hxxp://accounts[.]google[.]com

Analysis

max time kernel
899s
max time network
896s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://accounts.google.com
Sample260924-wwxtcssyfw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347475123535040"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{4FAC3F81-DF76-44F5-98F5-7E2FDE1F75E6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{61C31BDD-475A-4B34-BBD6-DF371FE3E95C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2236	4712	msedge.exe	91
PID 4712 wrote to memory of 4816	4712	msedge.exe	92
PID 4712 wrote to memory of 4696	4712	msedge.exe	93
PID 4712 wrote to memory of 2864	4712	msedge.exe	94
PID 4712 wrote to memory of 4696	4712	msedge.exe	93
PID 4712 wrote to memory of 4696	4712	msedge.exe	93
PID 4712 wrote to memory of 2864	4712	msedge.exe	94
PID 4712 wrote to memory of 4476	4712	msedge.exe	97
PID 4712 wrote to memory of 4476	4712	msedge.exe	97
PID 4712 wrote to memory of 6012	4712	msedge.exe	96
PID 4712 wrote to memory of 4476	4712	msedge.exe	97
PID 4712 wrote to memory of 6012	4712	msedge.exe	96
PID 4712 wrote to memory of 6012	4712	msedge.exe	96
PID 4712 wrote to memory of 4196	4712	msedge.exe	98
PID 4712 wrote to memory of 4772	4712	msedge.exe	99
PID 4712 wrote to memory of 4196	4712	msedge.exe	98
PID 4712 wrote to memory of 4196	4712	msedge.exe	98
PID 4712 wrote to memory of 4772	4712	msedge.exe	99
PID 4712 wrote to memory of 4772	4712	msedge.exe	99
PID 4712 wrote to memory of 2884	4712	msedge.exe	101
PID 4712 wrote to memory of 2884	4712	msedge.exe	101
PID 4712 wrote to memory of 2884	4712	msedge.exe	101
PID 4712 wrote to memory of 5600	4712	msedge.exe	102
PID 4712 wrote to memory of 5600	4712	msedge.exe	102
PID 4712 wrote to memory of 5600	4712	msedge.exe	102
PID 4712 wrote to memory of 3404	4712	msedge.exe	105
PID 4712 wrote to memory of 3328	4712	msedge.exe	106
PID 4712 wrote to memory of 3404	4712	msedge.exe	105
PID 4712 wrote to memory of 3328	4712	msedge.exe	106
PID 4712 wrote to memory of 4972	4712	msedge.exe	107
PID 4712 wrote to memory of 2216	4712	msedge.exe	108
PID 4712 wrote to memory of 4972	4712	msedge.exe	107
PID 4712 wrote to memory of 5144	4712	msedge.exe	110
PID 4712 wrote to memory of 6104	4712	msedge.exe	115
PID 4712 wrote to memory of 4092	4712	msedge.exe	116
PID 4712 wrote to memory of 1260	4712	msedge.exe	117
PID 4712 wrote to memory of 2656	4712	msedge.exe	118
PID 4712 wrote to memory of 2656	4712	msedge.exe	118
PID 4712 wrote to memory of 4800	4712	msedge.exe	120
PID 4712 wrote to memory of 2708	4712	msedge.exe	121
PID 4712 wrote to memory of 2712	4712	msedge.exe	122
PID 4712 wrote to memory of 2708	4712	msedge.exe	121
PID 4712 wrote to memory of 2712	4712	msedge.exe	122
PID 4712 wrote to memory of 708	4712	msedge.exe	123
PID 4712 wrote to memory of 708	4712	msedge.exe	123
PID 4712 wrote to memory of 2688	4712	msedge.exe	124
PID 4712 wrote to memory of 2688	4712	msedge.exe	124
PID 4712 wrote to memory of 1120	4712	msedge.exe	125
PID 4712 wrote to memory of 1120	4712	msedge.exe	125
PID 4712 wrote to memory of 1320	4712	msedge.exe	132
PID 4712 wrote to memory of 1320	4712	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://accounts.google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a0
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,13627008761686422403,17981467782515256748,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,2331481894107188191,12481354947842512168,262144 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,10639033231057482775,3139633949396838910,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,16753724356263333165,10129849769849601108,2097152 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,13785571476224426166,1317250943057171078,2097152 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,4777844494173985789,10544975375755891524,2097152 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,10911050075143268179,3585088693728425127,2097152 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5320,i,6480623514316038245,12444809778866729496,2097152 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3824,i,935882854265573151,5161693131201971156,2097152 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,3286861436092343565,13309097670095417159,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,3794498059167836672,8630380643435308843,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,11366704781795778478,8894222747531715624,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:12
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,7913898148690163942,15128574959113556552,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8010088102835881904,949235723100062357,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8010088102835881904,949235723100062357,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,12571069368514700851,8020902941699660507,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,11913231125751848389,4000132386987459675,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,10265317943882439329,8882393682624819290,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6921623780737251272,6497179611716595812,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2064,i,6564073368743372227,7823998894134638679,262144 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,2174197997958080909,125358392187035960,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2932,i,10581080733491199854,7843662441264692552,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,16926022279875175037,7694508434947601876,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14355163630605243499,9369286437483374500,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16031792803332529132,2435240394405928388,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,8276863366809499877,4251830622439376254,524288 --field-trial-handle=2716,i,9745266769045172836,12021177944108407967,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
  2⤵
  PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2804

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7e2421311f01c0a3e0359b179d5d184b784a544f569484e8c7aa1728434bf090
MD5 a39d02ce23ce2aa94cd962580e9b87e6
SHA1 56530e07d0ce2c0b7a3e26a928b482fda573b84a
SHA512 4601205dd780342710219c3c7bba02b76e76b1fb38d0582fbe70bed5c63c8edc6f46bf0def474dd8e77a6323b5feeb91a7fa91e43a8a331e0384dae58549e8df
TLSH
T15CE0208845C6C23E754564C7417C674C9280374F93CCBA072704C54972426C0A78B7E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c9307fc978c879bd087b26f2815d11543e3390a250826f0555978d1746c9b69f
MD5 37269cfdcf114c2a3756f36fd1c2d254
SHA1 697623beef7cba00fc92e7db9f2dfe7a8ddb0485
SHA512 8d79bafa6e50e2175690f31e3d86b8ec393881228f6be73a272d6e448722b4669599f0d6110e1a1d717048a811f1de04c084f88a94e3a89404602948dce9811c
TLSH
T1A0E086D935C9C27FB214B68742AC675C8290370E97CC6EAA2B04CC857641945A696FD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f093c797264418944cbb551280c07d9822b0b0cff47adfdcd2fb83a3340a63d3
MD5 6f48ca7dc655f011d0d0e02a21908402
SHA1 b0f0b43c59bcf8d4aee2dd9e375ae5026ac967a4
SHA512 7ed2a574ea2a9a36c09966431452004492f10f738d575d1892c5db90377e79e0f70622be1ff81d4bd8fc5724f33f5db8add65da4e6b4c5ca4e4e80b77e4440b5
TLSH
T1F1E086DC66CDC27FA204B587427CA78C82E1370ED6CC6B8A1708C4C47541945B6A6BD1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 49b63db7017d4584a7f67f425100779e5f0edac43c1981a91d8a2c44adf22391
MD5 c1bd0f0162aa180fe8b830b4463ee8e8
SHA1 b239f5497d30f6b9b6425d955715f82ea8c09969
SHA512 c37e0ccf21496a74d56816434e3c93f6cba6440bda00d58101fd69949e8f3f001fbbfb37dd3b55fea2f1751e70ffc25c526bf1332b88006fec8b71e92e4f1cd3
TLSH
T1E541A68096753655FFBA3B76CEC036873AF5868AE4C39E8705A0DCB98F4679883C0304
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 27c3f33e4c29f2d22232de65e0d80a86834939c2e290fa76cb7804c03cb98095
MD5 9cf3b12e8ebd73594d2780654c58e027
SHA1 dd9fd15774e42c0a4b2f606a0461db887550817b
SHA512 af4bbc00aa598c344f7f6d00f6f4160323ebd31debf56c1377e3caa151113b11d2c970317b750fc04ae6329b5ae3f269f7edf372996fb0a5070a7e1d4735d80d
SSDEEP 96:DeONsRLIW2ani0Fdjhny/zW/uq042F/3sCIwC/R:DNNs9Izaimdjhn8Euqlc3sCIlR
TLSH
T1C9A1AEF7C3E8C22DD90156F4AB15AF2ECE1D0918432C3C6AC9D8AE1B93E2871E10565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0161c74a567bf62da3056fcc0ad6a5e2019e674d14c07f2cf9402fa9da3a69aa
MD5 cf52e383bd6ca72b7430a53d31661d04
SHA1 87488361e539539a994c3dfa77a158abf4e4093d
SHA512 27d944b44985ae79f6f7bf945df922ee7060d79ec65954776a49cb7518a7d0a328d03dd052732018cff8536cb9845266f214350f4f542779c456c02f9a63c1e9
SSDEEP 96:D/ORZwOII2ani0FdjhnZzBuq042OZNwdGIj4/YR:DWRZwOIVaimdjhnZ1uqlrZN4GIj4gR
TLSH
T11991ACF7C3E4822DD91156F4AB15AF1FCE2D0524432C3C6A89D4AE2B93E2471E145B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 389b3ab8e6ba80990fdd7f0977c7fc6e69203a5beba4d3c52460184c696e0824
MD5 2c75d02dc25c43d753973216be2e309f
SHA1 1a646e376dfc3c5cd2990898e0c551e0f3bda42e
SHA512 f92f284361b0e6087b7c54806459f1425583fab526761a49535104ed5ad196fb674193773d080f33ede33fb98ce96036013707e523cfcb28e8ea8813b4c4ca5c
SSDEEP 192:sxR7R4bX/fsWswYyYhGzoA8pWmRm2/g6+WNkmHy4/Y2L4cYGAIgDGJ:sxR7AX/fsWszb7/s2/5ZS4/VV4+
TLSH
T1AA42C916AD24A93B4CCBD21DBB65BF53D2F95033A5951E48AAFC8B1C04E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 4157bb5dfb548cc2c2d8262ece5747ceadd8e7856c58ba74e733b64b772a53f6
MD5 38e483f8d60963587863b8c1b6329740
SHA1 e63b194bdcab16fc41891a767f097d931f1a2fd0
SHA512 eb1880f005a1ef1ce43b87c05dc3cdcaeadeab1aa652e4c7bd817ea063d6236bf861a38592da76de0b00e8c6b77e27c9e113a1728a328033238a9788ff3df171
SSDEEP 384:sxR7AX/fsWsR66s8qMpRiYnazAW8pZS15posJWeT+6b7Rs2/5ZS4/VV4+:s3AX/fs34Mnc7WeT+6b9/5f3x
TLSH
T17BC2F7059914D83B9EC39D18693D7E33DAEC506222C5DEDA5AECCA1C01EE1F9AB07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9180544e1f0ce9b06183dd714da60dd9ea097616303eecd278d13d3b5f26d50a
MD5 4b69c3fd185b833bd34946ecc022297a
SHA1 b41809e4d1630ecfa984b607a108dff80e5618dc
SHA512 b17c9ad36292fb74bf1b56602db9df53f69693880a3646a48784ab6fa26eaabe066419807e8e1a412b656a72de5068e96230a4d7c9e53e88f8bd0acfd2a55a7f
SSDEEP 192:sxR8R4bX/fsWsvYyYhGzoA8pWmRm2/g6+WNkmHy4/Y2LkcYGAIgIJ:sxR8AX/fsWsgb7/s2/5ZS4/Vh4s
TLSH
T1FD32C816AD24E93B8CCBD21DBB65BF53D2FD1033A5951E48AAFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 222d4116e863cb906ff0c5f04487f60a22a6cdd2ce054830e98f32e29d69ace9
MD5 c93ea59c7c15b7acffe22fcfa06cb5c7
SHA1 348cea4020fd30ca678bc160b6b8a47d0a3b3f5b
SHA512 f111873ecfd19b6fb86fc35e9a8e07a5a8dc533b232c3a60654c00478894e6b3d6aecca60e95ac731cb8607396e9440703cacb6070b341eb1e183eecf11e5dd6
SSDEEP 192:sxR7R4bX/fsWsAYyYhGzoA8pWmRm2/g6+WNkmHy4/Y2LkcYGAIgDUJ:sxR7AX/fsWsjb7/s2/5ZS4/Vh4k
TLSH
T18F42C816AD24A93B4CCBD21DFB65BF57D2FD1032A5951E48AAFC8B1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3017afb9b8a870e7511d614750024edcef5d3d5814bf408dcbf5c4f3a826068b
MD5 67d5bfde3ea4375c825aeb526d239bf6
SHA1 2dc55065cc8c50b2638db12cc64ef99d39151626
SHA512 04a40a0396801a9a1b5ed07562867f98da4de98f2faa3d5db34c6137f11d9a61daddd3a56cb55f6bc8d3531a90cf1d315e4640a988b444bd483cdc905b819da5
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWXroHrL:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0Vs
TLSH
T19FB2EA2F644CCB7E8FD00A9DAC196F977DA802C796588D4047FE994C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 72B
SHA256 740550632b1afbe0641fcfb37c4378aa2f20b73b9abdafa8637965d3904b1789
MD5 f5cef7ad6b78ec50b8d4fc9a62273bae
SHA1 8ef705dad3d9b8ed3f32912cfe4122b939798f05
SHA512 97d531d64db7dd3ae15d78d0c235f1056f6e807b26ce20c3adb78f9a15d99907b3f4a4df6686bbeb02556c11bbb53968906a5287662dc89b45e1afc4aa39754a
TLSH
T12EA002501AC16958E8651770141209F152456D581070823741F58088EEF26DA4285204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e002d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index~RFe5e002d.TMP
Size 72B
SHA256 b84bfb7db8e682fe802dc2fb008e25c3de1737a3713d642991996c9967ce8888
MD5 26ef85ea33bfc58f8380308b0803ec94
SHA1 5ae361776351547a85e248e7f1a817403439bfcc
SHA512 22c3859cb320aa1a478df0885c70687667a00495bb6eda7b9af13aad84d882c35436ea0dfb189c25cbacf85c8781c774be8282ce679efae3a461a42b812e30cb
TLSH
T1F3A0025057C06989DC611374140306B213008C1014B0833740F2818DDDE21D547C61C0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 ead42e589a676f1f91c2defde534f3562fbbed8a2232c78a4314d2d886298142
MD5 8a189a71c6f60e1fc30df17212e17918
SHA1 bcb73b55af0df13d6462aa980ac249da9e69bf17
SHA512 e5617577408f35193878ae9dc9d7e2fe39d2d3728d622440e250154578b06e380da20ef6c4c85c812fe327a4a58148c8628380a68b04e0f9c341036ff6d6828c
TLSH
T175E0C0FB3DFA1410F9AB8BD6243161A541467C10C844ECCF20F7D3CF60A17102406C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec1371f294674a63c2ec36aaf97b2189b1dc55d3de480606e4404be1a963dcec
MD5 ebdd8520406cb6bdf9ff6712577e685a
SHA1 33c0fbc7a16db8f3012464d0aab2519fe364341b
SHA512 0bba6d0d723fc5ea12e78344c6b222663a45eb78bcd8e6d1c96dc8c9bb055598e01333c6d88bce783594f7804d34dbd57f2d8356236be6251205bc3b44dcffa2
SSDEEP 48:KsgIzKxSU/yUGBq2MYUkkYXPIXekKiBK0kOW0R3MW5yxyIfKrC0wb+RtLdp3z:KsgQKxSOGvyKAE2SywKrCQz
TLSH
T1EE91DB5171BE064139BE29898174CB3B524232F33014EA7B7EBD54F58E6BE152EBC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5804.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5804.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 86df28acd7eb389e9b14dc08e66dd1857d9257a4e64ad84dc8abc26811294f9e
MD5 bcfc96bc4e8e6048d63965c60d232f40
SHA1 2e33b55f75954cd2a830bf8749b38d58cdb8b8cf
SHA512 6529bd375fda2cf68591af462b8de7cef70cf67a3de40dea4d5aba4284f0fd77926636f73c778bfea595561edd27e34fd9126b6f36822c7a14e6604f2fa8d71c
SSDEEP 768:i/UxvxjgC+c34HPQ/gm1VXwLyDmGA5b65Q92RQMPbGkPFQ:nZj3+c3+SAF65dQJkFQ
TLSH
T1D703C036ECA4ADB35CBA62C0364B7347AFB84463D1C955A44DE96F0E06C76DD430B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 81141e062a85a769f60eddd8ba4464a64322893e7b2403ebf19d7a9afe5437e3
MD5 7ecf5d9ab6ace325d3df6223e8115286
SHA1 abb32a92849ac75410f016a8a79bc5be3443a3fa
SHA512 8fd7c678b35947e79b8cea3c7563ce5cf382875c32949da2ed19df857fa07f7e66aefa441d6d37c56865e2f35e545dfd50849f2bdcd222f3af85f6197242c7ab
SSDEEP 768:Np37HPY/gm1VXwLyDmGA5b65Q92RQMPbGKSa7dLKk4M:Np3pSAF65dQJKWM
TLSH
T1B4F2BF72ECA0DEF35CB9A2C03547B2066FB88163D5CD869099ED6F0E05D79DA431B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ed28bf5ab460f70c464a069c6c817260f37f7a20d7d51a7c079d78067768edd8
MD5 e8235284ac221c5a93daad36414ff1b7
SHA1 8dc5fb8bc150bb20faf8c4fe733c3e9ea9a93c00
SHA512 788b4d5cd8b81de9ab2a64cfba1e5e19bf9705a436632dae0bfe056bb9b34f4828b428bd82a767425de9c95ba763d63448afae16f2a87d4fb4901104089812bf
SSDEEP 768:ip34HPY/gm1VXwLyDmGA5b65Q92RQMPbGKSa7dLKk4M:ip3wSAF65dQJKWM
TLSH
T1F1F2BF72ECA0DEF35CB992C03547B2066FB88163D5CD869099ED6F0E05D79DA431B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8b25bdad66b2614f912cae589815ec294e736e2e1211a20d174b24ffff40d513
MD5 35bdc96706ebe5c01d93b7cfccbbad77
SHA1 39ee251a1f87d8fbfce44ab16961e4b7e08a5e1c
SHA512 8c8e63dfaa8422adfc4c61f270cab3b074bd9f193c3205043f7e83bd5e2622185df006602bfb0d6dd7a48a6035886c19d26f1be3a6494fa8db3fe3809c8139ca
SSDEEP 768:vFQo3swg6HPC/gm1VXwCDmGA5b65Q92RQMPbGKSa7dLKk4M:yo3YAF65dQJKWM
TLSH
T165136BF29CD389B7D86D5383677E6E066EBCC063B4889190B7D95A0DCD825BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3f67c6b23979fd10ed94fda2ed41a6ca630aadd86b3273069483b273a5809570
MD5 3e3ce44adf4459c3394dbcdb0f0c69ea
SHA1 bf65261ff66d2effc147e969686cd12b1355e32b
SHA512 ca84fb51a6f7bd267e7a862ab618cb6517cff5a73c013c7094837da5d3d8b92af45e75e8abae4464c52643e689fbea4fb0fe4ebd07a02ad57aaf5627968cee6a
SSDEEP 768:U/UxvxjgC+B382EMgm1VXYtDmGA5b65Q92RQMPb7Fj0O:BZj3+B3x43AF65dQoFQO
TLSH
T12403C036EC94AEB7DCF95280364BB35AAFB88463D0C556A049E96F1D06C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6ee63b1-76e2-4f42-8b75-225f4f9536b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6ee63b1-76e2-4f42-8b75-225f4f9536b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download