hxxps://217[.]60[.]103[.]56/sh

Analysis

user interaction
yes
max time kernel
898s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://217.60.103.56/sh
Sample260925-2jhfssaa69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{312AC55C-343A-4990-96E3-28E7FDB9C0DD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3060	2092	msedge.exe	87
PID 2092 wrote to memory of 2152	2092	msedge.exe	88
PID 2092 wrote to memory of 4164	2092	msedge.exe	89
PID 2092 wrote to memory of 2152	2092	msedge.exe	88
PID 2092 wrote to memory of 2152	2092	msedge.exe	88
PID 2092 wrote to memory of 740	2092	msedge.exe	90
PID 2092 wrote to memory of 740	2092	msedge.exe	90
PID 2092 wrote to memory of 4864	2092	msedge.exe	91
PID 2092 wrote to memory of 2288	2092	msedge.exe	92
PID 2092 wrote to memory of 4864	2092	msedge.exe	91
PID 2092 wrote to memory of 4864	2092	msedge.exe	91
PID 2092 wrote to memory of 2288	2092	msedge.exe	92
PID 2092 wrote to memory of 2288	2092	msedge.exe	92
PID 2092 wrote to memory of 908	2092	msedge.exe	94
PID 2092 wrote to memory of 1536	2092	msedge.exe	95
PID 2092 wrote to memory of 908	2092	msedge.exe	94
PID 2092 wrote to memory of 908	2092	msedge.exe	94
PID 2092 wrote to memory of 1536	2092	msedge.exe	95
PID 2092 wrote to memory of 1536	2092	msedge.exe	95
PID 2092 wrote to memory of 4804	2092	msedge.exe	103
PID 2092 wrote to memory of 4804	2092	msedge.exe	103
PID 2092 wrote to memory of 4852	2092	msedge.exe	104
PID 2092 wrote to memory of 4852	2092	msedge.exe	104
PID 2092 wrote to memory of 2508	2092	msedge.exe	106
PID 2092 wrote to memory of 4780	2092	msedge.exe	113
PID 2092 wrote to memory of 4780	2092	msedge.exe	113
PID 2092 wrote to memory of 4780	2092	msedge.exe	113
PID 2092 wrote to memory of 1728	2092	msedge.exe	114
PID 2092 wrote to memory of 1728	2092	msedge.exe	114
PID 2092 wrote to memory of 1728	2092	msedge.exe	114
PID 2092 wrote to memory of 4196	2092	msedge.exe	117
PID 2092 wrote to memory of 2428	2092	msedge.exe	118
PID 2092 wrote to memory of 2200	2092	msedge.exe	119
PID 2092 wrote to memory of 4660	2092	msedge.exe	120
PID 2092 wrote to memory of 4660	2092	msedge.exe	120
PID 2092 wrote to memory of 4660	2092	msedge.exe	120
PID 2092 wrote to memory of 2548	2092	msedge.exe	130
PID 2092 wrote to memory of 2548	2092	msedge.exe	130
PID 2092 wrote to memory of 3500	2092	msedge.exe	131
PID 2092 wrote to memory of 3500	2092	msedge.exe	131
PID 2092 wrote to memory of 3500	2092	msedge.exe	131
PID 2092 wrote to memory of 3840	2092	msedge.exe	136
PID 2092 wrote to memory of 3840	2092	msedge.exe	136
PID 2092 wrote to memory of 3840	2092	msedge.exe	136
PID 2092 wrote to memory of 4352	2092	msedge.exe	138
PID 2092 wrote to memory of 3396	2092	msedge.exe	139
PID 2092 wrote to memory of 3396	2092	msedge.exe	139
PID 2092 wrote to memory of 3396	2092	msedge.exe	139
PID 2092 wrote to memory of 4348	2092	msedge.exe	140
PID 2092 wrote to memory of 4348	2092	msedge.exe	140
PID 2092 wrote to memory of 1612	2092	msedge.exe	141
PID 2092 wrote to memory of 1612	2092	msedge.exe	141
PID 2092 wrote to memory of 3448	2092	msedge.exe	142
PID 2092 wrote to memory of 3448	2092	msedge.exe	142
PID 2092 wrote to memory of 4968	2092	msedge.exe	143
PID 2092 wrote to memory of 4968	2092	msedge.exe	143
PID 2092 wrote to memory of 1820	2092	msedge.exe	151
PID 2092 wrote to memory of 1820	2092	msedge.exe	151
PID 2092 wrote to memory of 1820	2092	msedge.exe	151
PID 2092 wrote to memory of 3512	2092	msedge.exe	153
PID 2092 wrote to memory of 3512	2092	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://217.60.103.56/sh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffce155c188,0x7ffce155c194,0x7ffce155c1a0
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7273032520660245817,2352829601817887544,262144 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,3843061871915498881,13107251639002761488,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,252683380404055045,2839760401667059555,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7566236854329868738,15157006998176353695,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4961615795827473562,15927723714142656372,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,2501154432155543629,7950098639609222407,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,10108374631047397539,1096249228398380892,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,14584290498459009559,15359839603519422949,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,4645800460032713157,14150703186354030264,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11868594581144364149,1702647525411605179,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11868594581144364149,1702647525411605179,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6212,i,1501871589428596722,17421907349633489286,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5784,i,15495549793981700670,5783391269779780843,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,12206752330833134620,7077720693948177611,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14206356218085221332,4581637543899002258,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,13265868758299788321,12569038632743021718,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4800,i,5629900625402777249,8815860794059607421,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,12196548040838078878,1041779586735387457,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5972,i,11582798405386721568,6870862577237233115,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3600,i,12962310896391633502,10475373819968882598,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4748,i,10384520677895300745,5967235364708672069,262144 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6128,i,2056766721296599730,2695240648881993698,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,9948797741774887689,18251050755281537078,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,2797374312855118418,3733569448690298583,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,12233827509526972246,17358287263469964478,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,10921260534345394100,8866266696842910765,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=1504,i,17908640686487125433,6793866337101003817,2097152 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,1792368458605168049,13097473509290480363,524288 --field-trial-handle=2292,i,333809520308974707,2455220752882411376,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ccca960a19ae9acce9be98a430113f4232a5d3d4846f4bd02a4fd482ecab0fd4
MD5 8c0e7f81a9ab50addbcf7408f52b927e
SHA1 6c04cf606190daabaf6a6950505709dfd840b4eb
SHA512 8784cba0573940401decbf35f8a53245aac238fe3abb3f351887d24736f47c3ebf3d217136800c6296048ca9e5531924383142fbf85b7ee033a621b3d9c4125d
TLSH
T158E0209C05D4C35EF3016C4BC1AC4B0CC2803B5B96CCEE551B008C44B185451B385561
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 33d340efc980f6b352ef5ce7ecf532f69ff69927db381f3787528306326f6532
MD5 d3b251874067d45fa53b62d1d41045cb
SHA1 32bd75ea9c52df67a188a78d99c4fbb2212ce3b4
SHA512 213860b01eb81bf5ba9b48187d25e8d33f131c5adcf9317669608e059499757be22372c7f8574b1450fe4ff6df12c5ffa1d943ff0d82632a8cfd112aae4770f4
TLSH
T1DFE0788C45D4C76D730864874165D70CC6803F0FD3CC6B7557048DC9714314472D5761
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cac7153e7a48277d74f0440f2f9033ab4608c7be81f4bcfbe0544ab5069cf743
MD5 fa569c4d270d571dcc4e4612270a3d86
SHA1 f4dceb89d44bc11938074960ed7e0145ad1cbde3
SHA512 d8f512ee7ba6bb956114f542ff26276175a7e06876615e1180e72ed352d175526910fa5b580bf254e201965256c73bbec913d8699c2f5172112fa13ff8812572
TLSH
T19FE020CC45CCC37DF704688752B4570CC3803F6B92CCAE571700CC497143544E6C1561
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68d04fb35dac98017ad63eabb3ed88120a194503e73f09af3c60540315dc1bd9
MD5 2623f45f0eddf41d10bdc58622d70534
SHA1 b0f4ed79c6db9aafad6eeaa39ae206183c9db2cc
SHA512 92aefdfadd9d5effe401071fda1efad1339f95458df57e5e7ed7ff7275533a0e3d860d021f95db4bc5648139dfab2a1b344f9db176f3bb1fdc975d09b9986392
TLSH
T1D76170F778ABA4D1F7A8A1BCAAD210D7B6B7749019673C0D1BB0DF79988E71850040D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59065f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59065f.TMP
Size 3KB
SHA256 d53998a29e9ee842e383a4881e781885d5f0fc37060d82905e1fbad457db49dd
MD5 cc1ed884784340746d09000d7002bf24
SHA1 30374186d48c76afaffd818278f038e43918ae21
SHA512 e7e617d4247a0a3d7010b65eacd83f797598fcc5febd642d3d2c2738e1074e2b22f79647eef0f49b6ec29b483c7a5ce1ec5f318eaee139c2b6bfe52150ab81c5
TLSH
T1166170F778ABA4D1F7A8A1BCAAD210D7B6B774A019673C0E1B74DF39988E7185004093
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 c7b8b5990273b338ac5cfe6499942087810cbf1766cd29b868202c581fd671f1
MD5 2b43a16ce52d7a9d2bc5fb927b34a7d3
SHA1 451ec67f5670bd01b4d59c42ae3f419078d4f9fa
SHA512 6b3e71340b845fdc643f0ca413aaaaabdb27513a7bbac6f9d4d8ee9efe7b0524b09443f30211fddb118cd8fdb8f447bce0e08612e06c570d64ee5672525cd3e2
TLSH
T1CD11BDF383E595AFC91116F09A28EE2BCE2D0506421C7C29C5D4EF27C3E3035E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 921fe6d63809447c8489b8a965e9ec1002f14bb4a98cec8fc604a0055ec3d090
MD5 a676f10c509244d8d4ade1c34d56b4b8
SHA1 3b212a962e28206a7dbde50ac738606d4d6921aa
SHA512 c8cce6b1a5f55772008731e8d68083c4d54059a1b7fa5a94d3142088b80e37c1c6b88f8841fd3778ea6982e837b417a6cd3f54058c0b77e619dfa277cfb5c0e9
TLSH
T175115BB3C3D585AE891116F0AA28EE2BDE2D0516422C7C5989D4EF2BD3E3475D10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e513f10338aaa6171dd55531619b98769ab540e19bfdcbf78021114597906871
MD5 ed58fb98d3fc48fad94f953aa4bdb58d
SHA1 2db434fb24fe263063853aeec27f8ae839b0a180
SHA512 33b0f431c9beb6125615b82d80aab0c169e76982abddd24cbf8e832460e0b5af592dcb3f7d41d209e3fe3690246b954e5aa6212594779a2abccf173163c7090e
SSDEEP 192:sxZxaR6W7/fos9wIdpJHW6+WNGYRP7e8IgrJ:sxZxa/7/fos9RJHbGmn9
TLSH
T19012B6566E28A47B8CCBD21DBA25BF53D6F95033A1911E48EAFC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bdd39beb70cc91bcee366b5232f197e0ce6819100812eef6d34c20843b9c665f
MD5 a14be5d4d7bf29c93d98d26fea96c51e
SHA1 6941bbe6925bffdbee8e6fe383101a76f36018cb
SHA512 2de90f193a14c10c32da9abe16d750ce58894c31084f11324a8c65fea13adf05b08541c16f3e2bee91a7dbb1b384c4423d12cd9b0c1d05241efcca32d2060498
SSDEEP 192:sxZxaR6W7/fosO5Idpe1HW6+WNGYRPpe8Ig5JJ:sxZxa/7/fosOS+HbGm5d
TLSH
T1FF22D7566E68687B8CDBE21DFB15BF13E6F9503390911E48AAFC861C05E6ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0604440001f032c78cb67057fd863895b7e31bf09c87096b0c9bc034306ea4af
MD5 dcbb2d87054afeace390adc3aa1e14c9
SHA1 cf17d170d520123f511f51793a17f94528f8ecf6
SHA512 084d48e55a412c47b77903c4ea577fd94c38919630a08f1f29282c2a6bdb33b893f4b19aeb9581e76379b21045e7be7587794585c063c40cf2bb3e0f5210c7e4
SSDEEP 192:sxZxaR6W7/fosO5Idpk1HW6+WNGYRP1e8Ig5JJ:sxZxa/7/fosOS8HbGmtd
TLSH
T19422C7566E68687B8CDBE21DFB15BF13E6F9503390911E48EAFC861C05E66CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3b7070587106b3bdd1461b90fad4be9fa92606afecc44ded29ad7e4b49c2a649
MD5 cdc69d707803f8f5a00bad422a6d86ed
SHA1 ae30feb3d3d86e0ebb67dab7b4ada0d2a84fb49e
SHA512 713ae835cc7dca7a016c96b01b5095c86ab0fb27f8a4a5ceb759e266fe074741be62be40aa6a0828cd0f16d87e72f5985ae49032a07ad05b629e63844e39ec26
SSDEEP 192:sxZxaR6W7/fosU5Idpk1HW6+WNGYRPRe8Ig5rJ:sxZxa/7/fosUS8HbGmRb
TLSH
T15322C6166E28A47B8CDBD21DFB25BF53E6F9503391911E48EAFC861C05EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e76eb06e38575faa2e3b651bd26c392d2de1eeba36891aa01b0511f267632c71
MD5 ed2882f3b7ac42e0bec3429c9c804878
SHA1 8d5cfcd17e1da21b24fd1525e6fd4fda987b1e61
SHA512 cdd7d6ff518f85fa5b9a9c567e48aec627f9837a70ae1c2fa1ac2cb9e8b826a9daa6f7a3f8c8cc9dcec48c2daeb9167899446c4ff7227e05ebb737cfdf357d35
SSDEEP 768:TfK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3grop+Oh:TfK9uzYWvcQWsu1ja0HL7Q3rp+Oh
TLSH
T11CC2F93F640CCB7E5FC01A9DDC5A6F972E9802D7A6588D4047FA984C02C77EE522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33ce4dfc327e425321ebda97317cfbe791d83851828a310ef897510112d19aac
MD5 8a212ab373cca355f313f3f5c66020c9
SHA1 b6e8e6035b8b10f3c57b739baa9ad47b89d5aa07
SHA512 19e56318d61c95ebb1e2dae047fc153f0b69372ede94017b479e82fafea23362217625f522fa98129747bb885e4a8bf09e2b6d0dcdbbbbce59a1f356beb79118
SSDEEP 96:K0mFzKKkcmbOPCugYY+uohlQO+K4LQE+MGOp0FjWK04D:XZbOPCugYYdoh+OOLQERGOp0EA
TLSH
T1CA91350072BB16413A7E245880B1971F528232F33058E62BBFBC54B15F6BE584DFE6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93d09a4d-32c0-4a37-a6aa-6438aad995f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\93d09a4d-32c0-4a37-a6aa-6438aad995f4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9b51f392f0ee875e01c7d095a76606c401e3f25d7acb9f5df8233735e73806ed
MD5 835c12b4772d31d424d02ec028fb56f4
SHA1 ec2712786cd4f68f1494a051a248ead969054706
SHA512 aa89a639087169cd7500b95f136155dee3ee1389c12ad9219243830b17038e66bd77205f339bb913e4b6280433209dd89ce46e756bc8ecf3491fcf3693267d04
SSDEEP 384:PZcIhsNmTwDZ3niDOjTV92OqG7YjTPtgOIwZOyqLEoG:HhmySnWO0jTPXsdIV
TLSH
T14C827D366C785DB76CFB9145F48A36038FB88077DA856B90D4EC6F0E05EA5A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 db1492af16b9f5264c5d834a964a4a7f0245f9e5ccc5cd9c870b60496bcd5949
MD5 4e507d874b5bda13ae3912a8905a4c46
SHA1 597ff0e4b13aa5e89aabc1159d8c269c15d1aa43
SHA512 d94145783e4f6cc17284a883d85b08429c70d5fc103d7ac2443b8f00b753bdbeacd75f8241350900ce411789ac66c10cf7f6e9c5358750b72e73526bcff09fe5
SSDEEP 384:EiFiZcI4zsNm8TUNTUlIl6wDZ3niDOjTV92OqG7Yj1PtgOIwZOyqLEoG:fFQEzwgzySnWO0j1PXsdIV
TLSH
T17FA25C375CA49D7BADFA9645F54A32038FB840B7C985AB90E6DC5F0D01DB5D8130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f637aaa63a11bebfa6889f7d224dc109018cdd125d39b566fc88677e56e4e838
MD5 a17b016c199f5873b09897c3bb5d2fc7
SHA1 ace7ec734818283a3f85635f5c2417177e2e7719
SHA512 e9b46aeb4563f511fea845164e6e02b2509c991a6b218e9f28c79de313637e15ad9dc0fea90b364642e8d1ef122e07867fbdd9affdc8f704f17f762a03232dc6
SSDEEP 192:SON66ygpQmiUyv2tOCTVg+2OqR0BzPVNU6:SON66lH/tOCTV92OqGN/U6
TLSH
T1B402D634AC686CB78EF3AE06F48B36139FE8117BE9512B84DAD81E1C01D765C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e01e44e03ee21f1098070dded917b39a4cae0c6b8861d81319d5e28a4392afd0
MD5 23aad757c3f55b42fa2c913ed391f8bd
SHA1 de7242e3d90add6c39c9b2b45ef70016b4f38fe1
SHA512 7e356fcb8e03707035f1b90ccd20c4758feb7050201ace056cdf367cba94d9062463eebf8b661957252688ade705336f0c6f94354b0acabc82d5e6afe33a19e2
SSDEEP 384:VZcIhsNm6wDZ3niDOjTV92OqG7YjTPtgOIwZOyqLEoG:thnySnWO0jTPXsdIV
TLSH
T1E9827D366C785DB76CFB9145F48A36038FB88077DA856B90D4EC5F0E05EA9A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e081198ab09bd6fa00ce1ca53921c1385a73d04e5d8fff7b39cbc138cc8f464
MD5 d4c4045de61acf4c1c601d3fab25622a
SHA1 623cd7b5a24c5ea15a22002043f33577c8ab7fd2
SHA512 46efb0ea18806075f8f6838d4d5258d1aa3021ed97e3e801ec1c27c17fce89aa9077245f2fcf10d23bd074ce218752b3b1b62daba3d350c7eafc97935693a38b
SSDEEP 192:SONf6yyQmiUyvL2ROCTVg+2OqR07Yjpo3U1/VU6:SONf65tROCTV92OqG7YjLPU6
TLSH
T18D121835B8786C775DE6A545F48B32139EA88167DE463F90D5DC2F1C01EF6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd7fe662-edd5-4999-82f4-e6e01f3edd3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd7fe662-edd5-4999-82f4-e6e01f3edd3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1dcfc6605363e5da5e44c4abfeb74d72d150ff09f175a8b0a80605f767a5a126
MD5 39edf4d3592ffc836489a4d73ca2d4b1
SHA1 647cf3f8d609aff1d0cbb29b29b9a8e9b3bbef1f
SHA512 f9e9af0bcd2e903d3084a03c40d2070ede63a35a896ebb816da208b5d8af3cb91b01111534b03748afea837a29efa8b3383ac2dc5bc6f01bb9ca54af6ae42543
TLSH
T110413B58AAEA1148B3B67E0BABF6A86D487B7D372E0AD45D10110E4F4627A00CD71733
MD5 SHA1 SHA512 TLSH

Submit Download