hxxp://accounts[.]google[.]com

Analysis

max time kernel
899s
max time network
897s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://accounts.google.com
Sample260925-w9vadstfle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{608CF0C8-162D-4B80-A680-828E0DBD2FCA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{0AA086D3-5211-49CA-816F-215AB917ED10}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 3200	3132	msedge.exe	90
PID 3132 wrote to memory of 3620	3132	msedge.exe	91
PID 3132 wrote to memory of 4804	3132	msedge.exe	92
PID 3132 wrote to memory of 3620	3132	msedge.exe	91
PID 3132 wrote to memory of 3620	3132	msedge.exe	91
PID 3132 wrote to memory of 3656	3132	msedge.exe	93
PID 3132 wrote to memory of 3656	3132	msedge.exe	93
PID 3132 wrote to memory of 3544	3132	msedge.exe	95
PID 3132 wrote to memory of 4772	3132	msedge.exe	96
PID 3132 wrote to memory of 3544	3132	msedge.exe	95
PID 3132 wrote to memory of 3544	3132	msedge.exe	95
PID 3132 wrote to memory of 4772	3132	msedge.exe	96
PID 3132 wrote to memory of 4772	3132	msedge.exe	96
PID 3132 wrote to memory of 1168	3132	msedge.exe	97
PID 3132 wrote to memory of 2112	3132	msedge.exe	98
PID 3132 wrote to memory of 1168	3132	msedge.exe	97
PID 3132 wrote to memory of 1168	3132	msedge.exe	97
PID 3132 wrote to memory of 2112	3132	msedge.exe	98
PID 3132 wrote to memory of 2112	3132	msedge.exe	98
PID 3132 wrote to memory of 3468	3132	msedge.exe	99
PID 3132 wrote to memory of 3468	3132	msedge.exe	99
PID 3132 wrote to memory of 3468	3132	msedge.exe	99
PID 3132 wrote to memory of 5104	3132	msedge.exe	104
PID 3132 wrote to memory of 6028	3132	msedge.exe	105
PID 3132 wrote to memory of 5468	3132	msedge.exe	106
PID 3132 wrote to memory of 4276	3132	msedge.exe	107
PID 3132 wrote to memory of 3920	3132	msedge.exe	108
PID 3132 wrote to memory of 6028	3132	msedge.exe	105
PID 3132 wrote to memory of 6028	3132	msedge.exe	105
PID 3132 wrote to memory of 6024	3132	msedge.exe	109
PID 3132 wrote to memory of 5468	3132	msedge.exe	106
PID 3132 wrote to memory of 4276	3132	msedge.exe	107
PID 3132 wrote to memory of 6024	3132	msedge.exe	109
PID 3132 wrote to memory of 4092	3132	msedge.exe	113
PID 3132 wrote to memory of 944	3132	msedge.exe	114
PID 3132 wrote to memory of 5944	3132	msedge.exe	115
PID 3132 wrote to memory of 5752	3132	msedge.exe	116
PID 3132 wrote to memory of 5752	3132	msedge.exe	116
PID 3132 wrote to memory of 2788	3132	msedge.exe	118
PID 3132 wrote to memory of 4136	3132	msedge.exe	119
PID 3132 wrote to memory of 4136	3132	msedge.exe	119
PID 3132 wrote to memory of 4116	3132	msedge.exe	120
PID 3132 wrote to memory of 4116	3132	msedge.exe	120
PID 3132 wrote to memory of 2896	3132	msedge.exe	121
PID 3132 wrote to memory of 2896	3132	msedge.exe	121
PID 3132 wrote to memory of 5036	3132	msedge.exe	122
PID 3132 wrote to memory of 5036	3132	msedge.exe	122
PID 3132 wrote to memory of 5968	3132	msedge.exe	123
PID 3132 wrote to memory of 5968	3132	msedge.exe	123
PID 3132 wrote to memory of 2592	3132	msedge.exe	130
PID 3132 wrote to memory of 2592	3132	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://accounts.google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff84b13c188,0x7ff84b13c194,0x7ff84b13c1a0
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,9482073885953158013,1819191606552109011,262144 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,8419901572200203735,7889559984577434338,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,18035816564278744233,11242694880131298146,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,13979656124429694042,13428614839455412720,2097152 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,8723661590626475043,18299229478731172039,2097152 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2851566253414400278,8062226550427981831,2097152 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,10518724648165856965,15319755027341056390,2097152 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5372,i,13267431982947337795,563544424771595419,2097152 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3420040875876111117,12296083811913723445,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3420040875876111117,12296083811913723445,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5492,i,1827129243305689431,14098042426526748434,2097152 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,3061808049475345461,14093315205563825930,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,12868213263427142734,16557912510521362768,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9009838722518225917,15123417417601489505,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,17216854657632823580,6194897466752640690,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:12
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,13775069403825166089,15155165047301654566,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,5965755421318268657,18231492546223575381,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,1417772556591205602,7865141405860839549,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,1945369094223488745,14118412547535846554,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,16392562679707631202,1615255518466933948,262144 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12814847639701488533,464245053709693647,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,9814318023156570144,13633982546022447211,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11225243296333515574,11554018744514822532,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,7185144894738088775,3967222572649207423,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14720413924167989251,1253754345065252890,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,880411393718105399,14757666506267912659,524288 --field-trial-handle=2320,i,15469410750871200967,6152371967338858219,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3056

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b7964f441ec93564c348a2bcc419848aeb682bc7bacf17525c7b1e3ba4536924
MD5 f9b2ea8ce1a42739bb421edb3647019f
SHA1 def4502bc287d70c51ccba0dc4686e32faa67434
SHA512 392527d42614d35a60a0dea010c4a06957af7ef1cb4919dc00ad9683600447cb7694f87f77a9442f866e3e41fd098397cd7096be04da49cfc6368e06988bc634
TLSH
T1FCE026C804C8C2AEE341648B416C5B4CC3C0370A93CCAE4A7F01CDB47085040BAC27A9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a42426de238ffd9d58bca711fb339da8a609e7080f07c05c3768c01bee91d612
MD5 2df957091460c1ba233dee207e28ac85
SHA1 5e17515fa2e6f56cc6a54ade141b5f83bc73669a
SHA512 01b9a33ca2be6dd1047386996799ecb665cb11147a08c3b003ce73c148454158f751dd0b93557cc411f33eca899ec3372718876079779acaed649a9dcb7e6996
TLSH
T19CE0CDEC07CDC2AEB314658742FDAB8D8390371AD6CCAF4A2704D9C4B142555FED6791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 93562fc53378cb9423f7b706e0fb503dfb9a7b088213f63eb9a957542f00d641
MD5 c1f567c99c5bd0b73a2407a9a8b83fea
SHA1 067a81f9611901523b7017dd6b068a358b4acf7b
SHA512 ed163e6fd36a370c6f1f1a91b2f0b07afa0a959db5ecdd229590aa48cd0f161d774df42b885ef5775b17bfe0307f090c73860784f20435c8eed8f46af3ae45ce
TLSH
T130E026C806DCC26EA3506487427C570CC380B70FD3CD6E4A5B009DE7B04A040B2D2791
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 061cc4ee22efb8496cf64dff33f58802511b7bf776fa02edab49bc870f4e4c33
MD5 63f82519fef89220eba8fed4e83ec565
SHA1 bd3362912a2679324923fb6f9ad119a7eeda7744
SHA512 e740cb9794e38f815638a2d3b6d9e2531c90dce543b646aa4044bb0c9feb21d432aab9c091e440a0d4cec3e31b3e256d477c954034119ffcb682eadf40e161ad
TLSH
T15661A70D39EC40D6FB44103249D39E4B36FB89AEE9831F21494ECAB7DA433B752615E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cab9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cab9.TMP
Size 2KB
SHA256 f0751313ad5fdd07db107629bbf54589a0e7e8b358dd923b04e7d3b90e0f2578
MD5 4a8b07d4d4d22af98021e96506728029
SHA1 0e2a8e4655504030299c520f94fddf993ba894a0
SHA512 76c16e420a92e59aebb224a32cdafe8813e55946369c711181d03b3c2258207c8b6b5c442d7cf8c4eb04cb2263b7a4ec9977d39af3564d7ddbb3748b35b030bf
TLSH
T14C51864D3AEC40C6F744003149D39E4B32BB89AEA9831F21498DCEB7DE433B752A55E2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 df8dc0126c89539589de464e7be85a145c3db1f72fef2734482c5696f6b93dac
MD5 9b7b2d6c43230baa3adb1518fe91c569
SHA1 912d311d0873f738983b6684acbc32042a368157
SHA512 b4ce8034a261a3fa92db352318d4896aa5fac44b6cfd080c1eb411723a5a08038bb0312bb68b1c004901828ed7674567c3ee2e43ff405a1721ad0339fe7c86ac
SSDEEP 96:D/ORZwO6s9aXFizBuu2O0BZNIwsGj4/cR:DWRZwO6s9aXFi1uurQZNIdGj4kR
TLSH
T1548199F7C3E4822DD91196F4AB15AF2FCE2D0524432C3C6A89D4AE27D3E2472E141B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b3f05eda2a8d5056446ea9cb0f5ae914aee0f71d0b9019e95410f49947e18dab
MD5 b6eca9b212967cd2274c2ec91cb4dd2b
SHA1 e288292daf3ce22d0fc3727378fa7f7bdbee3d21
SHA512 631bcd1a342cb8c688142e041901f08759c837655c9fdade33973cbd9adcf33c6b9df9d2918531ce1a0d976ea2b5d94bcf59d1e15e43f94f7d81dac1233604ae
SSDEEP 48:YALlNbOhBnhjhbthzhkAs1aCZsTfoKsKgmzsXzEsouCIs062O0EsgCKs8csU4stl:DlOn1Rt1+9aXFAzsuu2O0cHItIw9R
TLSH
T1E0917EF7C3E9C62DC91156F4AB15AF1ECE1D0A14432C3C6AC8E8AE5B93E2471E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9b5dd841321da80a1df3bdce02ef2252951ae6112909db520ebe6a0b5a668873
MD5 926484ba71149d2b762244e22142b282
SHA1 2ba716dc83f2b3a67480214a8e51af8913349345
SHA512 23016f4abfa7f886cfcb3174d62ebab2514eb9a26f8298049d94899b178fe08891fa32462255e8455e68285c233f893307f234f6cfd85db4aed21b8d89e5edc5
SSDEEP 192:sxR/aRUb3/fKksm6KkzoA8pWpX/g6+WNk4X/Yof++GZ2IgDyJ:sxR/ak3/fKksmbFm/57/izOq
TLSH
T1F632B75AAD38A97B4CCBD219FA55BF93E2FD503365951F08A6FC861C04E76CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a38849f92629b26885a7240e74d384962a46601832c8e075e73f344b112c95ea
MD5 5658a67f0af3d996abfd9565f668ade0
SHA1 a2af7aa200d6df0115e4242c8af7537897aaa87c
SHA512 126c735b17789772bcc3a6fc0e062322ec6e3775c80db6c675d0d30ce7eba3c715c569a663deb0df25d5674e374967c6f17f6ad4e646c35b3fa574c3f1d8638c
SSDEEP 192:sxR6aRUb3/fKksc6ykzoA8pWpX/g6+WNk4X/YoN++GZ2IgIJ:sxR6ak3/fKkscjFm/57/ozOs
TLSH
T13D32A61AAE28A97B8CCBD219FB55BF53D2FD1033A5951F08A6FC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6ee7bbe0a9dec2105cbbb2e80b9a6defb8bf9d09b3654d6f09081ba7bd874b39
MD5 d50d4492b6dc1f8716a9bf8347ef8677
SHA1 0baca195193c33fbb9388b6fc79a4650d625c509
SHA512 6a36ee1dfff16b820b14dbe3048b3353a59b0ad0eec2b738bde3fb79fa349a36df4be4f35fb528cd069dc3562ced6c08b35bd7fbf41e0f728599a725fadeb3b0
SSDEEP 192:sxR/aRUb3/fKksm6ykzoA8pWpX/g6+WNk4X/YoN++GZ2IgDQJ:sxR/ak3/fKksmjFm/57/ozOg
TLSH
T19F32A61AAE38A97B4CCBD219FB55BF93D2FD1032A5951F48A6FC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 2df32ed63179939aaae7ab30f381845a2b610d0a683e5e73b0926ff5881765fe
MD5 8e3075ad53a6d4de97ccf33d3de4e600
SHA1 aebfba416949f3a1c7de34c614e63a662e239a9c
SHA512 16977de88c22ba7f6182aa217d3ef6ff9653deb1b753742108909eade3e5100773c5970cfade0e045de7cde6b40aa8b9821c9a09d2a2eb13e069a6b8db153793
SSDEEP 384:sxR/ak3/fKksme66s8qMpRiYnazAW8pZS15posJWeT+DFI/57/izOq:sjak3/fKl4Mnc7WeT+DC/5Diz/
TLSH
T137C2F8099924D83B9EC39D18A93D7E33DAEC506222C5DFDA56ECCA1C01DE1F9AB07417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2a2c1ac892edb5d4825065f9ee16adcf829095fd41c96f392dfdedc594f62186
MD5 7268421c81e4a52b2ac4c86b30584aad
SHA1 cbfe82864612ea306ea20767078b6d40ff203d99
SHA512 b0e461eb3bf3244b45256f01da32a9ef287c51e0b843e53e2b9875492dbbdd9685179c28a37f8d13eb8db8dcc551111e07b1bba155c7cbc1eca3b6e74d6afce5
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUHrondV:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0V2
TLSH
T140B2EA2B704DCB7E4FC04A9D9C196FDB6D9802C796588D8047FAD94C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5f1cc2e-4994-43f6-baa3-c1a07a749541\index-dir\the-real-index
Size 216B
SHA256 950a0abb69303b8089fd4e819a1dd07f38c0bbd5bda5522509f14f8f3c31dc59
MD5 45c88798ea5166e9eb5c21affefbed5f
SHA1 75379a34c03fc3d7ab5f90696f478dcf41977c64
SHA512 52f18087ece6efbc7dbbccfd3cb153cf41a5ec1fee53213d40a218425c53a1aad2b6f683629ad3df23a5229b23f7d4868b8546ce0e79148fb094c224b6b03538
TLSH
T144D08CED9D52A205FC90B5B024BB74690A2136DDD605BA2B84FCA22CCC826E0FA03258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5de8dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5f1cc2e-4994-43f6-baa3-c1a07a749541\index-dir\the-real-index~RFe5de8dc.TMP
Size 216B
SHA256 8afa32e8e29021ad37f734e5916cdbc6a9ebd3aa745a6cf2f32faf1915b7aeb0
MD5 8cfd956da053f556de5865744396e099
SHA1 fae1efb79cf2ebd906aa194a391986cff3799a5a
SHA512 ce1f8e92c2d8938e9386e51c75eae82b9bb8f4a0ec55ea5ac7162db33442868ecdf4dd9629756ba5896e1d6c3bd92da007b4de5b01b4e4487df119a54987f183
TLSH
T16DD08C9888229200F8B0A1B028BB71750A202908D505BB2B85F9A0589CD25A0EE47348
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3ca2adaa8c065e973b78e3be1dd3117d61a032c9fe6c96957ebc0df8f46e8c93
MD5 ba91649077e6f1eb68e46718977c3519
SHA1 f5b9ee26883e478a36226799b9085520bca472ab
SHA512 8e4e8fd80c0612d5bac6569dcf6788630af056b67dd3b4e53be6429a50774b229bed36b0d6ff012c7e8dc859ec379bded96dd787c3bc0e2ff25d3a80b0f9e4b7
TLSH
T1A9E0C07B3DE77C10EC5FD7E628328CA4110074C8DA80AC4F103AA9C764723203449D71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7ffc7e68f919756d5a963890c1cde81c8b4f85c5f09cf75249059f4bcbaa7c63
MD5 78e4cb53a053fc7cf4590452de625bf1
SHA1 0abd2d53994f91d836d9be770e5999ce018aa175
SHA512 6821178354f05b68194562a7c11c23a696c7b9c8933776120e8b9ead5b0f743f39e319fa2f346b907e4f901aefb7b4f5c89c4988528f93ffc024ec8d3f74085c
SSDEEP 96:KHa1G6gYI2yYz9I62KwTI82MCabsanq+gKrytITcoGm7J2KS4Cg:85PuITcoGmyZg
TLSH
T134915EA9717F1624383D3909A1E5A65B474237A33168EA3B37E900B25E67E140CFDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dfa9cc91-2547-44d8-89b2-0c24a6e80f5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dfa9cc91-2547-44d8-89b2-0c24a6e80f5a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ddeeeb95577a614eca01abb3a9e4747e6513111b795af25a2a8bad95401eac70
MD5 1753246df22f2b29eba2c89e8214b7cc
SHA1 24b39d1ec112a780ed65de0fd8ab4bcc1ea53215
SHA512 8da27198a45f6b4e6c75583db6f8985c0efa23e6b76fc1b53701b142f16437aafa8c976efedeac0cff9bcfcc4765b4e2d61a542f2c251b19d43fba13ea0d3392
SSDEEP 768:k/UxvxjgC+/38D5mOuwwL/9OA9at01j0iq00+Iaix2sFa:RZj3+/38HCHq00NaW2sFa
TLSH
T17113B036ACA59D739CF7A244B20A63C39FF40923C5C9AAD449FD2E0E05476AD130BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 77f4240cf58ced866d7bbbddca9bdbaed157a1c1eadaf7d17ed7b8afd9155fef
MD5 812f27aa9130a37f871f37b84b517226
SHA1 8ca208946007fc8669448eaa9fc1170805ad9bd9
SHA512 92cf61aec9c32760c9bb7ca17bd7ad185d93a4141782e5a811ebdfdee4bea10f73f7bbf2f5543b7b378e3f9cce856a678f16babaa9b0caa5600a6d196cba0b3d
SSDEEP 768:4FQL32wgID6mmOuwwV/9OA9at01j0iq00+Iaix2sjF:bL35fCHq00NaW2sjF
TLSH
T1B6134AF298E38977D8AE9747A33D2E415EBCC113F5889680B7D9190DCC461BFD207866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cf146b7258d0bcdcf2f2f841b48ba45a404117121b553cabb633f324f2bc6bd8
MD5 9f9c7a3ea961319b3f75546875ed8083
SHA1 8389f4df008451a07dbe68292210362b9def8183
SHA512 5cc0460c6ed745be71362415531cf1dbace2265736fa2e49747dae6d77e6a57effd58db888f73cfe00c10051c0f0f0b4c174de6c43966cfb7b5f38d03fe9e011
SSDEEP 768:6e37DzmOuwwl/9OA9at01j0iq00+Iaix2sjF:6e3/hCHq00NaW2sjF
TLSH
T162F2AF71ECB59E73ACE6E284B20677825FF44517C6CD9BC085ED2A0E00576AE170BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 10f0c8801ce8a11d24e3658a5754332cd89deee980249dcca1016cc38bc56a6f
MD5 f0d0b101b31a2fdee00a711df4062d6c
SHA1 063610df34be7db18c3e8b7cfda2032dfdd93ac8
SHA512 557f42583506c18b7458c35d65c83df92a4258c5d9972144fba8647d3ab1b44571d911a08635624acf5e57658c8eb6a1c5e6c3ed0b5d7fb0d12d9da34dd1912d
SSDEEP 768:Me38DzmOuwwl/9OA9at01j0iq00+Iaix2sjF:Me38hCHq00NaW2sjF
TLSH
T182F2AF71ECB59E73ACE6E284B20667825FF44517C6CD9BC089ED2A0E00576EE130BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 becb31c4674dc48528e7e9c1f7ba10093d93dae44fe81bfcdb9e5cc16a540a33
MD5 3762272efdbf577db8864871012461a7
SHA1 626814fdbe629e25c6eae2217962b74dc7949b4b
SHA512 0d6ad09d80b13905a704b5adebc354e1b6f2d89c5fd248c8281e94320b11c1767283f7734bf00fd9dede196ace4df88043b32a84ee28f86b35c2103519e0dc62
SSDEEP 768:X/UxvxjgC+H3FAHOuwz/9OA9at01j0iq00+Ia2GdSHxRz:KZj3+H3FcCHq00NaFdSTz
TLSH
T15303C031ECA59D739CF2B384730A63879FF84663C6C966A049ED2E0E05876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c396f43-322b-4208-a432-0d57ca08dd5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4c396f43-322b-4208-a432-0d57ca08dd5a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download