd409a6b75ad9018c7aee9492d88009f5588375493784917ef124139aadffd94ae8
TLSH
T1C421485E8E91555FD5A84576157754E033F0CDDC1B1162631C3C36391D257992D0B1C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 5473cfaf14149c54fc1ddfc2cc4a21d228c08052db662d9f9a3d78f2d4030158
MD5 8eb9ddafafd8186430bae8b6e757f576
SHA1 dfeec305c60584d8cbb27a8983bf193b6dbdf4e6
SHA512 9f29e69830a226366387251103ad89ef89a5e28ea799e798afc8c7eed3d76b9d754bc7ad75b5a13344b1a57de128b3ba7b4ad2142df0aeaca9c3bda535111018
TLSH
T11851E74E4E074F6FDDA8127114B90491337456CC13781A0BA6FEC138FC87B182C99FA5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5889ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5889ec.TMP
Size 1KB
SHA256 3055dd639b4f258dcb44985c468d118145ff6d89bf1187847034bee0ddc7614f
MD5 b333f005d2ca3c15133baca9476a984f
SHA1 64e7900d2c8b25ce040529e892346102b7a93203
SHA512 5d1ec58534f965ab3d4195107a3c83a954fff34404e6ccad5b695b372c0cc8bc124be49a94dd76965dd2b3838e034c141f5ab90ea9c3f821d66dd0fab498431d
TLSH
T15A212FDA4A925A0FE9D495BA0543A8F83370C9006322B393A97D267E5C34B9D5A4B1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b203ee00ab04a418f2a1559eb515c5f41271e7d6aa9e119537fce43026fb9371
MD5 9c4a10f041775eea8e502a205bd3f975
SHA1 9cd24fa88f5e7f29657692a94028517b078bd167
SHA512 862647a7292a8615110497ba834aa07906d665d572b71811cda066e31c501dccdbf1a9683f2d0204fbebaac171f998dd1d2570449afe44cc4336736230548855
TLSH
T19CE0C0B72DD32810BEAFC3D120308490060A749CE901FC0E992BF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 55519f121129ade7b645db8de8fea26b6de639fe8181313918636fd5b7e064a1
MD5 dfd957dd55da90857e6a9b888ebcc7ab
SHA1 aa4ed77ec6388639504cf6125b0162468bb4adbb
SHA512 78ba05561c2aa20e8e54fa31d5ef3f3ac363624ebef492cd6180735183606b8f16911dd03156f803559a49c4043c8c5e143137aa7cfb139969922680fe3e6433
TLSH
T136A0021289DBD0A9E410067011669A5073B56CDD05063301C4D8E2A9CED52A151C2203
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e097.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e097.TMP
Size 48B
SHA256 1df9a782db3afcbf5f424883b32c26a3c167143751bb300b87f581973a61088b
MD5 1a4f53aac64782be0937e4ece784a6b3
SHA1 3d9275464408b77e6d651866f1dcabb74bebec1b
SHA512 a87fcc8a9b909ca2738d7b57ce8790ce050bed6b60027c7ae2292dc5290dae58f41911a3f96822a9e0698827ce46e6c774a21d033bb23ff22d0b3bec94c04bd6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c37aaabbd3554496bcf001ab093824784ee48a2a1b51696c726e4b9ffac5da08
MD5 ed6a5b9d2ba612313f1422a5f96d0747
SHA1 669c886ad215b2b82abb575ff016d50d706fda66
SHA512 3265f570050046d5c8b5a881a4b8e6aaf1151e0b5913b20d56b71e2cfd5ea6a28df8357c72447a14c4e7fc5e0f26da1107373f5982d0ce144d64eeb1449bd6a7
SSDEEP 48:KYHIhKggkXy93I5KIYcPyBGInKr6YzyVyHoMy4YxlsVsIiExKX4PSxTqhwtEU5o/:KYH+KggmG3GKIY+iGEKr6+2fuKoAM
TLSH
T175C12547313B061329BD2489B39196364F4232BB3058A9BFBFB900665D6BE211DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

937b78b9-654b-41c4-9b8b-bad1d74af005.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\937b78b9-654b-41c4-9b8b-bad1d74af005.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 97c3666911f465a962b3edf48d2d3973d833432912e6998f055d16f90c6bd35e
MD5 7ac06f24a8bff368c5644cde5f04a775
SHA1 311d43f96273d36b25a418e62a11ad2383444bc7
SHA512 df6886c2d39b0c2346e2605c4f3ecede7cd20cd79e975e87b5c577feffd925776dd67b41118513e4fa92330c2f49e726577d73c1d76fdc7b4a496de6854d0632
SSDEEP 384:qiFiZcIJsNO8TUNTUlIliTW1ztm7xMwR2edJBXs:hFQJnwg3u3R7HBXs
TLSH
T177825C735CA8997FADF7AA85F58A32138EF48067D6C4AA90E7DC9E1D009719C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a38e7e93c34b471cc9cb9e1408a24ef46d291cf9e869b9b2e64ed31b627ab2b7
MD5 dc5f8842fb27cd909ec511316b660634
SHA1 cd9919fd684f283140acca5a2c5b1411454151a3
SHA512 8ad117b8b1ffd5388407e3e2b074e3c67925c2c2ae62f5dc2a4e13dd1f64925aea4c7f739f8b015a7835f966f535c00aa61b598cccdaf5fdf6e049ba5504df96
SSDEEP 192:uMm+xasuheOwQxMGsN+nTXG1ztNXM7FzeQmiU19MR8BMTCz+FdLlf7a8z1rqSXs:0ZcIhsN+nTW1ztm7xacR2edVBXs
TLSH
T1AC626D716CB85D7B69E7B181F48A32035EF4C027E6C85B90E6ECAF1D01D7668131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d9ffcf119ee579a414959afb381d37c3d6cbf93ccd8c1c362f4c03f75eac4229
MD5 2320d6e931a9bf3363714db9cd4d338f
SHA1 c030c87e1d6def7e5360f1d6cd690776f7e90b71
SHA512 359fbfef63dc29089aa45377592a8ea215c963719fbb17483a298dd6c5aa7aa1c3a3ebebf3910b55af82e3d4ec919f593e562a56dacb2a09467bfb307e2e182d
SSDEEP 192:uim+xasuheOwQxMGsN+iTXG1ztNXM7FzesmiU1nMR8BMTCz+FdLlf7a8z1rqSXs:6ZcIhsN+iTW1ztm7xM+R2edVBXs
TLSH
T1FF727D716CB86D7B69E7B185F48A32035EF4C02BE6C85F90E6ECAF1D01D7668131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02a32f609af30f0acac20b85935e4d577790cd7ecb188e72ab85f85c996f1495
MD5 8afd843eb1bef63d6d50857edc408f54
SHA1 8ae42d504b0db02423452d19d27d73fb3fbb1826
SHA512 7bd4a0e0fd8104bc4121b8f574efc361760af0b1b24d180863bce8ad14d46b38ff9578f84fac0cea973ad6ac3d41e8b2f9c4d428546f137f41f463882e4193e3
SSDEEP 192:lONZ6vMtPQmiUy4ZThTCz+FdLv847ZfU/u:lONZ6UtRtTNdTlU/u
TLSH
T112020935ACB86C6BEAA3AD45F48A37175FF4216FA5D05B50EAE82F1C00D764C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b716df662ce3b449c4e03fdd36b2dc23c5dfc591fee744d18697b3e66732ad19
MD5 bd18a175a36f9cb668080daa84613324
SHA1 e5382feda7d7fce34321c2015adbf22ae473681f
SHA512 1ab451b674c1ac8fd8535a23ba3956363cf056a4fcb6e1bd81bcf926a173abf6f54b5915627d83b5dfa3b2f43b9df815dbc5e94aa798aec396867fc454063043
SSDEEP 192:TONH6vM1PQmiUyLZAhTCz+FdLlf7n80IrqSU/u:TONH6U1R8ANd+BU/u
TLSH
T115120A71ACA8AC6B5D93B585F48A32075EA4916BEAC46F90E6DC2F1C01DB66C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8ff9fd20b51c15736359ab9fe3ed79b773bad07d6b101e50386135df2fb718b
MD5 47e82fec4676b1d341d9c3895804209a
SHA1 38e011a500caa3fa9544822a20af46ede5291f7d
SHA512 10cc64a6dc6d7b4e5c268be343ec0cdf4fce6ea7ba82bc775d4fbe48b5f24ccd3c670abdf7663abb7b70d0c79b40014096a417b523e446efcd9bd46112fcbaa6
TLSH
T1B0E00201920400B9C52C0331014716109AD1841011B10255653011690CA33102931F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0ad701d99d3729d39aaac5a9166714b1a789c8805c1caa55701440cfabc304cb
MD5 78803a75ddc340701aff8ccbe4d3c8c9
SHA1 22f8f2c352b5dfa4724b08a2cdfca1ce5623c6e2
SHA512 e2419310cd6ded24ea095c37e44ad4987666943d37eac300aeb1b9034e7ea8a4f89c9447fd062509ebcfcd7d7c35e072f08c9c30fa9dc636bde284271fabc1a2
TLSH
T12EE00201970400B9C52C033101871F10AFE1C41011B103576770117D0CF33103D31F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe590110.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590110.TMP
Size 392B
SHA256 136ce3c7c388c45fff5ee1b8cb6baaa78e4d7838e7110ade8db752dd860d4971
MD5 8d4358e81595cfa8c7fa5467905e9231
SHA1 45a8cf6be4aed0fa02825c8fa1dfcc9fe11d799c
SHA512 ed5d53b6987217eda77ef2877aec5d74c547cc256e26f050f8cccd116b21b000e57e586b226aef3141e08288272e4b1dccf9cb94843217e06fca651c90735744
MD5 SHA1 SHA512

Submit Download

d141be14-49dd-4f4e-a337-95b8a54dad2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d141be14-49dd-4f4e-a337-95b8a54dad2e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5926f4f81b5d1eaa95f086ee5ebadcead1632e33f9879ea370d4e02012da9703
MD5 c041899e0a7b838de31b8e2d78a3d1a0
SHA1 b81a7071593aa6c922c5d8595208385aa630fc90
SHA512 f894c6acc376b19894e9b13cb8547b8993d3bf93326410f3e8f9bbc4ff6c3fb92f724aaa429ef3333280c35e449ec00226604f31d20886f2ab9b59d774b40208
TLSH
T1EA41286CB6FA1148F3B76E5AAFF6A96D447FB8372F06D49D10010E4E0662A41C4B1B37
MD5 SHA1 SHA512 TLSH

Submit Download