hxxps://u114853957[.]ct[.]eu[.]sendgrid[.]net/ls/click?upn=u001[.]mgWWpAmZu9wYoj5ZwxM-2BnXrqS94wqe4ycTDGuKAorS-2BrhjbEwX7krefAv3Tmk8KHzoC9P96Kc9XABHAKIhR-2FqjV2-2B9OYX-2B8HvTToFC4HcgTxlTbk0PkOACCpRFNB-2Fm4WCGwn_ZHebvqosO6XTNW9tsRZTPDLulQ72PoPL33mq1M-2FPEodABesTtkUm-2BMLqWDDiCmOlcm5cOYqnBDn1bO-2BC3AheWDmr5cK9GIfU06MDJG6DarK9n30Z8xriJONIKZOp6xzBBy1fdNxlk0njdR6yLxtS-2Fvqt0nqC07e8s7437bkbrL8Z9ikrub-2FovC4v5lnw5W9nFAmums9gnQgMh1jPwcLMpJKlBtMthmnomV4NpPToVzuZwCBITWElULPn2dqOiOM2XXWMOI-2FShhRSC8daXGWTuKKZLTwtiUTFT9wIEcXNdfTH-2F8LGKoWZsE6crf172IP5WnTZ4VJJpiQ-2Be8QZU1SLjGvlhjAFMyw1uMoVwOuz5nV7IQO9GqDbXpaj7-2BznC1Er3R61o3dvde2JS1710jWNt46K-2BooFbSuwiE-2BO9QJGkginRcP0zXLDvtfvELOD9gmEpEIxvGO7dyiij6T8roJFaBTMX05gt0Bswx3jG8IxnUEIjm9X-2FXGN26IDNwhjfcIQS9g8Ymt6zNj4UeLwXYMpXNQ2sZ9kIcSIPP5hAr9V-2FQkiHOabNMQUhO4A3TTw1fGZNZew8IwAxC5ThDkk9neoLF2jnI1DpWEGPkSbyP-2FPewYMeaFP1DByvueHuWXkgUsZZFkAabBKs85chREu0vGK5knnf-2FYSaXBqRw2BO-2F6KAyw-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/09/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u114853957.ct.eu.sendgrid.net/ls/click?upn=u001.mgWWpAmZu9wYoj5ZwxM-2BnXrqS94wqe4ycTDGuKAorS-2BrhjbEwX7krefAv3Tmk8KHzoC9P96Kc9XABHAKIhR-2FqjV2-2B9OYX-2B8HvTToFC4HcgTxlTbk0PkOACCpRFNB-2Fm4WCGwn_ZHebvqosO6XTNW9tsRZTPDLulQ72PoPL33mq1M-2FPEodABesTtkUm-2BMLqWDDiCmOlcm5cOYqnBDn1bO-2BC3AheWDmr5cK9GIfU06MDJG6DarK9n30Z8xriJONIKZOp6xzBBy1fdNxlk0njdR6yLxtS-2Fvqt0nqC07e8s7437bkbrL8Z9ikrub-2FovC4v5lnw5W9nFAmums9gnQgMh1jPwcLMpJKlBtMthmnomV4NpPToVzuZwCBITWElULPn2dqOiOM2XXWMOI-2FShhRSC8daXGWTuKKZLTwtiUTFT9wIEcXNdfTH-2F8LGKoWZsE6crf172IP5WnTZ4VJJpiQ-2Be8QZU1SLjGvlhjAFMyw1uMoVwOuz5nV7IQO9GqDbXpaj7-2BznC1Er3R61o3dvde2JS1710jWNt46K-2BooFbSuwiE-2BO9QJGkginRcP0zXLDvtfvELOD9gmEpEIxvGO7dyiij6T8roJFaBTMX05gt0Bswx3jG8IxnUEIjm9X-2FXGN26IDNwhjfcIQS9g8Ymt6zNj4UeLwXYMpXNQ2sZ9kIcSIPP5hAr9V-2FQkiHOabNMQUhO4A3TTw1fGZNZew8IwAxC5ThDkk9neoLF2jnI1DpWEGPkSbyP-2FPewYMeaFP1DByvueHuWXkgUsZZFkAabBKs85chREu0vGK5knnf-2FYSaXBqRw2BO-2F6KAyw-3D
Sample260917-252rkaea88

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134341602635940280"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{D9884811-4F52-4094-99E4-9A4E72882A44}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{E2F4562F-73C7-4B32-90D7-CCE1B81E9AE1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2600	4036	msedge.exe	87
PID 4036 wrote to memory of 1412	4036	msedge.exe	88
PID 4036 wrote to memory of 1540	4036	msedge.exe	89
PID 4036 wrote to memory of 1540	4036	msedge.exe	89
PID 4036 wrote to memory of 1540	4036	msedge.exe	89
PID 4036 wrote to memory of 3992	4036	msedge.exe	90
PID 4036 wrote to memory of 3992	4036	msedge.exe	90
PID 4036 wrote to memory of 2584	4036	msedge.exe	91
PID 4036 wrote to memory of 2584	4036	msedge.exe	91
PID 4036 wrote to memory of 2584	4036	msedge.exe	91
PID 4036 wrote to memory of 2096	4036	msedge.exe	92
PID 4036 wrote to memory of 2096	4036	msedge.exe	92
PID 4036 wrote to memory of 2096	4036	msedge.exe	92
PID 4036 wrote to memory of 1760	4036	msedge.exe	93
PID 4036 wrote to memory of 3312	4036	msedge.exe	94
PID 4036 wrote to memory of 1760	4036	msedge.exe	93
PID 4036 wrote to memory of 1760	4036	msedge.exe	93
PID 4036 wrote to memory of 3312	4036	msedge.exe	94
PID 4036 wrote to memory of 3312	4036	msedge.exe	94
PID 4036 wrote to memory of 1756	4036	msedge.exe	101
PID 4036 wrote to memory of 3108	4036	msedge.exe	102
PID 4036 wrote to memory of 1756	4036	msedge.exe	101
PID 4036 wrote to memory of 3108	4036	msedge.exe	102
PID 4036 wrote to memory of 4796	4036	msedge.exe	104
PID 4036 wrote to memory of 1620	4036	msedge.exe	108
PID 4036 wrote to memory of 1620	4036	msedge.exe	108
PID 4036 wrote to memory of 1620	4036	msedge.exe	108
PID 4036 wrote to memory of 4272	4036	msedge.exe	109
PID 4036 wrote to memory of 4272	4036	msedge.exe	109
PID 4036 wrote to memory of 4272	4036	msedge.exe	109
PID 4036 wrote to memory of 2188	4036	msedge.exe	110
PID 4036 wrote to memory of 664	4036	msedge.exe	111
PID 4036 wrote to memory of 664	4036	msedge.exe	111
PID 4036 wrote to memory of 4432	4036	msedge.exe	114
PID 4036 wrote to memory of 216	4036	msedge.exe	115
PID 4036 wrote to memory of 100	4036	msedge.exe	116
PID 4036 wrote to memory of 4808	4036	msedge.exe	118
PID 4036 wrote to memory of 4808	4036	msedge.exe	118
PID 4036 wrote to memory of 2032	4036	msedge.exe	119
PID 4036 wrote to memory of 2032	4036	msedge.exe	119
PID 4036 wrote to memory of 1528	4036	msedge.exe	120
PID 4036 wrote to memory of 1528	4036	msedge.exe	120
PID 4036 wrote to memory of 3820	4036	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u114853957.ct.eu.sendgrid.net/ls/click?upn=u001.mgWWpAmZu9wYoj5ZwxM-2BnXrqS94wqe4ycTDGuKAorS-2BrhjbEwX7krefAv3Tmk8KHzoC9P96Kc9XABHAKIhR-2FqjV2-2B9OYX-2B8HvTToFC4HcgTxlTbk0PkOACCpRFNB-2Fm4WCGwn_ZHebvqosO6XTNW9tsRZTPDLulQ72PoPL33mq1M-2FPEodABesTtkUm-2BMLqWDDiCmOlcm5cOYqnBDn1bO-2BC3AheWDmr5cK9GIfU06MDJG6DarK9n30Z8xriJONIKZOp6xzBBy1fdNxlk0njdR6yLxtS-2Fvqt0nqC07e8s7437bkbrL8Z9ikrub-2FovC4v5lnw5W9nFAmums9gnQgMh1jPwcLMpJKlBtMthmnomV4NpPToVzuZwCBITWElULPn2dqOiOM2XXWMOI-2FShhRSC8daXGWTuKKZLTwtiUTFT9wIEcXNdfTH-2F8LGKoWZsE6crf172IP5WnTZ4VJJpiQ-2Be8QZU1SLjGvlhjAFMyw1uMoVwOuz5nV7IQO9GqDbXpaj7-2BznC1Er3R61o3dvde2JS1710jWNt46K-2BooFbSuwiE-2BO9QJGkginRcP0zXLDvtfvELOD9gmEpEIxvGO7dyiij6T8roJFaBTMX05gt0Bswx3jG8IxnUEIjm9X-2FXGN26IDNwhjfcIQS9g8Ymt6zNj4UeLwXYMpXNQ2sZ9kIcSIPP5hAr9V-2FQkiHOabNMQUhO4A3TTw1fGZNZew8IwAxC5ThDkk9neoLF2jnI1DpWEGPkSbyP-2FPewYMeaFP1DByvueHuWXkgUsZZFkAabBKs85chREu0vGK5knnf-2FYSaXBqRw2BO-2F6KAyw-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85e47c188,0x7ff85e47c194,0x7ff85e47c1a0
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,508850215885326248,11257618704887700439,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5837135485409566167,1174955652823049929,262144 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,11734910739543934306,8232150463988582899,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,14338036296945733733,4218431748438846412,2097152 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11321220295260603870,5080994770236434538,2097152 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,10664037141576111422,6880585994431963432,2097152 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,12999809252727558444,7685690590619651273,2097152 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,4965279835625814267,1637572714213063157,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8349695934541037175,10752782898215054135,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5376609479879722252,4764821526422704667,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5376609479879722252,4764821526422704667,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6252,i,9632216716404823527,7621172254118615286,2097152 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,11917702920485961907,14936275499517009774,2097152 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,6427984721611501962,14512785382893136700,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,2315195774271489675,9638315403653548390,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,1649352473422208289,11333609861849987063,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,3925620423985394537,17390104414807397530,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,7235405899434900915,6745292918439910967,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,3131976663041228255,9627557054156850558,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,570826886723858524,14574608192445911854,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,12596427541481754428,18250508492570450381,524288 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,6887095006767737226,2937011063894169388,262144 --field-trial-handle=2016,i,6763295382877562331,11733969443952169027,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7261706d12b3aa9810e73843d80ae71fe6f03a752b2ad2eb38fd621c864a7360
MD5 8fbfe277e0ba689dfdc3edae59746858
SHA1 421d2b844a389cea9c9239b54fef0b42c5bbfca9
SHA512 2f545d5c3c7d0eb7895abe8a4d56d2d062e3878622f68a1ed3586e042e84123f06128c9aad06f96d58e612d1deca05453e51e1ac4ad78b7a71d32df7773325c2
TLSH
T141E07D8C15C8CA2EE3C06647416CCF0CD290374ED3CC6E1A974084ECB002844F3C2F91
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5c4a1672e3d771101f456d974b8f6edd54e6df2be648cbb45cc5a374d74b1a2e
MD5 41f38f7bc363c910566cd9b0590cfcf6
SHA1 f70cfc6b2926322b72ee3f345681b93733d663e4
SHA512 c3e30c7ec62b5d2d128e3640ade599a361bc5765e74166d821a721b6419fd43300f204303860c10451f6dbc3457c20c4bf5fd0a824656eaeac6c0075d5c69aa7
TLSH
T15C81A7845990A0B0FB94357C53D0994F3EB5AACC4ADF1F96A064CEB8BC4E3B8478346C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59357d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59357d.TMP
Size 2KB
SHA256 0ae85077451e4993c0fc2e6d9267d8ec386845da71bd2257bc8f74770234cc63
MD5 c1609d4083c4c3018f07d5e150b3a95f
SHA1 35125c0e48c73319e13aac3f58dd604e4c3423fc
SHA512 f114b4e02f26c39e7602355e2572c59fef443fada55673e0546036d2e3316172b7eb84acfdf1f3e1af98ef6e2ad3f3bd0d9788b2e18610414fa0979edcefa18b
TLSH
T15C51B8845A95E070F7A4797992E0168F3E36A9CC86DF2DD51168C4B9FC4E35D93C007C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4c33338afcf1892cf6ea5c9617799043ed539720d3baadd8a5792926a31d738d
MD5 f806a0f3d0ed34807bd1c4257f958e0e
SHA1 1ebec7d5c0ff3522df723b7485600020fe649b36
SHA512 845e5bff67fe5cde69d5d32c6e5eb0b24c141edb4791eb41043f8620077f981e054dc8c7ea65cd07f915dbc46eedbc5556ca3ad669850da4876d50c8de103818
TLSH
T1EB7199B783E5C23DCE1256F06A14AE1BCF590518432C396B86D0BF17DBE2571E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4445fd57ce0094538026767ade242e4837400151c246cdf79ed22a1d9b0e0c34
MD5 b49add302a85283705c75802b6869e87
SHA1 46c19af4c50a5399cdfbdf9aeab9482cb9ae870e
SHA512 584f726926f62e041dc073eb042e85aec4a372abb1f54b14024cc5cad5a9afdd0f977cb250023a1bb582614a730535222d1c65fd332e80b33971ea71d8dcd011
TLSH
T1557199B783E5C22DCE1256F06A14BE1BCF590518431C396B86D4BF17D7E2571E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0c4c3ecdd03dbc2750d4639179573e2ddc58c8c8627f1b9f130b0550aedb03e2
MD5 74d4ff43ecafb5bf2e8f6649ca1c54c1
SHA1 e626ec6b44fe949e557d76a9e9c65765fbf80612
SHA512 d31bb42325b3254694aaba494f7b00a0d7a55d15dc9daa94af26b0111a07dc7515b72c55cfb66121a3a8a35b36e71f5abb2980c478f0d2af2ad521bed4053952
SSDEEP 192:sxZERYWQ/fjsB2YIdpUdHW6+WNMyJ8/YapW2+IgrJ:sxZEFQ/fjsBsAHbk/I9
TLSH
T1DD22DA556E28657B8CC7E20DBE69BF13E6F9503291D41E48E6FC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2b1fb38c4c68e042c62dc1f4cd5bfceba2b61a8e798a82a2d5651b8b365ae5e5
MD5 62a3e399ffe2ceda13246c5b5a0b8114
SHA1 988a845e1b0fde29df3efc2063e69728f0d70afc
SHA512 0ce4ef4d1534424163c47d659fdae22ad38b49db22ee3b629d3e322f9a5c39ff49d44dcede7391d22e47709a566342d1a577f726a61cce14063547540a188afb
SSDEEP 192:sxZERYWQ/fjsZSYIdpmmvHW6+WNNeyJ8/YapB2+Ig5fJ:sxZEFQ/fjsZ47Hbg/pz
TLSH
T17632B9566A38697B8CC7D21DBA59BF13E6F9503251D01E48EAFC861C04E77DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b8e4640c5bd44fdfb64f9ad0b0ebb6500e3176395bc555b1098c5e40357dff69
MD5 0ee13e134e40e47aa10d85f22c2aa963
SHA1 ac68167844f80c78b512ceb42a5d52638c7b6ee3
SHA512 1fa209a6e62427bd0501247065d04e41297040ba31724db9961157809a2c864c2a56d745a46be5520b03f3ba70598434e0cac3f9486f008af3b5bcb5bff04320
SSDEEP 192:sxZERYWQ/fjsZSYIdpUmvHW6+WNNeyJ8/YapP2+Ig5fJ:sxZEFQ/fjsZ4hHbg/3z
TLSH
T13B32C9556E38697B8CC7E21DBA59BF13E6F9503291D01E48EAFC8A1C04E77DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b322ba2032fb12d1c0c8472e51515843105eb7d678693991f225644b6b440018
MD5 018b4b3000dff28401a7afc49aca58e1
SHA1 c9192879c7698ca3acc6c4a763b95cbc32328627
SHA512 0746bab46aa49170039cf4fba633fe60a5ed8b34d35cc561164553e5ecd9c5b4806e9ff11790a360b923703d6cd3ab20dbf399d59b1132edcdae26cb4186aab1
SSDEEP 192:sxZERYWQ/fjsRSYIdpUmvHW6+WNNeyJ8/YapW2+Ig51J:sxZEFQ/fjsR4hHbg/I9
TLSH
T10A22C7566E38697B8CC7D21DBA58BF13E6F9503291D01E48EAFC961C08E77DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f92560a4536987cb05f8c8ba0ec84a27f960ae6c22720eaf957195def822acdd
MD5 9ef8dc9c28a7b178f842b528af366d29
SHA1 bc5db3353059bb80a5a4a8cde154102bee7278a7
SHA512 77e74a21095c571c399f8638f15c179d523b805ab6e00dbf8bf37641feb14e8c04e87e8df608c4f0f5b52fc1dc9decb54e9c377d5980477c6576ccd9892a17de
SSDEEP 768:W2WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Nro4JfeemR6:W2WPcLKWvKeEeu1jaClLiF7m4JWemR6
TLSH
T13EC2FB3B644CCB7E4FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a9b0eb1c02adbe7c5889a352dda469ecd5cf4ab64835fb9102b650da5bab0f40
MD5 bd5c5853b7329fc6aa3785d390b345ad
SHA1 16e832a93d4594d5ae8350cbfd264980d242e708
SHA512 5f3ae849ebeaf829c155f8d980d7c15b88d1946d80a00ebd693dd6b7fd295aa2e054b34dfda4c143ded89924f74fe7f36aa9bf57956f61ee78d8b6261765f97f
SSDEEP 96:Kc0AKla+CaQKTSMr6KIIS6EwKRynbqfrxT:SDPeJnKbqfrxT
TLSH
T176B1B315717B535038BD294880B6971E524236B3365CE62FBFBD00B68E6EE484DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a02e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a02e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 706355185019843d23ec8f3abbae2241b4f0bb28ad9db8026d5b5c95818891fb
MD5 1e6c7571c4ea6a72ccd9e63799b17925
SHA1 c3dafe8aaada2e748e190da482dc667d534de494
SHA512 2b1fa25133ace53bd326b0ee5ee2bf86f57e9e0e5a1a1eb9dc51cb92a13745bfea0e42d4fd2484b4d7c972bfea19860b60f85a7acec03e57e3dd3b15d4beb4f7
SSDEEP 384:lZcIqsN3Fc/q1mLczIGmAs8PDX3i7sa+VYKfo5:dqoy2LlL3i7hgre
TLSH
T197827D72AD78AC7B5DE3E645F94B36139DB8806792C86B90D5DD6B1D00DE298030AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bb7fd3f336ef1e6924ecb98b266bcbb37fd5394ae11402ef833f2499eff5ea53
MD5 b6df97fd9694d8cdc716ec7bf391ea0e
SHA1 957b012200ab0f3b0d7050dd17dc21cff665b308
SHA512 8f76fac74b93dfbd3be0be52e66889ef1abfb1d0233e6434ac0acb94e32986b442fc2c620b247a932f50cf97516678df7afdadc4b32fad81744dc59ed1b19309
SSDEEP 384:1iFiZcIQUsNJ8TUNTUlIlMc/q1h8czIGmAs8PDXLQi7sa+VYKfo5:8FQjcwgMA2LlLLQi7hgre
TLSH
T19FC22AF259DB987AD9AE9747A77D2D039DBCC063B1846A50B3C85A0CCC9A1BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46df12df5400915735b1a69e532a76898642b2b310cfa6157bcde43d62105036
MD5 88d0d05514d8a684346367319702a2a4
SHA1 6ab2c84768dd3ff9065f1f63c0280a6aeec580e5
SHA512 6d5bba64edc09f07e2ff246be0942f6b73d2402dda4c85c2668c837a77897f65e633f4069639b2fb46fbef671f9f84830d13d72b90b79a3b370b09af16d2fdd6
SSDEEP 192:aONj6IE7QmiUy+vjTPuIGmAcjzor5RZSC7syeeU6:aONj6DtjPuIGmAs8RsBeU6
TLSH
T10B02FB35AC787C6B9FF3AD09B4873A23AEA4112BE5952F54DAD81B1D00D725C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c89843cd7893a02167ed58c93fac249412211338760f5c5c259abd20cbe7bc02
MD5 47490f7df32054207c7a2c39f7df5b40
SHA1 9eb0cb5915fd5d5f26c073eab2e7882bacc00f5e
SHA512 ba56afdc2061018b8004a2b45f78d6695b2ebde544b53f989073fbe24b27e12b90cc0b97cc796f9dce2e2ab57b8a4eabc51c0e016d1f87cb8aa5771db79575f5
SSDEEP 384:+ZcIqsN3Mc/q1hLczIGmAs8PDX3i7sa+VYKfo5:8qBP2LlL3i7hgre
TLSH
T19D827D72AD78AC7B5DE3E645F94A3613DDB8C06792C86F50D5DCAB0D00DE298030A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 344f7ef2181c4681f4ba7364465b463bd395e9fc29aff21444cdaeffc75a351f
MD5 46477aa7ee5ac6f9138bfe45d35097a4
SHA1 0d423147761dca92748ca71c94776ee82f50a8f6
SHA512 745d4ff658455796c19fc211f64e3a205e39791d44e32bdf55e2666c6a09ab862eab07655e70bd5f3a51ba26e37fd39ed77125e5245d5bfbe4e5bf2bfa224501
SSDEEP 192:aONi6IEUQmiUy5vjTMuIGmAcjzor5RZtDXT27H3/DU6:aONi6DkeMuIGmAs8PDXgH7U6
TLSH
T12C121B36ACB8FC6B5ED3A944F4473923ADA44127D7886F90D6DC2B1C01DF25C530A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9613ec3b-2e3f-4280-9034-02742d4f4bca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9613ec3b-2e3f-4280-9034-02742d4f4bca.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7165a54b7939a16e88001c3ca1bc82200a6fd64ec75b024ddfffc179ba894d0c
MD5 09640299b04df6b15fb7930c4de72ba4
SHA1 b26f99f85413b50f49406682e21506fe8a117773
SHA512 28d6c7c347de9c90e9b1d2049c419c50d15e13340d555feb1078d7d7b7ca9b53d0df2dffce4803f46d4ceb97f1f771c84a28c06b52072703462c7c15643854b6
TLSH
T13D410799B6F91148B3B76E1A9BF6B86D487EB9772F0BD45D00010D4E4A63E40C871737
MD5 SHA1 SHA512 TLSH

Submit Download