hxxps://docs[.]google[.]com/presentation/d/10juJeT8gR0WDFrGmGeiZycEiVULWQge0rnZ19N_kajw/edit?slide=id[.]g3fb6f5d3b96_1_0#slide=id[.]g3fb6f5d3b96_1_0

Analysis

user interaction
yes
max time kernel
900s
max time network
878s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/presentation/d/10juJeT8gR0WDFrGmGeiZycEiVULWQge0rnZ19N_kajw/edit?slide=id.g3fb6f5d3b96_1_0#slide=id.g3fb6f5d3b96_1_0
Sample260922-nnf7msdb94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345503604567152"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{471380F9-0066-4B4A-A5E4-9FAE2D1EDB35}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 432	3312	msedge.exe	86
PID 3312 wrote to memory of 1136	3312	msedge.exe	87
PID 3312 wrote to memory of 1492	3312	msedge.exe	88
PID 3312 wrote to memory of 1492	3312	msedge.exe	88
PID 3312 wrote to memory of 1492	3312	msedge.exe	88
PID 3312 wrote to memory of 844	3312	msedge.exe	90
PID 3312 wrote to memory of 844	3312	msedge.exe	90
PID 3312 wrote to memory of 4460	3312	msedge.exe	91
PID 3312 wrote to memory of 4460	3312	msedge.exe	91
PID 3312 wrote to memory of 4460	3312	msedge.exe	91
PID 3312 wrote to memory of 1944	3312	msedge.exe	92
PID 3312 wrote to memory of 1944	3312	msedge.exe	92
PID 3312 wrote to memory of 1944	3312	msedge.exe	92
PID 3312 wrote to memory of 1872	3312	msedge.exe	94
PID 3312 wrote to memory of 1872	3312	msedge.exe	94
PID 3312 wrote to memory of 1872	3312	msedge.exe	94
PID 3312 wrote to memory of 816	3312	msedge.exe	95
PID 3312 wrote to memory of 816	3312	msedge.exe	95
PID 3312 wrote to memory of 816	3312	msedge.exe	95
PID 3312 wrote to memory of 2572	3312	msedge.exe	98
PID 3312 wrote to memory of 2572	3312	msedge.exe	98
PID 3312 wrote to memory of 2620	3312	msedge.exe	99
PID 3312 wrote to memory of 2620	3312	msedge.exe	99
PID 3312 wrote to memory of 5016	3312	msedge.exe	105
PID 3312 wrote to memory of 4624	3312	msedge.exe	106
PID 3312 wrote to memory of 4624	3312	msedge.exe	106
PID 3312 wrote to memory of 4624	3312	msedge.exe	106
PID 3312 wrote to memory of 5016	3312	msedge.exe	116
PID 3312 wrote to memory of 4256	3312	msedge.exe	117
PID 3312 wrote to memory of 1704	3312	msedge.exe	118
PID 3312 wrote to memory of 2320	3312	msedge.exe	120
PID 3312 wrote to memory of 2320	3312	msedge.exe	120
PID 3312 wrote to memory of 1672	3312	msedge.exe	124
PID 3312 wrote to memory of 1672	3312	msedge.exe	124
PID 3312 wrote to memory of 2936	3312	msedge.exe	130
PID 3312 wrote to memory of 2936	3312	msedge.exe	130
PID 3312 wrote to memory of 1752	3312	msedge.exe	131
PID 3312 wrote to memory of 920	3312	msedge.exe	135
PID 3312 wrote to memory of 920	3312	msedge.exe	135
PID 3312 wrote to memory of 5108	3312	msedge.exe	136
PID 3312 wrote to memory of 5108	3312	msedge.exe	136
PID 3312 wrote to memory of 1568	3312	msedge.exe	137
PID 3312 wrote to memory of 1568	3312	msedge.exe	137
PID 3312 wrote to memory of 4336	3312	msedge.exe	138
PID 3312 wrote to memory of 4336	3312	msedge.exe	138
PID 3312 wrote to memory of 3208	3312	msedge.exe	139
PID 3312 wrote to memory of 3208	3312	msedge.exe	139
PID 3312 wrote to memory of 2276	3312	msedge.exe	150
PID 3312 wrote to memory of 2276	3312	msedge.exe	150

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/presentation/d/10juJeT8gR0WDFrGmGeiZycEiVULWQge0rnZ19N_kajw/edit?slide=id.g3fb6f5d3b96_1_0#slide=id.g3fb6f5d3b96_1_0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff90580c188,0x7ff90580c194,0x7ff90580c1a0
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14301776659191846628,14470192816206250493,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7228422881104987563,5530995026815619521,262144 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,14182080757651835931,12564016585172446010,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1130666885501054534,8443745978916286375,2097152 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,835222904911934377,11444409333269949885,2097152 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,16314619948562007295,5759971500911291624,2097152 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,10615545397102083656,13701115286577088537,2097152 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,12168301669857533280,10173121188249477382,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,13288930605083670953,13049732018191710584,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,386238385125976667,6489960401602600302,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,386238385125976667,6489960401602600302,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6456,i,8137557428425473076,8720617952590329967,2097152 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,15089791360851283123,10768599140698705402,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,18321794575916155108,17329751363778344529,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,12304752335619135427,4991714116507503331,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,1243443448614504638,8114944400479829587,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,17855852965985262920,15558329525421831601,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,15077168586591219166,9618502126495162022,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,352997766630827101,13039646543388382361,262144 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,2369120831451698185,11721874139894616148,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,9285258007548577893,8553342829962056748,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,17742140463598622519,11534870426084687577,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,14891332007811185671,5411931132694929954,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,7552402913998966209,7849496266802574256,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11472426773627989891,2984704413791932467,524288 --field-trial-handle=2284,i,5828848888523335008,13950030991947688647,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0b49a4562d3985453814a3e5fba1836237dcd334dd15c9b3947ec1c83843f938
MD5 c97b62d0622c6e44acbf013f40a3a0e6
SHA1 6842f980a28c222ee26e4b639c5c27f8d15b3ad5
SHA512 85ab8bca724cbe62afc2f76b2157adaf1a9340c8ca9b1c08de04871a15020b2635c28b6d83d56fa6d308ae6e27aa8e69793583ed48ae76cf23e8e52d7541dcdf
TLSH
T127E07DCC4EC8C3EEA348678B81FC774C8681371AE7CCAB4A17058C897181848F6C2AE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 146B
SHA256 70e203c28e3c23c1e4f1ae69409378675062240be85433bc4140fe8b399a21e0
MD5 3ad02bb438090111c62aaeba12742cc4
SHA1 0a5ff1b7ffa7a4074a36cccf688260e2ec573e26
SHA512 5c1d2c4f4a511db2dba78b2af5011430a4feba4620f8688163a22650cb7e30ac06e4a9753ca47d313cd6f44b9d24813aa2e11b923dfafcb8260d60d815ed59c0
TLSH
T115C02B4884C5D29FA319E8CF422C5B0CD680330F86C8A70F0304C48430C2884E79A956
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0ee758bf3754651f4fdff9d9f01dabe8ac933b3114d520c19e31a9f5e798cdc6
MD5 3680c7ff855251583641eb1869967fcf
SHA1 4a9a614c4a399b9f639f1e35559e21132f7c1145
SHA512 c7ee696907a046b65389f26e59b0510c4e03578b99419613310ba23472ef49ec8968589c39214375eb51b5da05e945c529d19d208de48fa6e4636917a2ea2b64
TLSH
T1CAE0788CC4C5C25DD30C648BD57C574C91903F4FD3CCAA057704C444B003844F6C5951
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 325B
SHA256 7cfe36b578fdc4e98109dd6adc8e4274c34325564c5f72b608c8098d24ff70d1
MD5 1c422b434c98acaade9026b91af2c1b9
SHA1 3dfa9f6da00760637cd9309088ca35f4d6623da8
SHA512 76d1026e38a38b026e3aba1685108386a787112e6d8a3961fda37b5e84b0029cf8bb6838a3c3c311ae619a9d9612a3ef12dc67b80e1c2c91f98431b43f1fa3cf
TLSH
T126E0268C46C8C2AEA318744B827C578CC2D53B1A92CCEA0B1700848C7101980B3D2AD1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 329be44662b5dc27d406b86930a45c3b505ff9f9301b14b1bef14b6789acc052
MD5 2d26c585cb2b41cdf8f64abafbafaa5b
SHA1 70a0fcd45a26e8cfa3e70918a361d7018aa8457b
SHA512 ee0548922d5007b741cc04c9c7a8c667edc1e03a81bfae5d47a39e16f4155c8ced2e5d7599564469db9b9d92cc741be7795ac0df9d396412623f819605b0b86f
TLSH
T1D4812DBA60729C9AFF586570DCC8124779BE848411CF5FD54BAAC4386C833BB5ADC05C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58edd6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58edd6.TMP
Size 3KB
SHA256 7a1a042f5549b2700bac119977898ff5be2195ad2c914821d023572d382d4a19
MD5 7c9848fb25a592585e4822c157dd4b7b
SHA1 e77babbf3afc8f737377a7cc1d148dc37991161a
SHA512 8f9b4d1e39a2e04fd1695e1d625476a9171969dbbb4f5330b09b8d97c62b3027fe5cd78d4d14281a14a7a35eb74e48fee434368e9f61aa48021f7d27ca6da01d
TLSH
T16C613FBA21729C96FF994570DDC9124BB9BC948015DF5FD65FA6C0389C0233B5ADC08C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1e9fb9e35c08276b62db30945623afbcba21a8c5af1d2a28cf2eaf50c113db14
MD5 6c38541a6950ded3f9247a0234c2413b
SHA1 f1479722082570eda65f8871d106e1e1dc2ddaf1
SHA512 85912d1a17c7749b33584f4b9a57ee2cbb4ebce9cc7dc41cee34eb9d7cb9a67c85689ff8ef96e0d5a634b9b2d84df07f937ef1b6bde0675b94ad2775fe947120
SSDEEP 96:D8OZWkzGEpUzlz1Sk01yBdi2zqek4hloXNunu+qRqlsrw1XK3R:D3ZWkzGEpUzl0kl7iirXLoEuH4WrkyR
TLSH
T199D17AB7C7D9812DC81156F49B15AF1ECF6D0A18831C3C6688D8EE1B93E2471E21569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 eaf70f2d83f7812e3282ecf5ff2dd695c694de6582f7d0e7ed9c0e8bf0ac639a
MD5 5a69f781d01806c083daa705fc199ac0
SHA1 362b7bb41ae2819c2766f7873c274782bbab622f
SHA512 98516f2f1e4f16f2664f6ecf06bac2c39dd44a184eac44545061f6f00d4f30095f2837a10b97bcba6d05bda40f2ed8d70777c3740876e39555c8a24ae3e308dd
SSDEEP 96:D/OdhirtjQOPaBz1Sk01ytZqeIhlsNuPudRwBKbGj4/Qm:DWdhirtjQOPaB0kltZrILsEPudRkKbGU
TLSH
T127B168F783E5822DC91196F49B15AF2FCF291628431C387A88D8BE27D3E2471E11576E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 fa0b91d3b8744f23f9ecec14d7077d87c5c7fcfe7b4fded871afa945d7bd1043
MD5 69d2a0fec0982a829cd8870d31f3d298
SHA1 07bd86dc489d011ccc20f3da5fc6647aad674fdc
SHA512 49a5dce7bdb1907be8bb41fba29b91785eebd59e2e481f1457fd36ec41ea1b9b18890986d8290e2a6716bf9b7687efaecf122c27d88a63b59fd9f949cfe26014
SSDEEP 96:D/OhirtjQOPa5+z1Sk01ytZqeIhlsNuPudRKGj4/sDW6rwQ:DWhirtjQOPa5+0kltZrILsEPudRKGj4a
TLSH
T112B147F783E5822DC91196F49B16AF2FCF291628431C387688D8BE27D3E2471E11576E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fd3b320bc5e4099d7b684aa84c1763c6f5ab1a6e6a381fef6f66b166c1c99e4a
MD5 9a7112b2376bbacaea3bdbe299515fed
SHA1 eeef1f57d03b4b2272432f39c8195f172360851a
SHA512 724f23cdab185caa7947aeccf4078299e673cba5edcd85e589a2b9df51f129441f95120cb9cebb7ba62510d100283f1363b79c0d17173ebca9ae463a4f8f6068
SSDEEP 192:sxZQR1Wj/frsSG/Idp7wHW6+WNfsPgQ/YapAJB+PIgrJ:sxZQyj/frsSpUHbI/Eo9
TLSH
T1D122B853AE28A97B8CC7D20DFA55BF13E6F9503251D52E48AAFC961C04F66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d9b1534918de381c923ce736160248667b1fce190b6c1a2bcc6b9a4b9ff5c49c
MD5 4f7b616e42292e1b83dfcc8d9843635a
SHA1 fb17a9f5efe64518d56e9d38dd690b7d3de93e00
SHA512 330d6f05784f92923cd9638c7c4c9adbff61ea2a48d492713bcb839d5ebabea2607451ca2f7248f4104bf2d4a5739f3eb72351d8693bb01fd2b6a41e9da1e288
SSDEEP 192:sxZQR1Wj/frsXG/IdppwHW6+WNfCXXYapoB+PIg5ZJ:sxZQyj/frsXpSHbIXMo1
TLSH
T14522C957AE28A97B8CD7E20DFA55BF13E6F9503251912E48A6FC961C04FB6CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bb2ecc3ebc0659a5ff81a304005fcf976083a48458795e4edfb40f0cb13cfdc8
MD5 d7fabdaefa0b1543c85b9952ded46426
SHA1 649c4d6a841dcd8a35b2f279e81fccc44a6d6359
SHA512 1b1d463f7cb26562845bf377a1f96f2feec822cfaafe10cd1976ac326d689dbb0171c3839d4888639f452654390df3e37d6bf48c0acc0ead07ebe08435afa9e3
SSDEEP 192:sxZQR1Wj/frs5G/Idp7wHW6+WNfsPgQ/YapAJB+PIg57J:sxZQyj/frs5pUHbI/EoD
TLSH
T11C22C817AE38A97B8CC6D20DFA55BF13E6F9503251D52E48A6FC961C04FA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 60159d85f8c00cbf53130c0f870684d2280542ea09ee0ca8810c24d1f08c119a
MD5 b3ee7b255de8617c5bb04ed9190b6597
SHA1 75a045c258e0dde4d2fe7e47ba48c37c01418522
SHA512 07ecfb55a752d380eec0720c859a82a68e1a16cd3ec700d791edf3583100b62476e6901bda843a5d1f262031179a9b23c5a2857f1fa63783aea2e7965f314122
SSDEEP 192:sxZQR1Wj/frsXG/Idp7wHW6+WNfsPgQ/YapAcB+PIg5ZJ:sxZQyj/frsXpUHbI/5o1
TLSH
T17D22C857AE28A97B8CC7D20DFA55BF13E6F9503251D51E48A6FC961C04F76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 a71eb2d1030ba4432297f84db2aa86bc95cad8a34703c52dd80937f467e7284b
MD5 58fb6bb3960942ead19e03d080743192
SHA1 604329fed70ed70869e7a82c3a7c64c3d1164380
SHA512 d68d7110513250c32804f5178e9502f3e930a880c60c4733ecb54c0594e55311ebe9f6e7a410a91cabe9938c8fcadc7983ff71d8e6ea294712e45d65995468c8
SSDEEP 384:sxZQyj/frsP66s8qMpRiYnazAW8pZS15posJWeT+QpSHbkxAp1:sIyj/fG4Mnc7WeT+QkHb4Av
TLSH
T1B7B2E606A924C83B9EC35D1C693C7E33E9EC506212C5DEDE56ECCA1C01AD1F9AB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 239e800ec3739a20723d8b67989b02720f83b311c4dac348b7d77ffb29d05428
MD5 ccf174b4547c48ea2fb190a34f30913a
SHA1 a12c1cad916a614817e7d6e9a2eed0ce69879459
SHA512 9c42b966a9bda3250e236bfc4fdd969f04c9103f9f0314477a7c6e847667e577f4128508e2e07e4a1a4165817c3b1bf33d1b1e782f88db0fa228fa1b6862f6a9
SSDEEP 768:3tWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy77ro47femmRN:3tWPcLKWvKeEeu1jaClLiF7I47WmmRN
TLSH
T16BC2FA3B640CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5aae39ec-79b0-4eff-b5b6-8d9559be1957\index-dir\the-real-index
Size 960B
SHA256 9a093b7e269bb3d29baa84e88179c0839ceedb202bee220dc99bff10361c76d0
MD5 452fd0986e1a6bc597741b77691c43eb
SHA1 75dfdedf8d4086ddb4a91e6c6b218316e9f0ccfe
SHA512 2e00ac9054326f7a86768d9d633bf002fd5e705292e9885c7d03eea35f5076f420385dc3c5b53466825e35ad7830c245ebec4d44cd254b209a23c23e63ea98d4
TLSH
T1E51144860C534F67EDD40274207C6D46A27102DC1398AB4FE2BED026CCE67407D82AB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf506.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5aae39ec-79b0-4eff-b5b6-8d9559be1957\index-dir\the-real-index~RFe5cf506.TMP
Size 960B
SHA256 80d6cf2b4f23774ad9fdcd37b0056739b707f7822b8dcb2f2920aa20772f8c8b
MD5 f7247bfa8f5cc5a2467d505173803753
SHA1 003ae8904b71418b8a950e8c12d7d3bda2007187
SHA512 97158a5e1986193eef6c4612e1819d75df6d6a07d10ae0a51c0a8cfe69deda8f160d4cc421cfe9e9fd29a34c6440e439c460dd7d5677291d8e12fa582cad38b5
TLSH
T10A1123A601634B57FC8403B59AAC694622B691045358774FB3EBE11ACC92B847DC3FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 eaf8cc64190a6147f147b2947855f5d867e0204699959ad1bdfcf18f1ebd7322
MD5 bb4d6a6a4905869e66a2b92353738152
SHA1 31cacb9ce82111852853cd9ad9196a3511fca130
SHA512 57965e5c0d98e2edea6d38ef6934be4191fbd9d3eb3ed61f99d6ecf07eb5ade907a734f61d5c610fc651f067b21e2f301da532e408fa62f14e6c296fecd8e94e
TLSH
T115E0C0772DF71824EAAFC3D904B014B00005B424CDDCACCF512AD1C350B13613047C31
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594397.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594397.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f357c5518c14af691720fff9b377bab957661899402c607ec14240b71e6b3bf2
MD5 ffcdfb76276ec74178c265a82379c7bb
SHA1 56fdbdcf4b0da0ec265d2d76c98aa54bfe13195a
SHA512 7d0f0ba1b5f72ec18636260b871dfa3941f9349422c8c5beb8b8b296f074cbb41027f852b99c606d667b558effc98d785c3011f4e92ae3a76cf32b3429d66cc8
SSDEEP 192:uzLsN2UjQNBNE1ShQmiU1VV84zIGmUkOA+PWa97i6/RXvN22Mq:ksN2Uj0m16ZTzIGmUkOA+PWSiulXMq
TLSH
T184423B36AD78AC375EA35548F4473A13AEB8916BD6C42F98D5DC7B1C01EE3AC130B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 85af338e8d7931af147b3308fa857e33267b48901607b80cace66537af51da5d
MD5 3c990156a258c08b561cfa91b871289f
SHA1 8de9c19e865307ed8a04fe04637c556cb225803b
SHA512 9de60c9313da49b2e477ae3cf09e54dfe0737a06c1255cb3a74e4e512a9c0b3559529d97fc56511ea7645df3e0bfad4579d297a16d42034edf3816f74cea9761
SSDEEP 384:qiFiZcIGzsN78TUNTUlIl00m16rTzIGmUkOA+PWmuiulXMaoB:hFQ2ewgycHLkOAEWmuiudVa
TLSH
T1DFB209F248E79836D9AE4747E73D2E028DBCC067F5849A54B3D8660DCC9A1BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 590c1490002c0148747ebeef7e7cb5a30fa66fca775e385e6208bacce91e3c32
MD5 a09184a97f463f57de89b71cec5a8e56
SHA1 4e5bbc1310a8d3aa4ede17cfd2d66939a9385078
SHA512 e15f6d55d2c7c0ae34c2b2af001da19750b79722350b3a953a6e3af5df33f64a48cda2640250259295375dc4093bfc24ae38e320aaf35569836a16dd58829359
SSDEEP 192:aONx6IE7QmiUytWTPuIGmUkOA+kC7s05U6:aONx6DtnPuIGmUkOA+Rs4U6
TLSH
T1A902F935AC78BCBB8EF36E49F4873B239EA5112BD5856F84D9E81B1D00DB25C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e49a89b0897bfa177c8d2299e89f56a6c28d9b821833a77e313fcfce9f88a3d8
MD5 160d74bbfbde19de2f96f077ecc3f983
SHA1 e4443cf402b2fb71093400a6d0d468337aeaab36
SHA512 90d43efc020cd8ba9220f60c0c3af384f417208c3317618e5f0cc291c209f5b454beef72c197a6405c47bfce199a6afa5476dd90ac870478da48c89abc8ea450
SSDEEP 384:1ZcIhsN2U00m16rTzIGmUkOA+PWSiulXMaoB:NhjAHLkOAEWSiudVa
TLSH
T1C5727C729C78AC365DF79148F8463B139EB89127D6C86F94D0ECBB0D00EE2A8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6596ed959bebe399f240e965745da0034e5f20d3234c454ad79eef8bc906dbc1
MD5 17b15f2cdb53851f4185899b0b74122a
SHA1 8e3686806aca6c1f86239c8954059f7fb7313624
SHA512 cc487af78f176608cb60936ec4bb36e5534ef73248a5d4fc9cc15c2c002a6461fe818b304434a8b0736bca3d89976d3650eba2d7c7f6e8f5812daa7f97585cb1
SSDEEP 192:aONU6IEKQmiUy2WTBuIGmUkOA+PWy27H6/RXU6:aONU6DGKBuIGmUkOA+PW7HuU6
TLSH
T117123A32ADB8AC7B5EE36584F4473A239DA5412BD685BF94D1DC3A1C01EF36C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d2a5b3ef716a4292d368fc3fa008c2e2fff610e9afbc890566d3e972650b3e16
MD5 526f070378f39d607b3cdf602feef57b
SHA1 49004eabb299c0450a8f6156dedc580ee67326fd
SHA512 f921b5f26d7c9bce53933a1b5a2db0f8c4cee4e8aa73b8f590ba6ade1c6453beb0ba74ee73d00271556b3452aca030573aaa88fd90a742b9d1734dd07e42c800
TLSH
T17BE00103D60000EEC035423005832A702B66802042831246693042783C213402F608C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9fae44db027dd912669e27d1e01fc4e8eb480fdbdf3fa27b6685d79e03beca85
MD5 cbd7d457409b905db9b429e370a5ad2c
SHA1 ad50f8b94487fa08d83956745ba383ce74dfbef8
SHA512 4763d67fe49ea32563422375818232ae641de08e56440c53095df541360cc390510eb097ea1014e57d1e3e326a094e2e9bb327676017c342475243f2e03e3a02
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cecf3e45ee5c07acf461fa33f7b2f4e634b83614d79a5b2c830ae891c755ad91
MD5 2085f8d7de8b37a0147b60566d64e5dd
SHA1 2ce883b8050820bce0944ff251494ae745b7a1b8
SHA512 e9eadfff6b89b0fe94cb6050e581c2933f30244b315607f95f9a85dffcfa7f4a4009095eca2701c0f049a0b7dbaec1432f86fd85af9e04cc5427886ec1c04b9b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a238352940fb2ba42ef418ee9c1995643d79c9bf08aa414ca2dc7fcdc0b82774
MD5 44bb854a6cbb61ba70ef2bce203ae74f
SHA1 485f1de42a4cd80654beae39265c97d74fec3e2f
SHA512 b6d0da1019fe26daf3d457856594a6177e5479080e217027370ea9e92919139b1f2732b81067b28ce2d831d78131d35a0497b6a698e0571f71d66cdf2d2759e3
TLSH
T156E00143D70000FED035423406832B713FB78020829312866A3042793C223402F70EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5980bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5980bf.TMP
Size 392B
SHA256 dc427d69a99454551207bf606e4e13efcd061d7a0b784d4e4553eac7581c7985
MD5 c3a46413c70ccc22bfa488339c2f3f60
SHA1 ba5bf5cef7658047ec51f2ce4df9ec409986be37
SHA512 65c8991f803be71afa399d3a9e3a20b51451e902be9f819525f3cabe87350760e5a808cf6e6a79760e72044869e7890d1ff3ceff3b7e07a72a0cf65837193555
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e57a9aaabf0455ff79a544d59922b407cdb6aec0845e1cbb568314af53b42ed
MD5 41b711b558a0ab750573f386da98c638
SHA1 2c2f63e8aff3a14a4f4b93703fe202d14eefe94b
SHA512 8072dede864e0f1145b8bf98975a00539a9fc3764db54d50dc2021ef246139b19208a373d5ee640cff93136a73cf8ce7a473ca6c41334dde624bfd44455eefc8
TLSH
T1FE410398B6EA1148B3B77F56ABF6A86D483EBD772E06949E00010D4F0A62B44C871733
MD5 SHA1 SHA512 TLSH

Submit Download