hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
899s
max time network
860s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260925-wngr6sgc95

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\D:\	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4128	msedge.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 43 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4976"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134336237447665223"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8071"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3562044790-535044693-348086427-1000\{74E92A5B-BD10-4A8F-BD40-217C3E386A35}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3562044790-535044693-348086427-1000\{BA587E8B-9906-4539-8607-5E1DC8C2F70F}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea070900420068006700790062006200780020007600660020007000790062006600760061007400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000075f9371d1b42dd01e28a87cf1b42dd01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070900420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000024c9c0fb1842dd0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8b	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4976"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8b = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
3060	explorer.exe
3060	explorer.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3060	explorer.exe
2976	SearchHost.exe
2140	StartMenuExperienceHost.exe
3060	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3928	1224	msedge.exe	80
PID 1224 wrote to memory of 4128	1224	msedge.exe	81
PID 1224 wrote to memory of 3792	1224	msedge.exe	84
PID 1224 wrote to memory of 3792	1224	msedge.exe	84
PID 1224 wrote to memory of 2892	1224	msedge.exe	82
PID 1224 wrote to memory of 2892	1224	msedge.exe	82
PID 1224 wrote to memory of 2892	1224	msedge.exe	82
PID 1224 wrote to memory of 4948	1224	msedge.exe	86
PID 1224 wrote to memory of 4948	1224	msedge.exe	86
PID 1224 wrote to memory of 4948	1224	msedge.exe	86
PID 1224 wrote to memory of 2772	1224	msedge.exe	85
PID 1224 wrote to memory of 2772	1224	msedge.exe	85
PID 1224 wrote to memory of 2772	1224	msedge.exe	85
PID 1224 wrote to memory of 2976	1224	msedge.exe	87
PID 1224 wrote to memory of 4756	1224	msedge.exe	88
PID 1224 wrote to memory of 468	1224	msedge.exe	89
PID 1224 wrote to memory of 3904	1224	msedge.exe	90
PID 1224 wrote to memory of 2976	1224	msedge.exe	87
PID 1224 wrote to memory of 2976	1224	msedge.exe	87
PID 1224 wrote to memory of 4756	1224	msedge.exe	88
PID 1224 wrote to memory of 4756	1224	msedge.exe	88
PID 1224 wrote to memory of 468	1224	msedge.exe	89
PID 1224 wrote to memory of 468	1224	msedge.exe	89
PID 1224 wrote to memory of 3904	1224	msedge.exe	90
PID 1224 wrote to memory of 3904	1224	msedge.exe	90
PID 1224 wrote to memory of 2968	1224	msedge.exe	92
PID 1224 wrote to memory of 2968	1224	msedge.exe	92
PID 1224 wrote to memory of 2968	1224	msedge.exe	92
PID 1224 wrote to memory of 4688	1224	msedge.exe	94
PID 1224 wrote to memory of 3656	1224	msedge.exe	95
PID 1224 wrote to memory of 4688	1224	msedge.exe	94
PID 1224 wrote to memory of 3656	1224	msedge.exe	95
PID 1224 wrote to memory of 3464	1224	msedge.exe	96
PID 1224 wrote to memory of 4108	1224	msedge.exe	98
PID 3464 wrote to memory of 2068	3464	msedge.exe	99
PID 1224 wrote to memory of 336	1224	msedge.exe	100
PID 1224 wrote to memory of 336	1224	msedge.exe	100
PID 1224 wrote to memory of 2244	1224	msedge.exe	101
PID 1224 wrote to memory of 2244	1224	msedge.exe	101
PID 1224 wrote to memory of 2244	1224	msedge.exe	101
PID 1224 wrote to memory of 1880	1224	msedge.exe	102
PID 1224 wrote to memory of 1880	1224	msedge.exe	102
PID 1224 wrote to memory of 1880	1224	msedge.exe	102
PID 1224 wrote to memory of 4000	1224	msedge.exe	103
PID 1224 wrote to memory of 4000	1224	msedge.exe	103
PID 1224 wrote to memory of 4000	1224	msedge.exe	103
PID 1224 wrote to memory of 2260	1224	msedge.exe	104
PID 1224 wrote to memory of 2260	1224	msedge.exe	104
PID 1224 wrote to memory of 2260	1224	msedge.exe	104
PID 1224 wrote to memory of 3752	1224	msedge.exe	105
PID 1224 wrote to memory of 3752	1224	msedge.exe	105
PID 1224 wrote to memory of 3752	1224	msedge.exe	105
PID 1224 wrote to memory of 1572	1224	msedge.exe	106
PID 1224 wrote to memory of 1572	1224	msedge.exe	106
PID 1224 wrote to memory of 1572	1224	msedge.exe	106
PID 1224 wrote to memory of 3628	1224	msedge.exe	107
PID 1224 wrote to memory of 3628	1224	msedge.exe	107
PID 1224 wrote to memory of 3628	1224	msedge.exe	107
PID 1224 wrote to memory of 3184	1224	msedge.exe	108
PID 1224 wrote to memory of 1604	1224	msedge.exe	109
PID 1224 wrote to memory of 4108	1224	msedge.exe	110
PID 1224 wrote to memory of 4060	1224	msedge.exe	111
PID 1224 wrote to memory of 4060	1224	msedge.exe	111
PID 1224 wrote to memory of 4060	1224	msedge.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd86a9c188,0x7ffd86a9c194,0x7ffd86a9c1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,5959227877368769950,4243759685023541689,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,3127816873364081375,18208673953819999890,262144 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,7239347115276416290,4151223943811285087,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,17236491037444472992,12685283427246443728,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,2626421479389881207,7896569861730473424,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4144,i,6943623006001600594,12258155451804749174,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:9
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4060,i,14329490674490323262,8774744783907742577,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:9
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4088,i,3427256245811138562,12063569135350749185,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3972,i,6982533154465377179,2612049588170508740,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3756,i,10716792928769153552,17002037036737711928,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,13940588807775689603,16151913616890786528,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,16685693620611906644,1132437689608617251,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14636128573629975644,3299266034451209931,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15002561023616695826,11158504914285379702,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15002561023616695826,11158504914285379702,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,10325097381022136618,13092071069706686640,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6712,i,2940192902977690277,16940504643550194929,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4292,i,17469734125786305356,16527722154746059370,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7016,i,1904692573836909908,3080529395578328643,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7060,i,16584982793579153667,17892480449523120069,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7156,i,8044664851897637934,12474674142761721792,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7248,i,12430174063074231140,12368904301890357734,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4744,i,13586261293394965907,15860899728490650220,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,15469245361248979382,5958737594973044364,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,4775029374762864116,11258276680635042329,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:14
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,8989426706160298127,1058602505002602263,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4620,i,10253676446645479407,11654879867280115264,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=1920,i,5667159892071496418,5728139320269325454,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5492,i,10109067245916548296,6954083152065851996,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7832,i,3352518671058914000,14596847716118503884,2097152 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8296,i,8706744437802546740,2403727547289868394,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:12
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8492,i,16644371721781081303,12112715174603224360,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5724,i,7200781979193901915,7999830567465350698,262144 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8390896157803356484,2844428428533549668,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,11100792989020700418,15561265460247390572,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,10175215148757105754,17805567594682645842,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,1900371528721882963,11550610123775859661,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,87374529106405312,13740982127467013055,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8708,i,10514296196346753038,5997702621958571000,524288 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2564,i,17838044057027915591,12953439969044953255,262144 --field-trial-handle=2600,i,10614951621487722987,17942938114141737202,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:2
  2⤵
  PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2440

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2752
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3060

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 72d46989a95bf72ba8dd6bd7c103ed98f260bc4cd752291ffe0fe22ebe19ab9f
MD5 60b4b0010bde0a90da634b59e1cb3907
SHA1 cc222b898cc2c0a26787374e6d4beb3f730138c1
SHA512 fd728fee89e141a7515870d1f29e536b5420651941b86a563f1295b15306d28e8bce82285f7940c352d628f7ed9d42f20d2edad22cbf26376d8f5602ca287a88
SSDEEP 12:sf9iXhV0xosfxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxosfxWMk8xVTeYWI31BtXP
TLSH
T136254C85B34494FFC8835E7189BD27903774F6DF1F02966B6A77760E2E271C84B44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e2471da-4877-4db3-ad0e-accd9d502718.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7e2471da-4877-4db3-ad0e-accd9d502718.dmp
Size 6.3MB
SHA256 4f1fe26f305b52f06a12a091057afebce910841d50a76e0672bfc79483baac31
MD5 a6f29095a0b49e74ab4a66061ad95888
SHA1 fdab655edd3b92986ccb5e2db315b5a79c02c31e
SHA512 a4d4ee23b9cadfab694fbb081e726a9a83e11153ae19b9578d3a027d21e29e479b15ae16861255da0cb802fbe81e9562feee2edd388fe8bb4b31ab9fc883e52f
SSDEEP 24576:cmOgSi80e9Rb7Tm4u8CnNe4hbOPxTPNNZ16pUmS7Fg0+JZCwTUZMp+ggf4NvzAK+:Pb8r37UnNPixOxSlwTxFcf
TLSH
T10D66D569F3424A46F40B427189E7B755E7F7ECD18A829F63310173682CBF68CAF16984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eec2c66-46f0-4424-81f0-0da82e49b89f.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\8eec2c66-46f0-4424-81f0-0da82e49b89f.dmp
Size 6.9MB
SHA256 a29b7d9b832a8f4ed62a16f09449a134de223e782a3163bed2285146af1a41b2
MD5 897e1d98b688448cf2561b74f9af36e4
SHA1 a372044ced05f6e3ef51280ce48c314ab798faed
SHA512 4bca2a73188167d01982764c372fb7983ac0ae0a658f8ac4e04926eb13fcb34955d690454abe10a2c52b1ee70e4645e5cc05088b3cb60da75225324fda5c5736
SSDEEP 24576:1LOODi80e9Rb7Tm4u8CnYeeFmTf4bQpOaZjsj+HiTumjW/i:1La8r37UnY9245axiD
TLSH
T1DF768269B352469BF40B4230C8D6BB91E7F7EC918A925F53720173692D7F24CAF27908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c159157b0e79e7b46a891e8afe68807c4e711f82964d04b80dcddf1d39eda259
MD5 94dc53892052e6d2db9f8b5550a4b43b
SHA1 29ebe8501640ce4b863ac0649c205fa162e24128
SHA512 5e174dd65b7b3514eefe1aeddfedb95e15f93bea92c1841942e97f8d717b896b0064539e74f7bb947e9e6a169d4427e3dfb7aea428ac47f5f7ef07fce464f22e
TLSH
T16DD08014C9FABAF6D03B257D02354705719C955365431305E0810D550D562C706E1EF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f03ecd3ece98ae7c02c56807236cba972a913fbc4f1f463843e7e76a213a3b58
MD5 5b2770fb705fb9354d56e7d4924fb963
SHA1 afdc0e48033c22fbe5ec8f6a29aa8902fa61fffc
SHA512 777e7259c18bc9b92f1e9b9c8f134aa7ed24e29741601440ad38833e0b30ed2c5d6b5ece22a8be103d4847ae1884d7294147a081993a150bf5cc2ab67a045353
TLSH
T128D02228E3F3B0A3C03F2BB220AE8B0C8228C02320C30B00E0020C802C8322E02C32E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69b9be3038d31cc05ddb5cc15fd12662ac61da03c3c565072f834b6bf6b17ce3
MD5 28e76c95a0cceb6357ec3c375dcfe534
SHA1 3ba5e37074e1d7f34d7601c04e7904e1a43221c7
SHA512 2f8f1d4f670d66fe9c731ba9d9c26a9ae78e70468b08912f957b2f38020b7a951b6b75dd3a5201f8cc072715c8e540dc1890687ac8f3bee837184b2768c63272
TLSH
T1FDD02414D3F37453C43F1771105C470C4114C01310C34700D0010C400C4315D01C31D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 db564d7191069b0758c03bd61f1ae68fb23eebbc8825fd89faa4ef989b986a9a
MD5 ff14534b9245388b11a87ccddccbb1c2
SHA1 fb7121d90de03183fd73f57a528e07cefe2461cd
SHA512 526ed940c0d94b3c0c8c3f12f242a4a9851a42958b48d66c0c914caff5fd6ebb866b8e658c884b4dd96ed0aa70007420759ab070c1859f3e8d465d3bcb7e89c2
TLSH
T15CE0869819CDC26FE325748B417C6B4C8394770ED7CCAE5A170889847142965EAD7791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c09cf5666064cfefdaef77040b541a56c636e53440957eab69726476d37a619b
MD5 ae102f39632236687952937fa173b50d
SHA1 a140543f838bf4aec2f6c2379b4cd7f27f9bb18a
SHA512 31edd9485d96e5f6799a30c5eb51bd99fc43d39164071e7404a18a0a1d04494754e5e1e0bb1637f611d6594323af9a6a07c22cfc30e1d2832786fe0b9c513d21
TLSH
T14CE07D9D05DAC26EA308B48783BCA70DC3813B0AD3CCAF0B1B0097947141844B7C2FD1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 1024KB
SHA256 66488e658c1308b67af12fc77d52324a6133c86d18b5d6a03e68e2b23542a579
MD5 762f3102bb7a7d40aec1ac301cfa5bb1
SHA1 8e74300601614d23565ae29e85fe7c2bbb52d4d9
SHA512 e7ea7ecca098a4b655905c17228b85decc1705135f756f143757b4e453cb9b457027966a26d896f71a98e6e81ea712fedfdff19daf92ddd7e5756b6768108de6
SSDEEP 24576:3WH95DQSkle5QlboVJqxwEsBFMxbnt+bI3G7r:3C95MzE5ooVcWEsBkbtTw
TLSH
T154253393C4D09465C13B24A8C87EE673B3C86A4D334D4BDF2669CEE61FB5B2DE614098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 23KB
SHA256 0f8b4794ccfacc77ce3b776b91401142f01e657bf2580a533aad6c0aa2043142
MD5 147437dab863b8b0a4f56967319a78d8
SHA1 e0882f43c16adb6b388ea21f24fac7d04106a3fd
SHA512 0b94fc068df71136e6de94904b5a4fd846b9c4304105be8e44dd5e80553613d99f25d4164d556ea2a69b9ac0919166bbb4b55c4c7be1df52e6cd075ebae8f695
SSDEEP 384:XMWgSF9GQuNERzPxQutjrSvdxsjCAVoUm2cWKA2uuf89V3lxy6PWb9RKSjzSAnb/:8WgugJNEsijrS7sjJVoKsA2uooVK6+bZ
TLSH
T1B8B2D1696CA05F319220BA07BF97E0B11B78C3460316034CA3257E7E7A477D9D887D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8b5c5b8ff549716964999adf005868ee7ea24f1515990a8077381ab71b54c27c
MD5 5e6b94c0edf313882581ed5f45a36d5e
SHA1 c0b7ff8f4551e96d0706cf9bbb94abefb844053a
SHA512 8f31e00218574939525753617f12bd22673f451e6ae61561f9886d1b3d711a9cbdf12d56b0f36d3412bda9c0f92632f3880658c152f03780477d8bcfcad4e83d
SSDEEP 96:PeDTQY/6FroZBPgLj5oKzMGlNwObpfeQQeKCIBYSL7BQt5F:W/0roZBPgnRVlNwOpeQQeKCBSJq
TLSH
T100E1CA6076B24065EFA676304CDC86B7363318CD7F438EC29767DE7A58AB3914AC0970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595f9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595f9b.TMP
Size 2KB
SHA256 f3213127b80fe4755a26d42c2f0a1375b01a19373bb6782c739f579c6a17bcce
MD5 86a96621bb9983f2499ee277b19b8bc7
SHA1 88bddc049cd6ba1f9f9da74b1c26f1338178b7c5
SHA512 e61d4434901a4eb0917c077cae63374b594230dc698d1ebb34b3f22c49bc9b63f749fb710e3f77d64a4f71ab12c365f24794d5bf41e146f3f2b2929e4f8a581b
TLSH
T1E8510DB1537301E6FFA8A678CDD1814B363366C9B9836ED2C5B7EEB9AC5F3950250140
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 b4931ee9b4cb7d5eb70a7fd7f842793fabcc888739d2dd146f46724ec4688fd0
MD5 29fd56d2c9df48a0c460cff3cd7431cc
SHA1 e61a7641bd62c287e45003cb37da096f9daf171c
SHA512 8427abcaf4005ae9379207cc85276b0ab6fa65a59ce6036a55907cc074c9f9b2c07baa7523ab6ecbb63141d0144266031db7baf26378b85df7cb145c5f5d2e4f
SSDEEP 384:DGWlWtqjx6qrm5h8YJQeF3ICRceChdBeZJoX3PmrAPwUJpeLJPgf41uqQZm0ivzi:WOY9X3cWhb8
TLSH
T1D1728BF763F4A27DC91161F4BA186E2FEF1A0424439C3CAAC5D49E8B93F1171D181A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 e137396fb9fa11b3be8d9ba846e823b396c86b557007eed705a9219d7dacb84c
MD5 50a8353762e844dd6f5fcf7762fe8a41
SHA1 945ed2a98cc32ff56da9df8a170bd1ea3994d645
SHA512 2a8aaa5571b505f56651665f5f5b8ffd9b000e8d49b452031f7d82fb557e8e5a07013a7b423b2073fe0067217e0417efc0192facf407a6c3add0bd4fc4fedfce
SSDEEP 384:DpXcbAzECScxCHZebtJJeZjgvWGJebPTBeHJS9hBwW7EwlwFe6J/l/GqrB/i0m47:d/+G5ltj0dW
TLSH
T18EA2B0E7D3E8927DC81221F5BA182E2ADF1E0964435C3C9AD5D8DE8BA3F1171D24198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 1ac2bd8475eab2674221583d42fdbc9ff344aa13cb62729051226de5a132c1a3
MD5 6e2ff1b7840b29a2ed2c4e5f58defc25
SHA1 6a04159408322565a4ee998e20aa0d42c0211ab0
SHA512 e9481fd01a8efeb7445220f5b0ec8f407a49414e897f9b9d4736665aace5eafcf8ab54ab32ea79b176f1788dbb43080b3fae7ea66e84a3f60632b1dddd8aaa3d
SSDEEP 384:DGWlWtqjx6qrm5h8YJQeF3ICeRceChdBeZJoX3PmrAPwUJpeLJPl41uqQZm0ivzY:W3Y9G3cWhqv
TLSH
T165728BF763F4A27DC91161F4BA186E2FEF1A0424439C3CAAC5D49E8B93F1171D181A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0045f60493497e660311717403ae0c25c891baa40dc94d678059dffbb9b65932
MD5 3308249a1e9363726a3a3160b029576f
SHA1 fd329cd0d91b70fa495c99f637ebaf0d41f72e2f
SHA512 9ec7ffa28a9540380e5d9837730914e11a98e43cecfd063ddaaf5fcd249503a55339b5ce967231b1ba5c3fdb1b7b12b48f34ae8dddb27e893993e0a2125b8d46
TLSH
T1D3D023A3130530B4755CFED7806AAC9ECB7700500401D9D560D0D45D157545C4D77141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58cf42.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58cf42.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fbe5ea3ad5b2be0f9dc952ba8cf005b38b21e8a6da201d9df3874dfd8aeb7c0a
MD5 6c623092921df6c8ec14e5d98080848a
SHA1 4721fc5189a8484ed84f60b495add37253c9983d
SHA512 d056f0b0a55bd8508342450d2a8202d7fea3c297e01d91ad4b5c3737f889a6db32c6fd6f76b14cc5524a3fb4ee761389d14e03de29432f38cd8bc15ee82244c7
SSDEEP 192:sxZERXbB/fmssrIdpRv5/W6+WNrb0/Y0tGiuBwIgrJ:sxZE9B/fmss0f/bc/5XL9
TLSH
T1C122B8166E34693B8CCBE219BB25BF53D6F9103251955E48E6FC861C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 ad6ba5f50e52c52f37d29887eea1c51425d6ed86a66869813be5e5c07b8f75d2
MD5 b5b20202185a2c6272e67f343186e5fd
SHA1 6e1ed48adc73961521383fdc0fd78f8e67a38650
SHA512 bd71faa070cc30be94dd227807f63dadc021342f78ee5c42df1ac7dcbddfc91e9770292b5418425e4393f982557aba517f099e75defc7bbdb8979a1dc4987bbf
SSDEEP 384:sxZmhmzB/fmsh66s8qMpRiYnazAW8pZS15posJWeT+UR8/bc6//5vhSx+TT8:sehmzB/fv4Mnc7WeT+Uu/bJ5vq+TT8
TLSH
T12ED2F84A9920C8678EC39D18693DBE32DAEC105359C5CEDE5AECCA1C01DE1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 41621a0ebbe4ac5016de71978909c419dfd1e72fc62a3e06f60758a6a1a0dc90
MD5 64fec45d0898ad8e616228626884de18
SHA1 82a18cd698c9ba1bdde80081a45e136ebe7764e9
SHA512 8435736a6b5a2a2a1fd26f011a34c4c1e00638fcbe78adac3d706dd4823eef649c92a8db9bf56abcf7336ec33d2aa84da00ea29b667e1e96cd0c53f80800678c
SSDEEP 192:sxZERXHcBzB/fmsdsdp8IqY5/W6+WNXEdC+b0/Y0tkiuBwIg5/dx+ImTyRfcy:sxZEhmzB/fmsdcf/bb//5hLbx+TT8
TLSH
T19D52E9576A24D9778CCAD209BE35BF52D6F914238D915E4CAAFCC91C00EF6ED120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2dd001e2ed8086c7265cf9729b9af4a456204fc7f0383f4dfec382323ba257d8
MD5 b483c7e79b6420f96d75b0174a126ebd
SHA1 1d0f0c592b9c814a58e1feaa877b4a111bc9e3e7
SHA512 0d72a49f49319ce016f1e19c76080bc419a93e2c3ba530ba2a23c7e2e57147695c67503905e0113a00941d088b7415c0506362e08a98064a2865ba52b80fbd7f
SSDEEP 192:sxZmRXHcBzB/fmskSdp7eu/4jqo35/W6+WNXbeEjddC+b0/Y0tUiuBwIg5ddx+IF:sxZmhmzB/fmskS8/bpW//51LRx+TT8
TLSH
T1D162E95B692499778CCAD619BE35BF56D7F900238D914E4CABFCC91C00EB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ae8557c2f52d3f768e9dac083caaf7dd71980ed28cdf8b9113c2ec0c78671684
MD5 029ee7068ac734078bc067bc6612fd47
SHA1 d9f24693e4fd4b1323ca2dfba39fb8f412b8f9c5
SHA512 9b467dbaf09419e74b9d6c6043d6cab9b53cfc849a347b47f59361eac8984a149df2ff4964b35537971e8265db1ff15f31561025526c06e5a2fac5509e24b789
SSDEEP 192:sxZmRXZcBzB/fmskSdpFeu/4jqo35/W6+WNXEdC+b0/Y0toiuBwIg5ddx+ImTyRJ:sxZmfmzB/fmskS2/bb//5xLRx+TT8
TLSH
T11B52D95B692499778CCAD619BE35BF52D7F900238D924E4CABFCC91C04DB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 68f958164c3656e2ae7817eed248d64e0d6abd18d59779f01607a325d0639f13
MD5 b95af410f195b0e01c2a3412fcacb109
SHA1 69de012d2cf53a46d03f2aeeec57177f02d28179
SHA512 04194e41e129316e428374e1f9cf3b0e1400191008a20a44234fc0fd996d4f511b80cb877719903544fed536a2e838c37e0df45d622d981609e56973481eb1b1
SSDEEP 384:sxZmfmzB/fmsh66sjqMpRiYnazAW8pZS15posJWeT+4S8/bFW//5o/Sx+TT8:sefmzB/fv4nnc7WeT+4d/bM5oM+TT8
TLSH
T175D2F84A5920C8679EC35D1C693CBE32DAEC00535AC6CEDE5AECCA1C019E1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 fa10511fd71389f128d59bf1edbbae6e8fe5d2d6c93a56beaacb8871c3f1fe91
MD5 97b5837f9817dee85805d732f133357c
SHA1 4a959cd2b932fd9242b1f445df9e38a85a74b556
SHA512 aa1979dccfee0deab8a08174535124a31a354d2318d993d5c9148d9aa55766d75e2ce17472f71708d077428a2394723d786670239f923d1dc6cd78c194568646
SSDEEP 768:kbWwy89q2pdWRm1rQ/78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nQLl/CE0MgTrons:kbWwy89q2pdWRm1rQ/7u1jaKnQLpClME
TLSH
T10FD20B3F240CCB7E4FC01A6DDC566F976E9802C7A6689D4087FE894C02D77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e6dd9d6248c581838892266ee2d2074f9fd4ba5fb09d81cec661f276b3daa402
MD5 6ca92b08aa6dc2bc89d7e19cae9a4d81
SHA1 6291bb40dcac2c050f9370f3c513f3fc071b8993
SHA512 bc9d23759dca828509ea938777d4ef48bd982b4fd47a09472288739b1a7d3438b653918713a63703bb8c547e4eb5f8cba8b0784dbd50ca24880c6e736132f80a
TLSH
T1B3E068BA38BF0810EAABD3DE0431006400103859C151BE4F4129A2C7A0B1221648BCA1
MD5 SHA1 SHA512 TLSH

Submit Download

19a22e4a3e98a107_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\19a22e4a3e98a107_0
Size 193KB
SHA256 40e9600d7ed2be3f146d22e064462588591c48ea0760628c42d87b4287622b94
MD5 a1d6218e8368ad6de51db7e9514ff5f1
SHA1 2f028bd17bdeceacde3fbc41380ec54171f58297
SHA512 eaee9232853084658e952e31ce65cc378f784297731f7dad348b958ef92935cfdf4e0c31810b252dca2da9a483e9c12e6c6ab7d7e8d7aaa46adcc30a387d36e0
SSDEEP 1536:GoWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:3rFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T101145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c738ebb492931ff3a5e867e0e0e33722dcc837175a66af18f6c9e3d8dc70c48b
MD5 dff857da6a7fd44ad257cb52e97e2900
SHA1 9bd8b6fcd4b2483db3c989fa31e0e53b14dda071
SHA512 c5e9a305f0d4c14af14093b381ac605e9eed3a4db385f88e0bb4fa13609703d820e597bd7d31d06af9792434b5508552238502aded9c5f13dc3c9dfb6b8b1df4
TLSH
T154A0027C49F85817EE5256B0A4C1426033358D243E41CB1348A4E745C993695620103C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 71d62e53b16ec9daefe807f56940b3c67b1eee585eccc9ed53ad1afda1f54390
MD5 1d681a75e3eb30623156cb9b0a014350
SHA1 52722d3229e46ddc3eef25e98777e02cc2c3c2b5
SHA512 5388252193793e41ea05e33974d2606ccaa676716a2a7747aa3ba710d2f50630d93dfb589f321a9a0c40d39bc2d0027a6db1810f8dce35c0f94d8f65dd0d7ef1
SSDEEP 96:K0CwKDaI2HqK4ku2Z2c2P2r2p2b2X2Pg2P2a2Gy2j2PK62ey2l2PG2x2Z2i2/2Hy:WJR72Z2c2P2r2p2b2X2o2P2a2r2j2B2X
TLSH
T173C1F29175BE428139BD650D81B8875B13827177341DE6AB7FBC60B68E36E080CFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a47a9c71-c78b-4f86-83d4-2d28a688de22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a47a9c71-c78b-4f86-83d4-2d28a688de22.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c15a542daaecb7a62c417496ed1fd2974e2092fc4bb5f18794cc3ced4b4a8073
MD5 eb2a74467e9b7d5b18ac1d86680af504
SHA1 fd2f03fb09e65b9d71c506232708474b4f5a6b60
SHA512 b72de267b08cdafe16cf8c0162adbc2d81ef9690b3720bd1d260d425395f2d31ecb784ddf59f6b408f288b54c5183ddf206682a799de508fcdb6c636e7d5520c
SSDEEP 384:rZcIh8Na8l57IB4szvb30Pb42tgOIwZOy5Koo:zhJXzT92XsRb
TLSH
T1DC829C3698B84C7B5CFBE245F48676139E788067A7C8AF8494FDAB1D01EA5D81307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8c58fd47cdb2e8cc5366dab138cfc2f74a491d32772b2a47e27ea8d036406f2b
MD5 54e4b5bdd00dc142b41a287659ade0b6
SHA1 32c73bc2eec2bc8f93341dc87d4c9834c4ee4941
SHA512 204b43321b20be7b74ea87599a514e157620aec027d91c91f9c1d2d01f90675b9847f3a9dd6db11bbc72b8b8ca7263951cf9f643c3ab10fae79fedf0e65bdd8a
SSDEEP 384:fiFiZcIU8Ni8TUNTUlIlzl57CyJ2szvb30Pbm2tgOIwZOy5Koo:qFQUfwgFJBzTd2XsRb
TLSH
T1EEC22AF648D7883AD9AE9747B77D2E028E7CC067B5849A50B3985A0CCC960BFC306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 08f01f263faaba074a4330a91c2eb2010309d1bc02b92ecb559ec0518e9be266
MD5 7f2b7e6230a68962ef089249e5a32267
SHA1 bb1fdd3ca447eeb4a61b60d1acdfc6093f523bb2
SHA512 74351ef12448dad0eeb4a4bfb8dbf1e0035c5f58dab0d251c11aeb270df8007b9ff8707d8677743c0bff8acf5ae3cf666021bd16dd17a93ef607a2108010efa4
SSDEEP 384:oZcIh8Nazl57CfJ2szvb30Pb42tgOIwZOy5Koo:Wh2JBzT92XsRb
TLSH
T1C382AD3698B84C7B5CFBE245F58676139E788067A7C8AF8494FCAB1D01EA5D81307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87dc59278ff6b67a2e02987624626bb678a8e7b99d623a584f3a33f560b28230
MD5 69fe7a6b3acb538f822124cef362f16e
SHA1 d0917a75f9c00b9254a9dff6209d1f1710639932
SHA512 975d0763224ed96f8eebd01240ceac6b5bd5a8bbb9ead41c2a2c23c6751dbbfdaa045f3b0c0ebf33d3f8b7566e6499a49c0b0048b71916313547a1191ceb583c
SSDEEP 96:DqGNkEQsjpf4eEE325ih/cIPURHl8h4otop5r1iDTmB3PnvQixdZuP7inyib3Bxh:GGN06GeLQmiUypEi/9e76vb3P0/jYU6
TLSH
T1D1020C38A8BC2C7B8EA79E55B44677139FA4106BE6D46F44D6F81F1C01D769C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 95682c7d6a075f04e3d714ac2d0940ad4b5e172b5a611eb304c38b921eb924d7
MD5 8cb1913281f4d89a7b04d7b1c73e7781
SHA1 66d4cf93903c1cedb80de1e1df2ecbcf7095e3b4
SHA512 fb3e6f4215ee8ec637478c343d1d592362a4b5369f3e1bc27bc2244edf59f10917117d50aeeaaac13d204ef3881424e136eca0c71f2261fd8039f3a6f0406e77
SSDEEP 192:GGND6GeVQmiUyTiI9e76vb30A+0p+HWwEQ/jU6:GGND65z5I9zvb30Pba2U6
TLSH
T137121B35A8B86C7B4DE399A5B0473613DE654127EB88AF54D5FD2B1C01EF5DC2307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b04a3e8be431f6ff8c7e6f6cd58240f83b7ef9982ffed618b8a27e416599a4d2
MD5 d4e0b02b0a6e3814d794c84152924f7d
SHA1 e769f690a15012a3f71fb6238ffdf48851c462b1
SHA512 d0c008fb5458a6c4e85bf9706bc9eead8c45f0907dfa67e3eedbe148f98cbdaf8ff7c5d4b64e259add1663473279969d82a86ec0d61e5c985c99095a6f16118a
TLSH
T16CE004015310407FC030077040C31F347F75D1100F0707455F10017C1D113403F101D1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 145a65d7f58c48cdab291a9950bfe31261ac1e550356f5b1277c646a4e06a650
MD5 b8a648da071f66705ab6f9cf04d94826
SHA1 b3585f1b0ffee9a887527607bf077c36f6bbf9bb
SHA512 25c451febe95f14dea602a86f465ea0cfa95255d99b5b1bc1b17d96cfc2bdc7761065a35b606f460a4a318e73ceb54f693ce71e00c1fbbfd5f2f707bf73990cd
TLSH
T1F7E002029110806FC134477040C31E347EE591000A3B07455B10056C2D173903F103D1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 03b105fbf4e21baf9901d9bdbfe6f21fa72a9ae455f30ad3abd0c81e81740643
MD5 ba2009d61679af11cc37035bbae2a931
SHA1 267e8c018d8ca604e9f2bf5202c3813adb1f54a0
SHA512 af0f3c92a8bf1a5c2a0174004101e0ea422de6ce8dfc53bb85ceb209ae00efac99a226812f7367ae6115a6480452255873c9897c8149e0bf2d62d49ca6fc7b3c
TLSH
T19CE00102A110806FC128477050C31F247EE991001A7A06455B20096C2D273903A21795
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f41f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f41f.TMP
Size 392B
SHA256 c796c943be134b07ed0fa99674181d99cb04bd327404ed9898627774a42b88fd
MD5 4d37eb70cb5216e0417b46dff8311fcf
SHA1 01b34c58aa67d7e91088de3cb763fa7a044a2c5a
SHA512 f6924e67225480c984eea614fe96bfe7fa0a4e206a45d5daf1b99d28142d53f7a6a1c79df6f509c1957539a9d20aaae2c39978ccf0d2190a4fac0e211f4fd484
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 60eae780c0af17bd88e8f16e97ab2f7efa91c3d81e7ec02adfb51fe8d592b401
MD5 bdc70a61295548303ec0b8ccbbcf3ecf
SHA1 41056146b1249030eafac666f0e7f458c9e885d1
SHA512 dcb1e8e54190f659c6c9b7b9908225ff361be5d2d064915ce672a1ef0a7bdd8cff4fd0e1f8790860e7e50e1982d10bab67fdf6779a099e1e4893a083db77a765
SSDEEP 3:MsEllllkEthXllkl2zEUOfall:/M/xT02zfOfal
TLSH
T1ED4404047FC00D05C5447033501DC3701371D51C171157473751C4135DC5D400C40010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/2976-987-0x0000016CB7A40000-0x0000016CB7A60000-memory.dmp

Download

memory/2976-956-0x0000016CB7000000-0x0000016CB7100000-memory.dmp

Download

memory/2976-966-0x0000016CB7100000-0x0000016CB7200000-memory.dmp

Download

memory/2976-932-0x0000016C83DD0000-0x0000016C83ED0000-memory.dmp

Download

memory/2976-1057-0x0000016CB97C0000-0x0000016CB98C0000-memory.dmp

Download

memory/2976-953-0x0000016C83C20000-0x0000016C83D20000-memory.dmp

Download

memory/2976-986-0x0000016CB7AE0000-0x0000016CB7B00000-memory.dmp

Download

memory/2976-984-0x0000016CB7100000-0x0000016CB7200000-memory.dmp

Download