hxxp://Google[.]com

Analysis

user interaction
yes
max time kernel
1049s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Google.com
Sample260922-tkfdtss18l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3276	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345668141007507"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{495EB466-1953-48C0-BAE6-85AB3A261EF8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1720	632	msedge.exe	85
PID 632 wrote to memory of 5596	632	msedge.exe	87
PID 632 wrote to memory of 3276	632	msedge.exe	86
PID 632 wrote to memory of 5596	632	msedge.exe	87
PID 632 wrote to memory of 5596	632	msedge.exe	87
PID 632 wrote to memory of 5736	632	msedge.exe	88
PID 632 wrote to memory of 5736	632	msedge.exe	88
PID 632 wrote to memory of 1884	632	msedge.exe	89
PID 632 wrote to memory of 6076	632	msedge.exe	90
PID 632 wrote to memory of 1884	632	msedge.exe	89
PID 632 wrote to memory of 1884	632	msedge.exe	89
PID 632 wrote to memory of 6076	632	msedge.exe	90
PID 632 wrote to memory of 6076	632	msedge.exe	90
PID 632 wrote to memory of 2736	632	msedge.exe	96
PID 632 wrote to memory of 2736	632	msedge.exe	96
PID 632 wrote to memory of 2736	632	msedge.exe	96
PID 632 wrote to memory of 980	632	msedge.exe	100
PID 632 wrote to memory of 980	632	msedge.exe	100
PID 632 wrote to memory of 3196	632	msedge.exe	101
PID 632 wrote to memory of 3196	632	msedge.exe	101
PID 632 wrote to memory of 2464	632	msedge.exe	103
PID 632 wrote to memory of 5308	632	msedge.exe	110
PID 632 wrote to memory of 5308	632	msedge.exe	110
PID 632 wrote to memory of 5308	632	msedge.exe	110
PID 632 wrote to memory of 5160	632	msedge.exe	112
PID 632 wrote to memory of 5160	632	msedge.exe	112
PID 632 wrote to memory of 5160	632	msedge.exe	112
PID 632 wrote to memory of 2076	632	msedge.exe	113
PID 632 wrote to memory of 2076	632	msedge.exe	113
PID 632 wrote to memory of 2076	632	msedge.exe	113
PID 632 wrote to memory of 1232	632	msedge.exe	115
PID 632 wrote to memory of 1232	632	msedge.exe	115
PID 632 wrote to memory of 744	632	msedge.exe	116
PID 632 wrote to memory of 744	632	msedge.exe	116
PID 632 wrote to memory of 744	632	msedge.exe	116
PID 632 wrote to memory of 2784	632	msedge.exe	119
PID 632 wrote to memory of 4436	632	msedge.exe	120
PID 632 wrote to memory of 3424	632	msedge.exe	121
PID 632 wrote to memory of 1752	632	msedge.exe	132
PID 632 wrote to memory of 1752	632	msedge.exe	132
PID 632 wrote to memory of 1752	632	msedge.exe	132
PID 632 wrote to memory of 3356	632	msedge.exe	133
PID 632 wrote to memory of 3356	632	msedge.exe	133
PID 632 wrote to memory of 3356	632	msedge.exe	133
PID 632 wrote to memory of 5820	632	msedge.exe	134
PID 632 wrote to memory of 5820	632	msedge.exe	134
PID 632 wrote to memory of 2740	632	msedge.exe	137
PID 632 wrote to memory of 4792	632	msedge.exe	141
PID 632 wrote to memory of 4792	632	msedge.exe	141
PID 632 wrote to memory of 1176	632	msedge.exe	142
PID 632 wrote to memory of 1176	632	msedge.exe	142
PID 632 wrote to memory of 3816	632	msedge.exe	143
PID 632 wrote to memory of 3816	632	msedge.exe	143
PID 632 wrote to memory of 564	632	msedge.exe	153
PID 632 wrote to memory of 564	632	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe2235c188,0x7ffe2235c194,0x7ffe2235c1a0
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12943618754001074296,3592454821891633653,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6919704946589665591,1917851471397907505,262144 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16379197099167660966,14342760576251058901,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8602557122779381607,11170904027873297036,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6589735704694930428,10573542758859076040,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,2746337163325878264,8219764061534248078,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,11509194470037522596,1322536036812764931,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,14271996346259764778,17207249908683278543,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16383517978260570950,13709868157497925470,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16383517978260570950,13709868157497925470,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6048,i,8222050623840802420,3272109934065902369,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6356,i,1648890941183047745,8996504381291693697,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6524,i,8243343701162788443,7672989199403211932,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,7975276774588564857,13432832516216698694,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6664,i,8223394886867141396,16689371040585558397,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,14185059747222046934,9182446074100219992,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,11607231436551979137,3708549813946337395,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,14885311109224352825,9514200073821905772,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6408,i,9159428758504010882,15203035150650529448,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6164,i,17399252229153644201,13793332463921666731,2097152 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,15494365555135653773,7595698476628048286,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,14028536745985331427,6224437046408123023,262144 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,16769018344499520300,9765721457644434202,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,15554006376975009432,3764695925918902347,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,499731185949521368,12526122165416314341,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10772378789587703317,16002912077728667055,524288 --field-trial-handle=2292,i,15964712298904444961,1926148261323242625,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 83385c89049aaf92811103ec4b29505aa1d74199c89e5a452b4b385a4ba42f07
MD5 086a524e41d3b7479d056b00eb841728
SHA1 d3131b0b47788649e19eb1df675766ca6a93bad2
SHA512 22ddeb76879c21ef76d823f6cd3fda0f7a287de9220d2a28b3136efd3093682e7d492b5d657115e4b2e2d96f5bb24c11e163e70c93580f3da36359015ce9d625
TLSH
T14BE04FD906D9C26EA208AC8B41796B4DC290370A96D86E9A6B14CD887143944A7E2A96
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9563e4629d8451687f76fee15e257c6e344e436aa19b7e79e2aa48169b77a6aa
MD5 0e92ed151313c575ba2e713afde87462
SHA1 af0a219a211fd81be4adb172476497abd06010ca
SHA512 e0932a120db04c21e60ee49df49e12f0f77686ed1d9e58421907142b7f1ab0f0a479eb682ab71fd367959e552f538de45c1232c6499184a42e6b46ab642b8034
TLSH
T12EE0CDDC45C9C36EA30C66C7417D5F8CC2A0374FD6CD6BBA172689A471439C5B3E2691
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c6c718e96e285e3abfd0be4178065e4429c4eca30ab93b4e42614c5af811e6f9
MD5 1a86f226622fc39029b211dbe4d07a70
SHA1 a9c21e9232b89b1e2e2dd83855c80814c233fc9d
SHA512 60986af3277a0beac1ff7c7e47cf693e7fbeace1af2199ed6cc556b87f15609912f6313765af9a0b4904d925b65ed5e173bbb247139508e14595d366b8f55115
TLSH
T139F02DB5CC25BC3B08FD5B2C50A40746EB5113573780888F3B3D910D8FB5A37854691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 97d75558a355c99cccfedf578b2bd0aba5d327a9dd6c9abfca202bb40117128c
MD5 1f7c6339d48f1d82d5c0d1ef0b7a27de
SHA1 0a5e8256053d6beb6059a174d67f336bbc315e44
SHA512 1c6166c2124a6d7f889f004a661659a1471b1fa4a858df16636a9b2e1728a3148425fd502c9c7e58d9318eec5e22d7b5731a1fec0281bfe2f6b4450fb2947071
SSDEEP 48:8dOLoLY83/DHjKHoJaeQWBiJc8lLV1KnM58WMxDhPBERoKtUE9bT00601C:dUzbUoJPPBiJTLinMJMxvERoKtUEP9k
TLSH
T14C9195426E86A4D8FB9C30FA40F01346F6B9F04D0E4BDE2E079BE774245BB4D5298661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 57fb46e5fa58aba5cc9ab049f5e041ab855833392eac5c1822ebab3c3be25697
MD5 80a0dfd43b187ed481eb36b3548a84c5
SHA1 19c7864e5a1cfa2505af04afb9ea38d44f1759ac
SHA512 5de13d1b74b5d68b8fe44936883c27de44b8c5da8cd855fb46cdf228466c2728a64b9c486f0dd38a8b9c0d932cbd1cc58a188b77aa052e2519abb06b5f62f318
SSDEEP 48:GdOLoLU83VlDHjKHoJaeQWBiJc8lLV1KnM58WMxDhPBERoKtUE9bT00601w:/U7bUoJPPBiJTLinMJMxvERoKtUEP92
TLSH
T16A9195426E9664D8FB9C30FA40F01386F6B9B04E0E4BEF2E075BE774245BB4D5298661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595f6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595f6c.TMP
Size 2KB
SHA256 555ee29c3c2072c3c7b66db6c517ef49258b7b19090360b5d6136800b0e9c64b
MD5 6abda9a57d544e97a74ea4b33e25449f
SHA1 a3226a3b7421c3d0cd88719cdef0403a0eb05c06
SHA512 7c995a47d19ae9f4e71ddcd555b6783e896b9e8a8ceed9c5193872f351e30652f291d3784e57c5af051a42529fd352332097c67cef5fc5736db211b4dc814b85
TLSH
T1B0511B838A807AC9FFE411B385F5138335F1B442968FAF320BA8C3796853B0E9198770
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 e3b5408923c3631745303d7124e18744c6b6c5dddbfe6ab254ddce4438792692
MD5 58934af30c667f50de21f27d49294053
SHA1 2181a501155dcec2c522fcb4d68fa37b1e6f55aa
SHA512 b148fc405dc603436c82d2af9c7388a27110df8ad4ba007620a46a07f2936faa68657d5a3caba05d6c334c61e6db1a4449efd3eb50e95be66386bd0db38fe998
TLSH
T127B0113A20808003CB003BB28882EC02F032082C8AC2B08C88A00CA0C880328C283A08
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

30d1f83e-58eb-4642-88e0-aacfe971799e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\30d1f83e-58eb-4642-88e0-aacfe971799e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 00f916c59bdc1be146313e786c58b154a450b1815324ba6eb30495a2e9c2d202
MD5 5868e8c487baa09dc6da66e9a97dbad1
SHA1 2541b8670def84adb0fd15ce9eed596423b8c7f3
SHA512 2d7fe91b7eb6a8045754222e1e79e7fa6ddd61e80ddeee19c3642512af954c26306715ce7c1e512396514865de64a250a48c888da57957fbc1f0a23abe5c84a2
SSDEEP 192:D1wUhdex8NOgRwa+IyubWVTdwqr/vkIGCNh:D1wUhdex8NOgRwa+IyubATdwqr/vkIGE
TLSH
T15CD1DDF7C3D9822DC91156F49B15BE1ECE1D0A18432C3C6BC8D8AF6B93E2471D252A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b664756b-fdbb-47c8-8a21-81ed6740e311.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b664756b-fdbb-47c8-8a21-81ed6740e311.tmp
Size 209B
SHA256 e7b04b1c8abf0be13ecafc9b2954dc65564e89268a32111353112382f212ff7f
MD5 4818c8367656cc1a843f6c6f2378610b
SHA1 a0dada26e2c6955ea09c716a0db22bdc3f4b462d
SHA512 0674d43ff9449f98c219565bb6a41a3916efffac03f4c1155447980213add2ffb9a3aecc419c12f4c0d46e266333f53eb0ed3276e3bb16873f67d19c61466c88
TLSH
T162D022332318B0B5A96C6FC946AAECAFC77A00300802DAE414D398BC053286D168BA41
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5ef109beedc7089ccde45074b6d51f99bb79bbab6470036d5d85bba1adcaf2dc
MD5 5ff0918035eb8a02146f22babc841965
SHA1 df59662dfc822adc7f33848bbd5326dc49dc3f1f
SHA512 122284038bb1b9d1d5e658e875d1e41701947d3dd99b271cbcac0ad1f2b92a246adf5c3ed2545e214d7871c20e455d291091014871225756a42090c1367ce3f3
SSDEEP 192:sxZrRBkB/fKsRQZZUGzodpofNHW6+WNrh5/YbITFYH1IgjBJJ:sxZrMB/fKsROZU9iHbb/FBY5jB
TLSH
T19F42B616AD38A93B9CC7D219FA55BF52D7F95032A0941F48A6FCCA1C14EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2852ef7ca7a13f9cf620e599872a1db613808f6379b2f8a70a890d76ac3f5481
MD5 dc531e00f9d403a69ea1049a69fa6a6e
SHA1 c44ec6ed70a539aca79e8abde6ef8532c171f88e
SHA512 e5f884e596e3fa0731adb3e71fc4ca4fd79895472738ffb89ca000393182361f648e8bb9bf9bd3978f0433b95a59aaeffa94a7017f44f02f27b649a424178b55
SSDEEP 384:sxZ5smzB/fKszOZ02iHb4Vty/FdY5NYU+R:sBsmzB/fpRbHb40FdtfR
TLSH
T18272D7569934997B8CC7C629FA35BF12D7F91023D8855F4CAAFCCA1C10EA5ED220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 88f985c6d7bb2b80f779a4704fda86075518160b72bb945ee3ca40d4a608ad14
MD5 f44d10c3507deb2b189c7bf1e69556ed
SHA1 dbf0ab1046e7da792541aee9379e6e587a096199
SHA512 7fcce9b872d555dd2e8d3e940b70334ab61da99516f3e94c2fc15d966a1df2204d3f8749999c696a6e7916fc13eb091ea8a0e6101a169d62fd0273d0160b9ed7
SSDEEP 384:sxZ5smzB/fKshOZ82iHba8y/F+Y5NaU+R:sBsmzB/fXHbHbadF+JfR
TLSH
T1D772C7569934D97B8CC7C529FA34BF12D7F9106298815F8CAAFCCA1C14EB5ED220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 271B
SHA256 b854e42bbcec971e7982a8e966b869256a419720e854df92e6ef4ea7aa1d169e
MD5 9bb5530b104c0a2d6e94ec909d7efb44
SHA1 e151fda5e2451041bd3a2ac83d92852b8d736491
SHA512 5166bea282bc410c66b38ee3ada9bcf359a8e2748d7d6e68b0a64016181d21d825ac2492539554c5da5c4df2652a23f71eba12cb745634a0358f2880fdc40307
TLSH
T1BCD02BFB1C960830DD6FA7C2483191A50001B850C9C8EC9A211881C754602513C13C15
MD5 SHA1 SHA512 TLSH

Submit Download

4ba059bc384de2c2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\4ba059bc384de2c2_0
Size 193KB
SHA256 cc1ccc862b66eb71377dabaf3b88d84b42a44e6ee9fe5d98e85256408ce307d7
MD5 0b89ea97931845b51994d92de075536a
SHA1 b85ee639703adf706739a9231b6965f4c9b9945b
SHA512 1d6e55a442b4616e6e2debdc46d7b26e4a13abb65f4c96c64ececf73753afcc3b2801a6060a8f0b2c4f0c52ddb1cb4772d018d5bb187483a8074191045eb019e
SSDEEP 1536:YoWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:5rFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T13D145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b439aef44c648636f2b6350305e2f377053667479afc8259d753c30ee08296a8
MD5 67e0826635bdf52aae220d0b56421352
SHA1 20e40314b87bd1941e4915ef1e37d779fd67bc54
SHA512 678a6221d2bdefdeab1fc136ed95cd5da21973d886686ad6245046b8a41d5732ec3ac6c1417a91b1017fcb68343189622b41b0eaa69b2c9ad9945db93ec5de2e
TLSH
T156A0021D15D94836CE2173B128825155A6315C14E945C34B58B4AC85D8931404D0B438
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6e271733f17ea943cbec78aeef3d27a6a70a86aa2542679ccee37b99eea11d80
MD5 dd034b9f212b72ff751fc346bc3b93eb
SHA1 adfa1f602fc5c7d2952fb954282f765ecd68efec
SHA512 4ed402e9f6f27ca31a6f2fadf5c6bf827eb304e4265a0563e4b448f4f7ba1558bed98639dc84f17cab78bb4a747d8ef633a4d5fae57c4e3057079989a12e42d8
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXSZDL:OtfFvpopPxrB4RhfS9L
TLSH
T19CB2201571BA021138FE690C81B58B2F064232B37159E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7ad6915eea2fd1f26b13f8b03b9d2134b26706a8951d2f4063e57198ed80174c
MD5 e6b5094628a78e6eb676685e771464d5
SHA1 8054a4053702120ac7e8972ffc4bcdb5581cb75a
SHA512 272e8fd5d70753a7e9e074345b16d5480817aa8172ef4af3e30425b5b26bf7effbab82aa9ed5599bcb59e117afe4f5640158cafef349d5850180a0a7ac2559c4
SSDEEP 384:nhiFiZcIw3sNP8TUNTUlI4G5mgYBlK2flBCupuSAiJt7xuvzxV+MhdpX9gL/7IzF:IFQw3awg6lPBnpfB74184pX1B
TLSH
T1DBC25B71E8A9DDBBACEA4BD9E74A7603DEE04163C58C8AC4DAD95D1C00DB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4a2bf3ab514881938e5e608008a2effde7ca34b2c14ce52befb785df3dc74500
MD5 2029f97333dce34723402537815db05f
SHA1 48db078fc277a1e4fe58802e9102e3779ca4170e
SHA512 63cc2a560469e79ec24703e039413614c5690f7b026c7445d32df4e79f06fae5ce2ab1ec5be9789ec7f7c58a905f29cf9b9cbd41c140e87a912d13c415809593
SSDEEP 384:nGiFiZcIw3sNP8TUNTUlI4G5mgSSO2K2flBCupuSAiJt7xuvzxV+MhdpX9gL/7Ip:tFQw3awg6uOMBnpfB74184pX1B
TLSH
T125C25B72E8A5DDBBACEA4BD9E74A7603DEE04163C58C8AC4D9D95E1C00DB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5c49ec806421ebe3246716e282417a2bdc1d7ef8a4aa02b1612776dbe968b2b0
MD5 8be9f62b287dfa935445629e12f0ffe9
SHA1 a7cb989b31f05173e91f0e510b44526f3cd43b4b
SHA512 b1ded6c41c321d925551475a16b62e44ac265c19c8a0fc516bd7f3a5e1fe16a5cf7d69888f4a3b273480dbbb4d225a0a2880b8bfc03692e8a5cc2e93b751b035
SSDEEP 384:nSiFiZcI63sNZ8TUNTUlIm25mg5FnK2flBCupuSAiOvsa+VYqgL/7IzaoQ:ZFQ63owgSSJBnpf4vhgCz
TLSH
T170C25C36EC99D9BBECEA4FD9AB4A7A07DEE40163909C9AC4DAD85D1C00871DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 91a58e4a1f5a10605381f1f37bd66be49c4270b9ab1dbad4e691d661a9c92731
MD5 eb0a98884613737aaefb7cf0e96a142c
SHA1 768cbb3beaba8c0b701ad6ef8e8b570f0e41d218
SHA512 31aaaf699216cd625a5ccae8e50da4dfa716dd8a3527c75aacc21a4e8c9fe07771dee46138f02a9cec8456294bcbd28ad063eff49cbf12831f6afc7745f97b82
SSDEEP 384:nyiFiZcIUW3sNP8TUNTUlI4G5mgSZO2K2flBCupuSAiJM7xuvzxV+MhdpX9gL/76:5FQj3awg6NOMBnpfY74184pX1B
TLSH
T172E2A1F198E789B6E8DE4797A73D6E0299FCC153B5884A80B7D85D1CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c1c303715231da9bcd7df216ccab7ceb02c80e6c1b81aa18282029cbb25be14d
MD5 b69078d638078c60a2bc2e87b3e8d991
SHA1 7850126f52394f02a40c7af8f1fe635a3255b905
SHA512 4ace5999a07cfe9397c4b3aea3d89edc6895c537ca8a625ece6dff56e2d0e6803f7a04023e9aa4d6f402fa73429914bc7025ce8f3b654c3eafdc1d517ccb1e89
TLSH
T1D8E00200DB81852EC128033440D3572427A1C18042524357A12005A56C573451E11540
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5953f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5953f2.TMP
Size 392B
SHA256 a670b18740a7155aa2b789dc3446142a8c6787acd053783ba069120896b26d5f
MD5 2a3db1ec9e42bea564d3bcb04706a282
SHA1 3ab1b23235c9d410da991f91b36323ff4d1e6b9e
SHA512 94287aceb03401238d1ff7cf4ae8991ed85e399430299ef20c1b868542f0f8714ed59b82ea6f6ce2ccf5bd00cca80eb73c9a506da5ec5e25990b46ec2b049b3f
TLSH
T126E00400D740053DC53C033440C3573017D1C14001D14357713001D57C173451F31D40
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 012ae1e4021c754543abf8365dc2a0f35cd860932152d58b5da93895cdc8fd02
MD5 524452ebdbe9931462a9a3b54a08a0f6
SHA1 6b774444cd1cc6331b752a8d34ad9175230562e7
SHA512 c35a75c33bb9830f206c4a7f864a48052f66a35ec763ee1671c6e0ecf0d1c2fc96656db63c23fe0ff3d0baa3d9cfbe266748a28e7e7285e93312d55b9c5c0d10
TLSH
T1FD411A48A6EA1148B3B72E56AFF7A56E487BB8772A06D45D10010E4F0A67B01C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2464-358-0x00000238499D0000-0x000002384A9D0000-memory.dmp

Download