hxxp://www[.]google[.]com

Analysis

user interaction
yes
max time kernel
124s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.google.com
Sample260916-rykvcsbd28

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340429762525195"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{091D1F78-98D5-41FA-88C6-1EF05721E78E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3504	4716	msedge.exe	87
PID 4716 wrote to memory of 5020	4716	msedge.exe	88
PID 4716 wrote to memory of 2688	4716	msedge.exe	89
PID 4716 wrote to memory of 2688	4716	msedge.exe	89
PID 4716 wrote to memory of 2688	4716	msedge.exe	89
PID 4716 wrote to memory of 4572	4716	msedge.exe	90
PID 4716 wrote to memory of 4572	4716	msedge.exe	90
PID 4716 wrote to memory of 4148	4716	msedge.exe	91
PID 4716 wrote to memory of 4148	4716	msedge.exe	91
PID 4716 wrote to memory of 4148	4716	msedge.exe	91
PID 4716 wrote to memory of 2392	4716	msedge.exe	92
PID 4716 wrote to memory of 2392	4716	msedge.exe	92
PID 4716 wrote to memory of 2392	4716	msedge.exe	92
PID 4716 wrote to memory of 2776	4716	msedge.exe	94
PID 4716 wrote to memory of 4696	4716	msedge.exe	95
PID 4716 wrote to memory of 2776	4716	msedge.exe	94
PID 4716 wrote to memory of 2776	4716	msedge.exe	94
PID 4716 wrote to memory of 4696	4716	msedge.exe	95
PID 4716 wrote to memory of 4696	4716	msedge.exe	95
PID 4716 wrote to memory of 3300	4716	msedge.exe	98
PID 4716 wrote to memory of 3300	4716	msedge.exe	98
PID 4716 wrote to memory of 3300	4716	msedge.exe	98
PID 4716 wrote to memory of 4808	4716	msedge.exe	100
PID 4716 wrote to memory of 4808	4716	msedge.exe	100
PID 4716 wrote to memory of 3144	4716	msedge.exe	101
PID 4716 wrote to memory of 3144	4716	msedge.exe	101
PID 4716 wrote to memory of 1828	4716	msedge.exe	104
PID 4716 wrote to memory of 2760	4716	msedge.exe	109
PID 4716 wrote to memory of 3956	4716	msedge.exe	110
PID 4716 wrote to memory of 3284	4716	msedge.exe	111
PID 4716 wrote to memory of 3108	4716	msedge.exe	112
PID 4716 wrote to memory of 3108	4716	msedge.exe	112
PID 4716 wrote to memory of 2764	4716	msedge.exe	113
PID 4716 wrote to memory of 2764	4716	msedge.exe	113
PID 4716 wrote to memory of 2764	4716	msedge.exe	113
PID 4716 wrote to memory of 2680	4716	msedge.exe	114
PID 4716 wrote to memory of 2680	4716	msedge.exe	114
PID 4716 wrote to memory of 2680	4716	msedge.exe	114
PID 4716 wrote to memory of 4620	4716	msedge.exe	115
PID 4716 wrote to memory of 4620	4716	msedge.exe	115
PID 4716 wrote to memory of 4788	4716	msedge.exe	117
PID 4716 wrote to memory of 4788	4716	msedge.exe	117
PID 4716 wrote to memory of 1492	4716	msedge.exe	118
PID 4716 wrote to memory of 1492	4716	msedge.exe	118
PID 4716 wrote to memory of 1492	4716	msedge.exe	118
PID 4716 wrote to memory of 2496	4716	msedge.exe	119
PID 4716 wrote to memory of 2496	4716	msedge.exe	119
PID 4716 wrote to memory of 2496	4716	msedge.exe	119
PID 4716 wrote to memory of 516	4716	msedge.exe	120
PID 4716 wrote to memory of 516	4716	msedge.exe	120
PID 4716 wrote to memory of 1500	4716	msedge.exe	121
PID 4716 wrote to memory of 1500	4716	msedge.exe	121
PID 4716 wrote to memory of 3004	4716	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.google.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff93291c188,0x7ff93291c194,0x7ff93291c1a0
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12555750023312194127,8944324998361039882,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5006567479248111105,8860571203085367229,262144 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,8680705990711471466,6848765075487623429,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15471592642729742580,3757172587464412634,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,10544271166208170084,10475352263450568464,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5215863450374816259,5082621367533649591,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17942678458686610661,15510827297695129874,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,17805964468353516207,8589814077506777279,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,10345496032808905410,1942574564291181303,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14222255768117322856,3957681466287443064,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,7077836031432179096,17971024608076136374,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,7077836031432179096,17971024608076136374,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,6943535543847444560,10874816358953208078,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,11597495727932386589,15429466836721814454,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,2949311434657208166,941201170086063339,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,7386390914610114234,10842911033025371195,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5324,i,1316207710105954027,16010138407526417400,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5552,i,12323432454856717913,14614428413592081845,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,5441853136136857955,14822922269202674466,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,5925976105346481970,6098107713175294336,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6788,i,16987430397790590678,14018494941973155074,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6960,i,15316784416441655870,13577940501321167186,2097152 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,9498229842725758835,7564864229841215913,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,4552974081550020955,8417866972352122153,524288 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7692,i,493603278646262670,9251056356288496507,262144 --field-trial-handle=2220,i,14460660514759322097,12765416464532619719,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9d80ccf30f787625c6edc30c02081c6ddb4b29cd2d17a64fad8cf1a587109361
MD5 fa5f026462ed0f8e5f40a032e278b006
SHA1 a3b539334f6c3f4005d3db163dfe25b78345928e
SHA512 ae5f0a6df56aa5bfe386c34627cc39bc785a00a7024539375be92c5e81af97cbc2f00d32add2e9833a279707a50c4d9352b6e7f34f334026882403418eb787c9
TLSH
T1F17186B9A960E2B8FFA84479D0DA14DF3D325D59B447AED30EB4E46ACCB630881F8104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1215d794cb36f8aec0c1efef7ae73a9d0ccea2160bf3697259e47b98512d060e
MD5 0458221f2a6e9bcbf17f5cc9d0a54daa
SHA1 10c1fd2915db5354c6072d39913ec131ae60fff2
SHA512 7cea6b2e5ebfc5fdeed7732a71565c34f15b3b8c26302bfaf703c76e7959f7da1b73ee7e1141d932f9ab4fb0366068337d221e77706a164039f7103d67fa1e85
SSDEEP 48:/tqn68rtzNKnlc/rLK94cKZOnb2KGBVc88IHAoT61kT25K5RyC9O4an4mpMnivYg:8n95zZDLIqI7IleOepMiA6V2iSV8SjQ
TLSH
T118B1A9E5B462A2A8FF597475C4DA1ECF3A36083DBC93AEC31D66E576897B34440F4404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58df01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58df01.TMP
Size 3KB
SHA256 cad0318612c2ddf7f476b2a73e19ec5a02d65df4c69892d34ddd9c5bbd6cf830
MD5 4400f3f3856ee2ece5589ed4bf3dc02a
SHA1 3b074bd4927f587567fd3d4eda3773916e56de40
SHA512 f7d282dcc42038f0711061c9e2f4570ac14dc77355c6304d8d9b5f7751312e7c2154e69c979ee977ff23e8fb76555046d0ecc29005521cf8cfe93ebc4834bdae
TLSH
T1B0618479AA60E2B8FFA84479D4DA14CF39365D95B447BEC30EB8E87ACC7630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d53148f3854d2f822bf07cecfc0fb457793976287f0a161c32056d90e2b1b517
MD5 b53fb92aee12893f56c0d56f9a9ae9f4
SHA1 88908c7988fc7e006de0121fbd4d1de4a6cbae02
SHA512 79d32647b9cda2424ea6351aeb6178821659e40dc94ab611663f716d134c10ed313de40202842eafc5041284398b9e16f60936c63055943d9d8d3bd4c4799c41
SSDEEP 96:DwO6oZoWnm39rz0u0j9E8qUwj3WiqEcvu8x:DL6oZoWnm39rQuS9E8qUi3Wiq9vvx
TLSH
T152A18AF7C7D9822EC95216F49B256F1FCE1D0924831C3C26C4D4AE6BE3E2471E1156AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 de8df5427a6baf073a1ecdb9df426466c6470e2903c92b25730748c7608ea434
MD5 ef741e84ffae519c8a948cf5311c9c66
SHA1 357fc27567a4f959808d53adfc7096a6a3ed109b
SHA512 0a1b812a8e4f71955b7185d5caa11c2c406c66c2ed2ddee1fac640c68347a1f015bbb53e9d4fce1c8baad37b648f176ba4bccac31907d09b8f3aff047407b4da
TLSH
T189D02233126430B6E6AE3E85A27AAC8FE72B00604D03DFD870D098A955354BD650B181
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59450e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59450e.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 431de01f34eb66a58cde1d38c71e8ac8296ee4e5ae0970a9b5174c0315f8750a
MD5 cd4f59a6d2d52bf2dd8731cfb2704d64
SHA1 43d99c7a12254d7cfbb5e74e73cb07a5f74f85cb
SHA512 fb898523a82e29e2061eca69cbf880ceaa05549697c84927c53b8cf56b041148f77acf1dd6e087bb7682c3564a08dbe3051de557e226986be905b4f791f93d8e
SSDEEP 192:sxZKR2Wv/fcswWUdIdpq7iHW6+WNrPzL9/YgRgMdRYIgrJ:sxZKTv/fcswbe/HbrP9/3gX9
TLSH
T13F22B8527E34A97B8CC6D20DBB15BF13E6F95032A1951E48EAFC861C05E6ADD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d23294bab86ed9831f01105221db7543518dc18e14cfab11e04211e2d447605b
MD5 7afcb847772c0d5091733978f200e7e3
SHA1 666c0c1b09b0fc1f6de1b36330303476a0ea71e2
SHA512 eff70fc25682f73ae9b6f9139e76717397556838423c8cf446e2989770081f6b621c10a59e0794c65e0d835259e8515c245ba3221bc98a10ba3dfd9a9f05fda9
SSDEEP 192:sxZKR2ucBWv/fcswWn0dqdp9x1fYiHW6+WNeCt9WyZXYg1dRYIg5UMd8mkysw8t:sxZKPmWv/fcswTMlHbVJX4Fd8mkVt
TLSH
T19752D7527A24D9778CCAD51DBE34BF12E7F5102299920E9CAAFCC61C05EB6ED1207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5afcf58764568540616373ee708f34c92cc004ee16e54ad47a2a484c21f1d8ec
MD5 675832d50e395308c2f0aed8a262eab1
SHA1 61ad12106f7bf59be8b307349c073cb69097651c
SHA512 ba6b5471d21bf7425801f8dbcc6c5999381f2eab159da85fb5114d3ec2d030dc8e74952a49cb4a2c6d8e365f65df3146f70dd5814ba329e606ed3adbed6d1855
SSDEEP 192:sxZKR2fcBWv/fcswWn02qdp9x1fYiHW6+WNe6lCHt9WyZXYgJdRYIg5UMd8mkysp:sxZKumWv/fcswT3lHbw7JXwFd8mkVt
TLSH
T10852EA527A24DA778CC6D51DBE35BF12E7F5002299920E5CAAFCC61C05EB6ED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5c2470648a452c86377ec91a10af106895f07e24a58eaeabb288287d011f5de6
MD5 59b6dec121b44dea3fbafba279e8522a
SHA1 2720ad43eab8c79bf80dd0f594feb3d61951aed0
SHA512 390b431db79c35d6206053fcbad172ec2a9008feff5bf386384c6dc46053adede4f55e7fe32ba6094761ad799ad20239c583efe7eafedd89091438396b598d08
SSDEEP 192:sxZKR2Wv/fcswWn0dIdpq7iHW6+WNryZXYgjdRYIg5UJ:sxZKTv/fcswTe/Hb4XCS
TLSH
T11B22B7567E24A97B8CC7E20DBB15BF13E6F9503291951E48EAFC871C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b7c6581eb4f0bf654b879d048d42bc1af442c9db1ea68ac8af37b2c13008a34
MD5 9f3b4309b3497914fe1d2aed63885995
SHA1 2e62d04ec99951549a0ef73ccf291cb29bde2301
SHA512 9ff98b0c8b859bbc2d5dd716478b878de2cb9cce6cb18abe0e4baf4d29ff8860524ae1636afe57e3177bbe16ddbd6d6886946c0a88915bf11dda91ea8b1182d5
SSDEEP 192:sxZKR2ucBzv/fcswWn0dqdpTNmfiHW6+WNeCzA+yZXYgOdRYIg5UMd8mkysw8t:sxZKPmzv/fcswTMfHbSxX/Fd8mkVt
TLSH
T12B52D7567A24D9778CC6D51DBE35BF12E7F9002299920E8CAAFCC61C05EB6ED1207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fdc39435224bbbd9ae118473b51f2c8c2175ed4b73f2438e940f62ce1e86261b
MD5 6e742a14fd5ea6b6cb2d1afc3415c3b8
SHA1 efcc0e04772055df5a4e892ed86d1a73d54937b7
SHA512 6d790522ce1ea7d13f02be7948c14ba693979738d71524f186a86c59ce66d33d93b31fa958fc2cdaebb9242086b8b9b2e4da5e45c9a1eb491c780fe61a4831b5
SSDEEP 192:sxZKR2Wv/fcswWUdIdpq7iHW6+WNryZXYgqdRYIg5+J:sxZKTv/fcswbe/Hb4X/o
TLSH
T1F222B7567E34A97B8CCBD20DBB15BF13D6F9503291951E88EAFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0cadc1a9fa07daa7f60dd25c3fedbaf4ef8c49777fef27cbac3f99af07e4b72c
MD5 2292e2bba7d1242aab3cdb3078b9b2b0
SHA1 5355dcce1f2e1d684acd0073fb95342cb4b25615
SHA512 a117b591fe5c4a4e8868095b8512fc13c111c6d237187a964dccbb4e27189cf426c938803a1a71bf9eb4597ef190373e61e60f364814afd326eef9a7c31875ae
SSDEEP 192:sxZKR2ucBWv/fcswWn02qdp9x1fYiHW6+WNeCt9WyZXYg1dRYIg5UMd8mkysw8t:sxZKPmWv/fcswT3lHbVJX4Fd8mkVt
TLSH
T1D952D7527A24D9778CCAD51DBE34BF12E7F5102299920E9CAAFCC61C05EB6ED1207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f5f3491837e3d02bcf4114bec253b93cb6a0914da6256303429efd0700ce3c83
MD5 e4e4940a62c078194f9452d37fcaa14e
SHA1 c23813d1aee188f7f1202fa0633edf60e21c6d11
SHA512 846308aa62fe96635637e40a2e750b4483e9f51c2e9b0b92e5e9038623b839b9aa3ab7adc2fcac3828393ec444e3b05aa6e16ec18dfc69c69e8e036b239a5eef
SSDEEP 768:VWichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzeroawJ:VWichfPWvPZplu1jan+LKgz13J
TLSH
T147C2EA3B644CCB7E4FC01A9DDD1A6F9B7E9802C7A6588D4047FA984C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e9355c2ecabda69_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\4e9355c2ecabda69_0
Size 193KB
SHA256 108dea339c3a585d1ae5511840fd25150051450677d128211b826c265824bcb4
MD5 cacef11c347fd3dbdc310e93b40a2da2
SHA1 89d023bef4c13670cf513e9b50d5ffc9079be03a
SHA512 32f9fb1b7f6827a6fb9cd742a29136ad5bbb083d9cde022e24c6438fe5b89ad4506594584def20b7d2692e7f98aea6f80a431d51ff3443f8d105316fb6e08557
SSDEEP 1536:0oWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:trFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T1D8145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 71e11aa7e7bbf7bae8f65967a6de3f5662d66351f4479153d383616cc44afc00
MD5 59fbe8abe7e1d6c4adccfc74e9a97416
SHA1 e17f6ae737b4c3621bd29abed84493485fe5fe5a
SHA512 3bf72e90ce775cfc64fcae49fc43e4eb7e0a4582a26669146127b1e301c1cadd1cbc254f6e8507a2bdbe00ae61e129e888ddc78b997f1c1dca38600a3e5abaad
TLSH
T1A6A0022C52C50802DCC58370918B4AA023706E147955CF2B48D4EE59CCD63A7C34207A
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596085.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596085.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1dff3a428501166dda44fd401dced40dbd521475c35f015ddbc3bb447e80795
MD5 6b37a50ac42628f8492ae2d41e5d11b5
SHA1 3aeb453a158485ffd8562bb0c38184aafb831923
SHA512 37650cd5fdd23cd19af8af0e0dac6b4af5287003bda0652cf82df088cce7f3e71a19667529009e7bedaf389514141add369a05008382a9d953852f96a2b65984
SSDEEP 192:LJONc6DphmqQmiUyX6q8wGYX59ezVCNY+Yjkk7lr/U6:lONc6191RwGYX5E0S+YbhU6
TLSH
T15802F935E8786CBB8DE36E45B48B3A235FD8112BAA906F84D6E81E1D01D768C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 097de36112c17ba9d858ae5dbaf4f89de1a87ea0494eec952969c07b2d4b5d17
MD5 06377aad87c27f7be3cf706c98762c05
SHA1 19168705b0891a795e25612901458b8fdbb70b45
SHA512 390176dbfd11feffa344055fb3e733c5b89b0f44168eeaf4785117ec3a48856819c911d7a8c17a0ec8f395a5f0fbc2e3b7f773f2346aebaa9e82e9e05ea4d420
SSDEEP 384:EZcIdsN6akC57XUBGYX5E0S+YpDxO7O6R2FeoQ1oJ:idKJuGYu0SVp9O7TRHq
TLSH
T134828E71AC749C7B5DE7A192F44B3E039EF8912797C96B40D4EC6B2D01DE698130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ce502e4475091b7c1e91d869f6ccc17500bd519b3c41db22a55b1197a80302ef
MD5 80287bf9e10b427b60afd4fe965d6f0e
SHA1 e580115ff27f0d3baaa0ee5e6f75d48910aa145d
SHA512 8a9dbfbd3fca8c9d6bc23675fd109be99482dff4a5b70b80e0a945cb1c8a7ecb776d8d46c72667eec2685c74823729c0aae28e44789eec9df34f2ca24ae2a157
SSDEEP 384:HZcIdsN6nkC576UBGYX5E0S+YpDxO7O6R2FeoQ1oJ:vdX0uGYu0SVp9O7TRHq
TLSH
T1FE828E71A8749C7B4DE7A192B54B3E039EF8912797C96F40D4EC6B2E01DE698130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 609f4816023f08f64b896ac53b9b2c6ee0c641f9e05c0a264dc28a42744c84cc
MD5 287cad984a10fbef869b97a7d52c1dad
SHA1 53cdbcd2c5c94185ccd0c824a42276e780795584
SHA512 3577c97dd9f01c6e4c55b35be7b2a53bb3a170d12f8bbc2eb060550b62af8e1bf1674be3e01a360881613fa4edb52fd0708244e661eab783820f6223fb8a3bad
SSDEEP 384:yiFiZcIeTsNC8TUNTUlIlnkC5PHF2BGYX5E0S+YpDDO7O6R2FeoQ1oJ:5FQunwg/BFwGYu0SVpXO7TRHq
TLSH
T18BC22AF258E7887AD9AE5743A77E3D028EBCD057B5C59A40B3D85A1DCC8A1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87c0f784fe921d351ae745944871382a9cd815cc096c1371a170dcea743f33de
MD5 6c3899edb922d9c1dd5cc429e1cb1ce9
SHA1 fe5afd145db934802d71d25fa48c7e09b05245fd
SHA512 012b84b55f03b577e563eea7cafa2880965d540686dc8bc93b665ad603a7b1121139038d5582c7cf12ac5457a455f4f67082b469713ae24ed17e595ed1eb9587
SSDEEP 192:LJON76DphYqQmiUyf60wGYX59ezVCNY+YpDyeIkIIs/51U6:lON761j/0wGYX5E0S+YpDHOU6
TLSH
T1EF122B35E8B4AC7B4DD3A991F48B39135FA4522BEB857F90D5EC1A1C01DF29C130E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 76bee0456db6ead9370dd50bb99a7f9f27b15304baad2a88f45e2c8927006584
MD5 bdbe861e99106def498d04b21287c2df
SHA1 5ee2132fdb46b8d790183639b68b74d40a5df253
SHA512 d66dcbf9a277576979c5cdb17241ba7c11152d9c04419494ba3054eee34697ab40e599dcc42dcfb9ce4426bd8a01bf500e0248fe16d5a7ec62d6202e8e850a6b
SSDEEP 384:bsN6jkC5nXUBGYX5E0S+YpDsO7O6R2FeoQY:bzRuGYu0SVpoO7TRm
TLSH
T19C625B76B8749C7B4DE7A592B44B3A139EF4526797C92F80D5EC2F2D01CF288530AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4237a54e4bbf95ea6cc93152effe0303b70a23d3762a712415cae870ab17f766
MD5 325902c1ad1e625cc33c580063b8e1ba
SHA1 01a1712e44c2cf3d97ed24f43cc59b9a30031588
SHA512 5ffd8102dbf7cce3c3b5471dc2a360c1a9e8570c423ff2d0e8bc3de00f781e0feeaa79d1c0ba0f1fb503a430a64baa19aa1d6d91f389e3d568e193889eeb7fbb
TLSH
T179E00204D5000116C018073012836B102BB4840542520355632001683C213442910580
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 455b0083954831291180a8b6ea26628133037b79177c0dd436830882c52ba427
MD5 4c17b39d52a872a3787cf1cfa19be9fc
SHA1 d846ba5380a3c39d9c4cb441d8343a442a67ccad
SHA512 197de306c3921b2210368e88c581ea0c2c69f821225da3a96d3a94f6d7ba15f5e33da6807f428e7e296f3fa97934ec36893ce3066fb41af6fc04294b27714ba2
TLSH
T132E00205D7000177C01C073012C36B1037B5C51543D30357672001783C513441D30D80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59715e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59715e.TMP
Size 392B
SHA256 6fb5e1fc1a266abac38a8bdf4936eccab145f7a23b1f4258ec3b8dc51113b1eb
MD5 4934467fda668efd64d905f5ebdb2e09
SHA1 dd29476ac1e77cb750fa2ea7e0bc2d4d6d7505a9
SHA512 26d7fc2555acb892cbc734786793b2555b2c5795d4e4439560a27a7fc77d2464b5f3d7f02c4fcef2fe839c6239ac520aef497004f517ae6186a5a4ab8ce6ff71
MD5 SHA1 SHA512

Submit Download

039cbc1d-2a3d-4bf3-95ef-cf1bed94cf02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\039cbc1d-2a3d-4bf3-95ef-cf1bed94cf02.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8cee9ab8db50c8164aa044bb3c5c96ff2ab7a4d7b1ec00472b2117581e4dce8c
MD5 137059f0b4ce46b58c353f5801cef3b7
SHA1 82b5c8aa1b9e82aa21135dca73afe0248f46a018
SHA512 2307de25fc044c0c437d2df92aae2dbffdef5a78092da9336ac4648bde8922fc77fbe7e5550479ca968d6efa510a47241e429c3c6ffba03e9f6305a1a9f2e43e
TLSH
T125411A5CA6E91158B3B76F5AABF7686D487FB8372E06D09D20110E4F0A26B40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download