hxxp://do-search[.]com/?type=hp&ts=1433293443&z=52261db8c2a5395e318d146gezdc9c5o5tfc7z3obt&from=cor&uid=TOSHIBAXMQ01ABF050_Z3JLC3MVTXXZ3JLC3MVT

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://do-search.com/?type=hp&ts=1433293443&z=52261db8c2a5395e318d146gezdc9c5o5tfc7z3obt&from=cor&uid=TOSHIBAXMQ01ABF050_Z3JLC3MVTXXZ3JLC3MVT
Sample260928-s8395axfmc

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
229	3992	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{9F75E818-5A39-4FD6-8A7A-77BF6E55A5BA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{378AA5DA-1F8F-4241-9625-CCEDAB4C3289}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
548	msedge.exe
548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1876	1028	msedge.exe	85
PID 1028 wrote to memory of 3992	1028	msedge.exe	86
PID 1028 wrote to memory of 2712	1028	msedge.exe	87
PID 1028 wrote to memory of 2712	1028	msedge.exe	87
PID 1028 wrote to memory of 2712	1028	msedge.exe	87
PID 1028 wrote to memory of 1668	1028	msedge.exe	88
PID 1028 wrote to memory of 1668	1028	msedge.exe	88
PID 1028 wrote to memory of 4428	1028	msedge.exe	90
PID 1028 wrote to memory of 4428	1028	msedge.exe	90
PID 1028 wrote to memory of 4428	1028	msedge.exe	90
PID 1028 wrote to memory of 5016	1028	msedge.exe	91
PID 1028 wrote to memory of 5016	1028	msedge.exe	91
PID 1028 wrote to memory of 5016	1028	msedge.exe	91
PID 1028 wrote to memory of 212	1028	msedge.exe	92
PID 1028 wrote to memory of 212	1028	msedge.exe	92
PID 1028 wrote to memory of 212	1028	msedge.exe	92
PID 1028 wrote to memory of 220	1028	msedge.exe	93
PID 1028 wrote to memory of 220	1028	msedge.exe	93
PID 1028 wrote to memory of 220	1028	msedge.exe	93
PID 1028 wrote to memory of 3788	1028	msedge.exe	97
PID 1028 wrote to memory of 3788	1028	msedge.exe	97
PID 1028 wrote to memory of 3788	1028	msedge.exe	97
PID 1028 wrote to memory of 3920	1028	msedge.exe	99
PID 1028 wrote to memory of 4644	1028	msedge.exe	100
PID 1028 wrote to memory of 3920	1028	msedge.exe	99
PID 1028 wrote to memory of 4644	1028	msedge.exe	100
PID 1028 wrote to memory of 3968	1028	msedge.exe	102
PID 1028 wrote to memory of 3968	1028	msedge.exe	102
PID 1028 wrote to memory of 3968	1028	msedge.exe	102
PID 1028 wrote to memory of 4080	1028	msedge.exe	107
PID 1028 wrote to memory of 716	1028	msedge.exe	108
PID 1028 wrote to memory of 716	1028	msedge.exe	108
PID 1028 wrote to memory of 716	1028	msedge.exe	108
PID 1028 wrote to memory of 2872	1028	msedge.exe	109
PID 1028 wrote to memory of 2932	1028	msedge.exe	110
PID 1028 wrote to memory of 2872	1028	msedge.exe	109
PID 1028 wrote to memory of 2344	1028	msedge.exe	112
PID 1028 wrote to memory of 2344	1028	msedge.exe	112
PID 1028 wrote to memory of 2344	1028	msedge.exe	112
PID 1028 wrote to memory of 5168	1028	msedge.exe	114
PID 1028 wrote to memory of 5168	1028	msedge.exe	114
PID 1028 wrote to memory of 5168	1028	msedge.exe	114
PID 1028 wrote to memory of 5180	1028	msedge.exe	115
PID 1028 wrote to memory of 5180	1028	msedge.exe	115
PID 1028 wrote to memory of 5180	1028	msedge.exe	115
PID 1028 wrote to memory of 5320	1028	msedge.exe	116
PID 1028 wrote to memory of 5320	1028	msedge.exe	116
PID 1028 wrote to memory of 5320	1028	msedge.exe	116
PID 1028 wrote to memory of 6028	1028	msedge.exe	119
PID 1028 wrote to memory of 6028	1028	msedge.exe	119
PID 1028 wrote to memory of 6028	1028	msedge.exe	119
PID 1028 wrote to memory of 4524	1028	msedge.exe	120
PID 1028 wrote to memory of 4524	1028	msedge.exe	120
PID 1028 wrote to memory of 4524	1028	msedge.exe	120
PID 1028 wrote to memory of 6072	1028	msedge.exe	128
PID 1028 wrote to memory of 6072	1028	msedge.exe	128
PID 1028 wrote to memory of 6072	1028	msedge.exe	128
PID 1028 wrote to memory of 3060	1028	msedge.exe	130
PID 1028 wrote to memory of 3060	1028	msedge.exe	130
PID 1028 wrote to memory of 692	1028	msedge.exe	131
PID 1028 wrote to memory of 692	1028	msedge.exe	131
PID 1028 wrote to memory of 692	1028	msedge.exe	131
PID 1028 wrote to memory of 5828	1028	msedge.exe	133
PID 1028 wrote to memory of 5428	1028	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://do-search.com/?type=hp&ts=1433293443&z=52261db8c2a5395e318d146gezdc9c5o5tfc7z3obt&from=cor&uid=TOSHIBAXMQ01ABF050_Z3JLC3MVTXXZ3JLC3MVT
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92207c188,0x7ff92207c194,0x7ff92207c1a0
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,10891453589392743382,10690815121686051945,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6615414638350416659,11158781450948058043,262144 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,5603474970739734808,17168171192685701435,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,13071488464805984380,876989889504734203,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,2384002469885453547,8928840280846972564,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8925338539285571095,7071512548324401154,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,7774590675414053830,9111553711541707316,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,7828904108419042553,1851169962678535650,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,5158321016769078841,7260625387400202524,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,1887559269298212969,2052417777144203157,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5628,i,9055605024101162950,13458069301234712845,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6656104912580220662,11059890239336508538,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6656104912580220662,11059890239336508538,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6052,i,1598004110183962992,11070463431683321266,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,10583319275992799280,8768258728643867047,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,979955718595615299,7848366717405161001,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6528,i,15822352299293836752,9312003558587770991,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6724,i,17621398034600293730,7173678308278225864,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7000,i,9180152326014933174,4509131354332883936,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6152,i,8837789480822958282,11417131942042468592,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6052,i,7771109673767129042,8117392205384657092,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6648,i,5279542794092351532,14378121140464217376,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4520,i,2160784826940765063,11688794289842168707,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,13771148989669955237,16319099087311044905,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7268,i,5296917312577324613,4939311178436383489,2097152 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,6675095648848696455,7885093515276372311,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,5222393678348490822,13707901953545110920,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,8024146272815002243,12757584663968260269,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,17090558079313329066,3848999024491400121,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,12033030974908682126,5990904459845200680,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13411983594865818181,11989010518074038641,524288 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3676,i,17412977846793358833,1054774783424835718,262144 --field-trial-handle=2504,i,12859557362816005799,17103419776688067734,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 1024KB
SHA256 ba7a8b3b994fd9d40cc9c95add3290b1e58fdc5c041a34f952e3a8316f25586b
MD5 a0a047b5ab3504cae8e723dee1e31d72
SHA1 2dfa3f35addb5dd8d434e352bf00ebaa8e1fbf1e
SHA512 f0cde6bfb3677d3aca93aecc7855bf1d5c2e6c64c08b17ccae09591add4901ee3b0647dd64c9728627c7edc398f91f1533ec22d6e61c68048e0e1af69314db47
SSDEEP 24576:Xd+5e/NSoLsqh5yvQScMXYvvv4kSe6sM499q:tVVsqhsdYYoq
TLSH
T1902523CA927A37BB78A6AF1FFC7BB450C0693C0A0C5A82D45198FB41981BB057F55783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89c6d4733473c9e7e22dd3cf5c6be5edbcd9233c4c3f830be7d761f23c017636
MD5 4ef182d7f738564786e81e10894e24f4
SHA1 49f4d8eefbc2ffd144d88b88f13c425b13189f1a
SHA512 e009585f63e5171e437b67fadb85bd4111caa825df045c191b672eb85191d25ee16bc48592df56497c15e2b14cf4c3f544d35fdf47f219bb7c37f6e4ce9f42cc
TLSH
T16C81C78140600B96FFE57931B5EA174B3A3E45A3C7839D96139CE4367ECB794B119E08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c162.TMP
Size 3KB
SHA256 8f24d7c05e256c7f6f0f38ccd3510090bd4fa0f7df128235750a5f1914f2aad0
MD5 dab97e412e7257bd081357c5d03e6055
SHA1 e869d1c796fe6f2bf76b63e550db2840c99c5c9c
SHA512 8cce72045d67202dedf96fab8ea7e7e6fba4bd8caf436941582471e9448a19fba300d79df86f26cc6a33f56ae2bee7659c5e9d24be2ca3b04d32977bc7eb9ad6
TLSH
T18461938440610BE6FFA43931B5EA134F323E45A3D783AD8217ACE43368CB794B204C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 aae9fb2f737604945c95c5d1e2f0c6c7f11910b890a559a34907c04fa5c9f944
MD5 6ae5f4929da34eb8f13ad9bbe1a68dc4
SHA1 0113ba31594575e05eab3ac1c7475f02284a4032
SHA512 211f66c166dc71ab6982b3cc49e6b16b8e0aa335778e52f41fb75e3b053ccebdf782f5ed4ecae26ae18d9c17326dfd166c25a09955aa22a8c4c557b5cd0d9631
SSDEEP 192:DiZ6Xn39emDlTYeb5eCy1/HJjIHes8zr1DhkFkQjZTmQrRBIFRpc4KrdISgiEGdT:DiZ6Xn39emDlTYeb5eCy1/pjIHes8zr8
TLSH
T1EC22BCB7C7E6D22ED90149F9DA18BE06CE690624421C3D17C4D8BE1BA3D35A3D39164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 480c8a677362da51797048c75ab1232bd4679f918588072813d5d2721a73e8a3
MD5 5fd6e933eb9eea8031bc2d71e4133f62
SHA1 b73566cefb3453336536e772b8dc67dfa0e99ff8
SHA512 c8b504f1bb39ff5ef1bc5c9b8a8c457f637f98a0662b5a51997a02bf33fbb172491a16cac25ad56f29d247a64c4f5e84b530bd62792aef43746390763304a597
SSDEEP 192:sxZDR4vWq/f/sUVIdpYNcadthYjHW6+WNtVCovYJ/YRPX7dIgrJ:sxZDNq/f/sUmIGHbva/mN9
TLSH
T15132B8526A3469BB8CD7D219BA14FF17D2F9503295D15E48EAFCC91C04E77EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 41011769ced403db00eda5d36443d1bca91a5fb05a0e2f06aff6b42cc4d322a4
MD5 a1dfff4e932b5587be3afcd18e25213f
SHA1 d8f7a7f540dcc8447f9afdb41819a833f1c2ed94
SHA512 d761ed26a770346dc590bf23e707230eff4c3c048d7a3a466774b3943f4ebec1829a0c5b400daed9a4e7bb8513cbee341c2ebccb589cc0c7ddb3afed3c9ebdde
SSDEEP 192:sxZDR4vnq/f/s4VIdpiNcadxUhYjHW6+WNtVCovYJyDQVYRPx7dIg5JJ:sxZDgq/f/s4miNHbvaPVmPd
TLSH
T1D742C752A93469B78CD6D21DBA14FF17E3F5503295D15E48AAFC8A1C04E7BEE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 61027e4fe7f07a6f65878fe972e10a55e9205d9a7af396b09d623f1d13e7c175
MD5 10f8afd5456cf5e8522568de54ed68e8
SHA1 763ab585d65bfc03271f588c3225d17482d65e06
SHA512 6543e62b584d944025fd61131530d5b8d0f6c6a7d7ba42baa72ab847983f1f5b80ad10e4a168a13e479880113714aef2484da93f17fc4c9bca36169603684b7d
SSDEEP 192:sxZDR4vnq/f/s4VIdpYNcadxUhYjHW6+WNtVCovYJymeqH9YRPT67dIg5JJ:sxZDgq/f/s4mINHbva79mMd
TLSH
T12842B752A93469BB4CD6D21DBA14FF17E3F5503295D15E48AAFCCA1C04E77EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5b98a97ca55021a029c1623d84152d0950ac6fe36c8f74178578aee71023555
MD5 f81dec18eaf7eba80c482ef16d86c516
SHA1 2f2c85df4258b9d5d1aa538153e97247ee6b42c2
SHA512 74699e0b29a4b4a0ae71dc6f4cca9a977023da36af84fa9761079bdede5d8b5ef3b14638a0926b6181883b2262fd4ded534fc24ee461d4936c70129e8697959d
SSDEEP 192:sxZDR4vnq/f/sOVIdpYNcadxUhYjHW6+WNtVCovYJyKx/YRPR7dIg5rJ:sxZDgq/f/sOmINHbvaB/mfb
TLSH
T1A732C853A93469BB4CD7D219BA14FF17E2F5503295D15E88AAFC8A1C04E77EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 38721184b4ef8c15e3715f81be95ccaec0479d630c6f9c0f24119bd47a0ec358
MD5 36a0b8a40d6126ea0795b1b52e54c3b8
SHA1 e978927ce1ddf8f76676500598dad74a3f3fd7af
SHA512 4bde061ca1c759308c5b98599e2ecc183a4df34adf697ae71483d8a45e3969d76e5bbbc1bb2eca44eb7b3eed845fa6821393b44ddb9da5052aea62be91ccf05d
SSDEEP 768:iYK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k31ros+8s:iYK9uzYWvcQWsu1ja0HL7Q3Os+8s
TLSH
T1ADC2F93F640CCB7E4FC01A9DDC5A6F972E9802D7A6688D5047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80140036-aff7-4ee0-bcdd-d5ea2f4dff55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\80140036-aff7-4ee0-bcdd-d5ea2f4dff55.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1eadde3880389c463352bceb296f462be6bbaf66041c9a550297e83a9bf64c3e
MD5 ab1df2d896a9ab40f2568f9e5d72a935
SHA1 c56c150649739e7ec4cfb6494d046e816986b14f
SHA512 4f966d8ccb9049f95e643244de2ed9e8c0535cc22c638e3cbe6cb8953c6c129bb16cb9ad85e3702b52e074d988413abcf3783859d27b2699e5b2efa04b3fc9ad
SSDEEP 384:ziFiZcIJzsNl8TUNTUlIlmwx3B1Xp12OjTV8/dwC3wJrOKv/tgOIwZOyPVoS:eFQpQwg73d1NnYAhOk/Xsot
TLSH
T1ADC219F248D74976E8AE9743A77E2D038EBCC067B985A650B398590CCC965BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0587c687e5d327a5535b6084605b23c273ce82ffe6a82892900b72eacced585d
MD5 83a814a7cb57ff97efa8b1ef3c3587f3
SHA1 c7eef0af290fe3fe93af934fcb2c08be0703aa48
SHA512 b7450ed8377a378a8b633cd50c197d79c4b90f1c7908d8e8c553ede70f7b94a17eb2b21d4206009f8d76ebcdca0106ac9406bf48bd9d7eadd6b06a0a64d8a152
SSDEEP 384:xZcIhsNbrwx3B1XjEOjTV8/dwC3wJroKv/tgOIwZOyPVoS:ZhL3P/nYAhok/Xsot
TLSH
T16A828E3298B81DB76CF7E145E58B32039FB88077DAC56B9490ED5F1D01D6AB9130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2dbc9e494159d7cd551b65ed0ec84dd10e7c149ca869c4c2aa818ddc60d79884
MD5 bcda83c74f606f14f3ad441c3d936d95
SHA1 9d640f6971e574445c3031af3fa89d4299b960a2
SHA512 2b9bfc123f459e911d3ff580c61287c624d929e2476ca23923deed9a373bea93c2f95c14f8d6450d90b4f79d6ed4eb3d2718d89a9847ae5730a48c6733f4c271
SSDEEP 192:SONe6ygpQmiUyHntOCTVgj0+FdVmOzPK2HU6:SONe6lHqtOCTV8/dwAKAU6
TLSH
T15C02E735AC782CBB8EF26E45F48736175FE4216BDA962B94D5E80E1C00D766C2307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 41aa3bda236df041157eea1e00d3da412ba50e362dfb792727b61c2c7949eb8b
MD5 9086ef5697fa5d1627a7e7b5cea46c82
SHA1 3b5a74a60c2848adf8c7bdd5aac06dc6192a6fbc
SHA512 6cdbc0d922ceb2ca06653f9e17f74552e390570b796cb8baba70fa69058fd168552d780ac4e6bb33fe1797d48e67edee492af48c48b695c430ced91a44d97e82
SSDEEP 384:pZcIhsNbmwx3B1XC12OjTV8/dwC3wJroKv/tgOIwZOyPVoS:hhg3m1NnYAhok/Xsot
TLSH
T17D828D3298B81DB76CF7E145F58B32039FB88067DAC56B9490ED5F1D01D6AB9130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0eb6f4b09cca8e75c1448b9bf794d481318d7b42a242e6f8a34ab84a2ac70128
MD5 598ffdc0656d039f51781d16039e178f
SHA1 ba927c287c0c3a58f61f4c48f76cba0a6af79f9f
SHA512 88ea8ab4f4dc4158d096e81cdaf2a122e682d1ae96946b8ecdd2faa91f35f3f258bd9a5cb9a6e71dda9b1e875ffa9eda39ab5f0512416d71e9a5ddb585fbceb6
SSDEEP 192:SON26y/QmiUyZnEOCTVgj0+FdVmCggFJSJrk3UKMqt/U6:SON26m+EOCTV8/dwC3wJrpKv/U6
TLSH
T116120A32A8682C779DE2A541F08735139FA45167DE8A3F90E1EC1E0C01DBA7C130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c691da9b-9c27-4e09-a655-fff04d53be37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c691da9b-9c27-4e09-a655-fff04d53be37.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4fcfe2d3f11452f59fcb394affa6a514f853ecaa73b64f41cb16720e53735cb6
MD5 1da99eb7497c6f0d524a2f2bb6c715ba
SHA1 26f72b252a4a5c7511452cb7b9abb492a5d10c1c
SHA512 36cc76e7e1bb3b457dfe1103e5737b9ece0fb8c620268454fee09df60bced5ce42bded53461a56767278c8ca4b00f0ad3e7c75cdd4e4a5716c9f7389917f24d1
TLSH
T10E412C48B6FA1148B3B66E565BF765AD447FB9773E0BD45D10110E4F0A22B40C972733
MD5 SHA1 SHA512 TLSH

Submit Download