hxxps://www[.]googletagmanager[.]com/gtag/js?id=AW-10810074153&cx=c&gtm=4e69n1

Analysis

max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.googletagmanager.com/gtag/js?id=AW-10810074153&cx=c&gtm=4e69n1
Sample260928-ed8dpsgd53

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{F9C54589-DE33-4631-A041-6856B502288E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2580	1196	msedge.exe	86
PID 1196 wrote to memory of 2080	1196	msedge.exe	89
PID 1196 wrote to memory of 3468	1196	msedge.exe	90
PID 1196 wrote to memory of 2616	1196	msedge.exe	91
PID 1196 wrote to memory of 4072	1196	msedge.exe	92
PID 1196 wrote to memory of 3972	1196	msedge.exe	93
PID 1196 wrote to memory of 3408	1196	msedge.exe	94
PID 1196 wrote to memory of 3468	1196	msedge.exe	90
PID 1196 wrote to memory of 3468	1196	msedge.exe	90
PID 1196 wrote to memory of 3316	1196	msedge.exe	95
PID 1196 wrote to memory of 2616	1196	msedge.exe	91
PID 1196 wrote to memory of 4072	1196	msedge.exe	92
PID 1196 wrote to memory of 4072	1196	msedge.exe	92
PID 1196 wrote to memory of 3972	1196	msedge.exe	93
PID 1196 wrote to memory of 3972	1196	msedge.exe	93
PID 1196 wrote to memory of 3408	1196	msedge.exe	94
PID 1196 wrote to memory of 3408	1196	msedge.exe	94
PID 1196 wrote to memory of 3316	1196	msedge.exe	95
PID 1196 wrote to memory of 3316	1196	msedge.exe	95
PID 1196 wrote to memory of 1184	1196	msedge.exe	103
PID 1196 wrote to memory of 1184	1196	msedge.exe	103
PID 1196 wrote to memory of 3688	1196	msedge.exe	104
PID 1196 wrote to memory of 3688	1196	msedge.exe	104
PID 1196 wrote to memory of 4680	1196	msedge.exe	106
PID 1196 wrote to memory of 3312	1196	msedge.exe	115
PID 1196 wrote to memory of 4156	1196	msedge.exe	116
PID 1196 wrote to memory of 4660	1196	msedge.exe	117
PID 1196 wrote to memory of 1276	1196	msedge.exe	125
PID 1196 wrote to memory of 1276	1196	msedge.exe	125
PID 1196 wrote to memory of 3584	1196	msedge.exe	126
PID 1196 wrote to memory of 3584	1196	msedge.exe	126
PID 1196 wrote to memory of 4776	1196	msedge.exe	129
PID 1196 wrote to memory of 2772	1196	msedge.exe	132
PID 1196 wrote to memory of 3872	1196	msedge.exe	131
PID 1196 wrote to memory of 2772	1196	msedge.exe	132
PID 1196 wrote to memory of 3872	1196	msedge.exe	131
PID 1196 wrote to memory of 208	1196	msedge.exe	133
PID 1196 wrote to memory of 208	1196	msedge.exe	133
PID 1196 wrote to memory of 4620	1196	msedge.exe	134
PID 1196 wrote to memory of 4620	1196	msedge.exe	134
PID 1196 wrote to memory of 2428	1196	msedge.exe	141
PID 1196 wrote to memory of 2428	1196	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.googletagmanager.com/gtag/js?id=AW-10810074153&cx=c&gtm=4e69n1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x284,0x7ff84de3c188,0x7ff84de3c194,0x7ff84de3c1a0
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,9662910384680684060,13252787113923754015,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,5962547141187215638,16935600075566645599,262144 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,17330944514136867291,7631153144195424210,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3080,i,3496576676519075057,15893632277486696492,2097152 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3084,i,18442841392275981654,12501865057495222346,2097152 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3300,i,4162160709681672507,14067014825821071206,2097152 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3316,i,5308397605486554740,477032559401549439,2097152 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,9091978322580686243,3493298987412483777,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,7256713384354395880,6948740715076603429,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,6171532548094382093,14441059355481663464,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,6171532548094382093,14441059355481663464,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,3447180946129562654,14538559071235612504,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,3873349395822968838,12238555560486745897,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,13707541782980076370,9356831819543992915,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13582301226594011216,16252746968974276884,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12386926516802961442,18146585490395318699,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,15266386126540347589,1025104951049375299,262144 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3092,i,1139243462162850217,13743352815711729340,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,16581356211755912706,67544780755142994,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,922029435698606490,5865286605805948387,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2972,i,1624751043345826900,6788281748488240730,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,14152243549581860410,7652330959234129220,524288 --field-trial-handle=3768,i,7411969258748858268,16485904515364609052,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c0eb34fd7c5f73e3af767565552b0f7a57dd0fef3a12caac89e3f5e12e3d977f
MD5 5e5e20285475ea634bf7b3c6f63aa6c8
SHA1 85ebba45bd04a963fd8fe06eae94834033d022c6
SHA512 ce3e31c47e02081141a1378fd4d78074e41af5d175bac9caa5b76f427ddc3717c2e634881372a52a0b44328acfc0147baad0051c154968731863fc9f2be579f3
TLSH
T1C7E026C957CCC6AFA249644B4A685B8DC2C0374EDBCC7F2E2B04C48C7001888B3826D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 db74ba7103265d17539e7959941e67b6f9fb7bbb7fb8aaa17b0f5d81076404c3
MD5 f40249db37edf918095ebba87e7446eb
SHA1 00bb6a2355d3010eb16d302de3ccc42c596385ee
SHA512 d49987652c4d56f5c33b1fcdac1c9a5bafc7387be61caaf49f024e8a9482435f13620539ef6690349cef980a68f45a83e3dbb635c24e0b70e1c18effe7d6c7cd
TLSH
T1E4E078C919C4C2FD510D644755584B0CD1C4371BD6CC6E5D7700DCCD78064D473C1555
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 94f04c46e3109655ddb85bdbbaf3ff2a0c65338f53cc4adecc7301f71b714ac4
MD5 810f7c6b7b9378626b5b932887ace71a
SHA1 1f4db36953c6924a62f0c5a2b0350c14bed00093
SHA512 af766c749f86714dd0f2d56d588e4292697414d8526867988a23f09c7112752fb139bba6b636bb2fc185015b6c6237bf78cef95fb031db5710413e5dc6fecc15
TLSH
T12EE0268D26CBC22EB2407447426C470DD281370B9ACC6F1E1F0CC4C87001058A382691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 481b1ac6c6d0d310d7664f14007f4660600c1d1a2c3acf1318796b12abdbc09b
MD5 e6c1fcdf0b1e172b1facd9063d2d3a63
SHA1 28a6e6c741284f0e061c1a2a453edf1552a468b8
SHA512 639c762c73c439ea27941b8008ed29443d38b251d13c3f152a3fa4e43a8b1db1cca49490121d5ab072d6a9dc97fea04bd8d1b68d6b3e31fc56c4cad9c8668413
TLSH
T11BE028C811C8C23D5104A08305F4574CC390333AC6CCBF551700EC4C3102854B3D7145
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f78d63ff86e5a954c13523f772bc12bfa6bfe85be3f5f1cbdeb67521fbfbdbe9
MD5 3106338165fd85ea04b7edc8523a16a4
SHA1 df97bc874deac7f12e83fdf74366c175a8750029
SHA512 37eb983d77b2ce7da2bd55a8e754a6a827b2d66b5d4dd395d1d8e7e70d3aa7fe7b142b97ffbc8c91e1fe201b92db365aaf4174d41ecb4ef54c4f65fa665cb05e
TLSH
T15D61A241C0C0846AEFD44230A1F6A0A7F23172B4C4A7BDB9814CDCBE8B07F3D226B880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f836.TMP
Size 3KB
SHA256 4d9d2dd8174f38c4cd9a1fa3564d67c4093640bd6cc5e85936085291516ec531
MD5 2b7514f99cc3262819fecf4b60e1b4bc
SHA1 dd4adb8a1ede9a93fc67655f60601ad2c461e0dd
SHA512 319e508bf7812333c8e1a3fc6645a47c9a86d44309dfcf8e22474f30c1443b5cc795cdcd5fb75b829d83da326a24d5fdbc9df65d6398a167a489d561b147ed38
TLSH
T1CA618241D1C0846ADFD44230A5F59197F23176B8C4A7BDB9814CDCBE5B07F3D226B990
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9ec7a118f88f1a5f34dbc939565fb4a9d7ebbcb20134f69c0c7d1060fceba32f
MD5 1a4e37e683af3f770da4900d6e2c1a85
SHA1 b6645ecc70eb325469a2c8dafbc645111a65a798
SHA512 740af4e8ec764d6fb6a921af235825c0ac47864f29c988e6b3cf2911162d7750b254865fff66925f2ed091d9dd1cf9d30c78d50c749139a179de608b507bc9a9
TLSH
T174218BF383E582AEC91556F09A24EF1BCE1D0546831C7C5985D8EF27D3E2072E142A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1782fa694e8e50c49f2a4898b65240b8afd6605b8df98f2a2401584450cfd603
MD5 ebb129f5e506dedfb4b4754f5355b98b
SHA1 83232d81c462aebf551e25476a30ff82bffac970
SHA512 5372d9bc475392c92fe4428bc3c402a955afb1834977c035a54cf5a4cff57974ffbab279b321be65278b067effac6010bce1db2b76a6d375f647066558500af0
TLSH
T1A4219DF3C3D4866E891556F06A24AE1BCE1D091583183C1AC5D8EF2BA3E2461E10198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5a2f1803d9696ea07020ec2809dbd8ed114a306f9038d5af00e7015c304560ee
MD5 1e8ab2a00460624351179435e2b994b2
SHA1 1ac84755eafba34c0593ed5e7aba9dbce5c074a5
SHA512 a431413f142e112b6b35a3b47ec39483a8af17affd0bca7a2c9e57e1fbf0f98d776eef603ff32c0f38ed771cb5d13b5905ca9833898c6359898e3eb4e7cad913
SSDEEP 192:sxZ1RBWh/fGsL+AIdpw9HW6+WN430/YgZsVIgrJ:sxZ1Oh/fGsaBkHbL/s9
TLSH
T14522B8526E34A9BB8CC7D20EFA65BF13E6F9103251D51E48EAFC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e387d19a3af2b27001915556a1bb3b3b9ef6666ab68e2df8439c2852b8e9f427
MD5 857b48d085b81b531f8f976fc578b703
SHA1 df82f8e05f4650a613e112e312500616253f76f7
SHA512 0e43d289f12d2e068f113c00b0a855d1089b86e72bff7cde20f7c4a2fd794fd5db18f3b9b5fca510657fc1822f806b0c21d486fe3f2522a06a53e3318ee54de0
SSDEEP 192:sxZ1RBWh/fGsEtAIdpO9HW6+WN430/YgMsVIg5MJ:sxZ1Oh/fGsKBCHbL/ne
TLSH
T18822B8526E38A9BB8CC7D20DFA55BF13E6F9503251951E48AAFC861C05E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ad453e3d35e72dfadddc2e90da4a9c04d274c0a0b4d6fdb32cacf4a16bc5a739
MD5 4571eddfebeda57bbe02b880166db8ff
SHA1 c33771cbbfea7fc7d09122a79c7638611a8621e5
SHA512 122ef4c8e68e883ac8968a7afd904a483fff048999b337b51a558140ae38976efd89f2db95f3f19c6d1ceb26c17c96a290de62e964b564be259099b9f49ef251
SSDEEP 192:sxZ1RBWh/fGsE+AIdpw9HW6+WN430/YgZsVIg5mJ:sxZ1Oh/fGs5BkHbL/s0
TLSH
T19922B9526E34A9BB8CC7D20EFB55BF13D6F9103251951E48EAFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 52053ffa6a17d64142b5cab677a9ef9aaca2b1bf53aee21b3fcf46379f1a9bb8
MD5 8381da6200430dcaabf0b9c5bcb7530d
SHA1 10f766fc2a1cef62fb302bab56a6ac3cba84e391
SHA512 1c96613a4596839ef0d8c57b25e0fedd55fd95de1e133fb745f13ae1cc82f85154ca55dbbc15b638f76c68abefeecc488c7e074ca9d58d398db695707d9f7e11
SSDEEP 192:sxZ1RBWh/fGsEtAIdpw9HW6+WN430/YgesVIg5MJ:sxZ1Oh/fGsKBkHbL/Je
TLSH
T13222A8526E28A9BB8CC7D20DFB55BF13E6F9503251951E48AAFC861C05E6BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5ae0580d58902c6355cc33f2eae89eeb574c4f925d83537bf795997852db1ea9
MD5 d8085a5fc512e0880d1dccbab8a58524
SHA1 82f70d62d33a27084de8537c714ffb52c784320c
SHA512 9eef52b88acc4c2f0a2ab81adcbea7834c2bf430e35a2155b80d796ae3f6d9c84d0a2a86f9d3c3e97e834791639705391019c8fdd5b89b5a1214df6ae02013ac
SSDEEP 768:MFichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzHrocmW:MFichfPWvPZplu1jan+LKgzUXW
TLSH
T1FFC2F97B640CCB7E4FC01A9DDD1A6F9B7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 864B
SHA256 953aa821e7c8e0ac2280505b671c497fdb6670d2761234fcada09b6537b0411f
MD5 b148fd5a7425b0ce4d02e1cd98de8b2c
SHA1 2bba6ec1c5ed5169b80764a467f92aca1ddc5d68
SHA512 d367961823cd9abfee6be3cff4c84f47c3f8921eb615d32144a2ead7664647628f6b56485f2acf63e35abfe02792b96a2f657d89e65c00f19b388d926461654e
TLSH
T15F11629B4E526A1FFC540330243CBD8972B102CC2340A71F52BED11E9C93B04EE81250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d3fea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index~RFe5d3fea.TMP
Size 864B
SHA256 19a06d03d39e1e28b532fcae7c4a0afffa5e5a50e5478f5915333c90c7630b5f
MD5 ca795b8428305d69e72c2deb131ad716
SHA1 f28da273fee1cc63909d899d674a15be92502c3f
SHA512 092e246575d1400cf643f85464610a5ec973815190eeaa1141aa5bdc12fbe3430697e0d3ac42e425f8b95fa9cf2d2aac7352cfb516c2582db4e2e061c3e7ac93
TLSH
T1DE1147E901634B06EC440370992CE956717641446354674FD3EBE119CC82BC07DC2FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 62cb5b84a443bba03b4b10e0520e878e420d05f3154e38562205915a4eeb387b
MD5 56d00c13bdc50114f2448d0ac6d02436
SHA1 b8a15282965f529c634a1d243b55be8d9c820141
SHA512 b0ebec2ced387eb36863e83613d37a936fc684dd3a096a2331ea4b0be332fb3a4d91cfd9df794ce91923b0acc408918df558038525584e390ffb3980ba87dc30
TLSH
T184E0D8B72ED72864ECAF83D6103188954105B968C544ED4F607A91C791A1755785AC26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3ad4f1d90b4610ec9d95333e9ddb092c4f6c2a84c8da8806d9ac9738a013fe8c
MD5 bc8895956e7c8f8ab98d6685944a91e9
SHA1 dd3f77c2579a4c2cfaa31935a5e2af764639c9ee
SHA512 7ead2a70ad5fd854f10f787eeb832646030ac72757c6cb03b3055a895c543810ba331f114aaa16a5f6ef4e266c193bd0513ca48c813dc4a5008f1f56a361149f
SSDEEP 48:K0cLq2EGqTba5iISuTK9K1oTxMDYBSqwyLWRsQO00tbYvAISotK9M1OtxG9Yn4Ul:KAzmKo0ye5WKyoCOduKu8FnQjXlptkz
TLSH
T18791EB1534BB125078BE796985B0871B02813577351AF62BFFBC50668AAEE4C0DFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599198.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599198.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a4c8ed238ef31fcad97dd1115144db4d0dc4fea72fcf7342decc08e2dce8a9cc
MD5 09f5226ac4e573984352505bae97a3f8
SHA1 a28dc19343a072115c6556bc61e1e26fe4c4490b
SHA512 72618158868d7d315c40b7b1cfa237087fdee235ae479a5969fbb53e2e387ff6c0818836df99c00a610d81f99797b404b2ac735a91b7197cc00c322d7a84a329
SSDEEP 384:9wiFiZcIKozsNx8TUNTUlIlDkxTJK5Dq5BGYX5EaV84YXT7rTtgOIwZOySL3oR:ZFQ/swgCXKQbGYua7YfrTXslLu
TLSH
T126C22AF248E7987AD8AE5743B77D2E038EBCC027B5859A50B398561CCD9A1BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4882261dd130ef4d0683ae64ec455af468ce5fedc1d8bef0cbe5e5b2de34c6a4
MD5 c7112535b3b382a54e0fb3100e7aec68
SHA1 dddb84804d362b2ced7c7ac06224dd4aa0ec015f
SHA512 928bf8a6d8fd0557ba1bd98acb65d325d4891c770fe9e7b91b5e779d207046fef5f1219c09c20f96152a1d0427db0969dc3060fbaa2b5d5b6980978c5a7ac925
SSDEEP 192:LJON76DphmqQmiUy2Vq8wGYX59ezTC5jzor3mL9kk7yFU6:lON7619jRwGYX5EaV8COU6
TLSH
T1CA02EA35AC787CBB4DE3AE45B48B27139FE8212BAB552F44D6E81B2C01D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bb5de195491801374414bc6b44b02bf8efb3f30cc67e2557ecbd500a5c245fda
MD5 3903e336ec210944214feed69418d041
SHA1 751e39fe8976589223b5fb1ee6e07e3b056fd09a
SHA512 e17fb962b88af74badbeb0f581cacb863386105a4ab598eaaaabef02fa220f3ea725136023c698e28fb183c057e518e638a61c611a99959c14a4e6eb61b37b16
SSDEEP 384:WZcIhsNPYkxTJK5DQ5BGYX5EaV84YXT77TtgOIwZOySL3oR:EhWXKabGYua7Yf7TXslLu
TLSH
T149828E769CB8AC7B1CE7A185F48A36039FB89027E7C49B54D5EC6B2C01DE598130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d8a05110fc7ecc8c29be88af6f917827a56a82d8252f86fd26829d9095ebe75b
MD5 b3fe6d9a2fb0ecb97669fea3949b7729
SHA1 cdd8b916c2431164d68249504a156d7c37f27523
SHA512 0d463dd718260cf87d52924230f5faf6e89d56a89499156f71cf57e5b4b4afc56b4661a0254f89538478f378e13834356312ffa22f9359aac925b6bb16465749
SSDEEP 384:aZcIhsNPDkxTJK5DQ5BGYX5EaV84YXT77TtgOIwZOySL3oR:YhjXKabGYua7Yf7TXslLu
TLSH
T176828E729CB8AC7B1CE7A185F18A36039FB89027E7C49F54D5EC6B2D01DA698130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e44d6ba3d77a1a7883e52f84648e324f7272c412ea7c6cc27b61426a93c58d4
MD5 1a62b19ab8f601d3c6fca49f81f0d5bf
SHA1 4f04e723eb6b2592ebb321c13f7ef6e398ab9db3
SHA512 442fde38b8470bbd4b2322ce31f31e12f863bebe29fbf9a872ceca87a298cb881882c85d433bcc5b98bb9ce531de4fbc0ba39d868106b6438a31dfeb028d0968
SSDEEP 192:LJONy6DphVqQmiUyLV7wGYX59ezTC5jzor3mLrYXT+SnkIIBq54U6:lONy61iA7wGYX5EaV84YXT7QTU6
TLSH
T1B3120B36A878BC6B1DD2A595F08B36139FA8512BEB846F50D6EC1B2C01DF65C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36570aa3-ec8a-4165-82b9-57dcf69bcaf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36570aa3-ec8a-4165-82b9-57dcf69bcaf3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c3b335df38a18ec8b76cb17589d448759e209f314f1475947148acdbae0fd65a
MD5 a941a2e798addbf7f52aee97533b91b5
SHA1 8a3ef397dd94848c7d4c36672e29024b03698f09
SHA512 dcfb1bff4f0dfcd58719c713c131296328e3521cfce0245421b054020e9f87de924b44a6ab2ffd9952b0f284bd82c7e0a62a94525af53ddd1d90785b9f70dcd3
TLSH
T12E41185CAAEA1148B7776E569BF6A46D447EB8762F47D49E00010D8F0627A40C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download