hxxps://docs[.]google[.]com/document/d/1hwEdKAH_iKS-O-XjbIoCJ3LfuSoR0qwd/edit?usp=drive_link&ouid=111280637660492437294&rtpof=true&sd=true

Analysis

user interaction
yes
max time kernel
899s
max time network
882s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/document/d/1hwEdKAH_iKS-O-XjbIoCJ3LfuSoR0qwd/edit?usp=drive_link&ouid=111280637660492437294&rtpof=true&sd=true
Sample260929-rlw2vstsev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
796	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{9CF72089-0619-467B-AC8B-72E8B3A11E13}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2372	3488	msedge.exe	86
PID 3488 wrote to memory of 796	3488	msedge.exe	87
PID 3488 wrote to memory of 556	3488	msedge.exe	88
PID 3488 wrote to memory of 556	3488	msedge.exe	88
PID 3488 wrote to memory of 556	3488	msedge.exe	88
PID 3488 wrote to memory of 1732	3488	msedge.exe	89
PID 3488 wrote to memory of 1732	3488	msedge.exe	89
PID 3488 wrote to memory of 3356	3488	msedge.exe	90
PID 3488 wrote to memory of 2472	3488	msedge.exe	91
PID 3488 wrote to memory of 3356	3488	msedge.exe	90
PID 3488 wrote to memory of 3356	3488	msedge.exe	90
PID 3488 wrote to memory of 2472	3488	msedge.exe	91
PID 3488 wrote to memory of 2472	3488	msedge.exe	91
PID 3488 wrote to memory of 620	3488	msedge.exe	92
PID 3488 wrote to memory of 620	3488	msedge.exe	92
PID 3488 wrote to memory of 620	3488	msedge.exe	92
PID 3488 wrote to memory of 1036	3488	msedge.exe	93
PID 3488 wrote to memory of 1036	3488	msedge.exe	93
PID 3488 wrote to memory of 1036	3488	msedge.exe	93
PID 3488 wrote to memory of 1056	3488	msedge.exe	100
PID 3488 wrote to memory of 1056	3488	msedge.exe	100
PID 3488 wrote to memory of 5016	3488	msedge.exe	99
PID 3488 wrote to memory of 5016	3488	msedge.exe	99
PID 3488 wrote to memory of 4040	3488	msedge.exe	104
PID 3488 wrote to memory of 4920	3488	msedge.exe	114
PID 3488 wrote to memory of 844	3488	msedge.exe	115
PID 3488 wrote to memory of 4444	3488	msedge.exe	116
PID 3488 wrote to memory of 1484	3488	msedge.exe	118
PID 3488 wrote to memory of 1484	3488	msedge.exe	118
PID 3488 wrote to memory of 4936	3488	msedge.exe	126
PID 3488 wrote to memory of 4936	3488	msedge.exe	126
PID 3488 wrote to memory of 684	3488	msedge.exe	128
PID 3488 wrote to memory of 684	3488	msedge.exe	128
PID 3488 wrote to memory of 3564	3488	msedge.exe	129
PID 3488 wrote to memory of 888	3488	msedge.exe	130
PID 3488 wrote to memory of 888	3488	msedge.exe	130
PID 3488 wrote to memory of 5072	3488	msedge.exe	131
PID 3488 wrote to memory of 5072	3488	msedge.exe	131
PID 3488 wrote to memory of 4224	3488	msedge.exe	132
PID 3488 wrote to memory of 4224	3488	msedge.exe	132
PID 3488 wrote to memory of 4528	3488	msedge.exe	135
PID 3488 wrote to memory of 4528	3488	msedge.exe	135
PID 3488 wrote to memory of 2292	3488	msedge.exe	136
PID 3488 wrote to memory of 2292	3488	msedge.exe	136
PID 3488 wrote to memory of 4376	3488	msedge.exe	137
PID 3488 wrote to memory of 4376	3488	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/document/d/1hwEdKAH_iKS-O-XjbIoCJ3LfuSoR0qwd/edit?usp=drive_link&ouid=111280637660492437294&rtpof=true&sd=true
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffc4c7bc188,0x7ffc4c7bc194,0x7ffc4c7bc1a0
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3467423790021180553,17612572541446508320,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - System Time Discovery
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7819629843062246558,4539914339656208688,262144 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,6961758250235317226,3780249290036313839,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17681444978686952152,2629105670980085648,2097152 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3276378536301239773,1247109392302359390,2097152 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,1847247944700531949,10912225722090942593,2097152 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17489944843909369273,6146743376904823303,2097152 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,5028483372124439738,2330841478258256349,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,2397451336098720336,1812125215786751865,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,15523710674090718659,13025693310792237306,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,15523710674090718659,13025693310792237306,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9383026213958852506,960503469511705881,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7194368763755656412,15529943443860724540,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9639994506094817692,1063725479367304114,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,17453081508049328013,15211222475045375909,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,1016022798612705721,10186649170297070735,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,11549195881802404680,3067011667370669884,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,4836707600449301096,15791532024567727376,262144 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,16729231135778759033,17300631483190732357,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2932,i,7669702478494070899,11134889988119214735,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,425194687008849009,17568744437199175543,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,3385951901645203598,10550543732572075452,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10707793322877172304,6047877029934779580,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,17934037325213731028,16785296153799384534,524288 --field-trial-handle=2452,i,14739188803413872273,9150653430916689487,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 01b5750e40959f2810ba0496e98302623adf8246ffe7fd8f58f87a1458de6ddc
MD5 6ab39dae7b0b2f85f0801767adeb6357
SHA1 071ff9d1ea8bbed4b612281a242dda214528056c
SHA512 29270c386b81da1fc57eefff854c87bbf1b3ea113cdc3b45df7813273b07da725de52a0d8b43c8a7ccd9b5838e25e14b111ba3656bce67a0d7b0abbb7886bd49
TLSH
T161E0268D04C8C22FAA50748742BCA70CD3A03B4B93CCFA0B174085897402C40B7C7695
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 211239b3d0ccb31ab439c1d53d6a6948a7d714f0b6d6395db1bedaef4603b948
MD5 7402fb93c73a441829e82ad0ef72dbbc
SHA1 42bf0f2f1f7878a211efc55b461a8022845ea245
SHA512 db756d48a1ea75594307d8b1f6772f4a7bf41accdae48b7c6bc465d20affd8d3657e6ff7025177c5f25c8554be54366ea762b916ae49775b3c5583a8fbbef5e9
TLSH
T1DAE026EE04C8E32FA2007447427C670DC2B0374BA3CC6F8A5700C4897602248A3C26A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ec02b4da31dc57d2aad70e3c5bd09c14ad96251bf6b77d586430636cc474c353
MD5 7db4d372fb08b805c6e2da221535572a
SHA1 10f32bbe219387506bf196b393269374f982cdd6
SHA512 6ed262f23065e559fbcebda7830213c59c64479fb00634e93b9dfce7c4ec35604062abadf8501902259a512e35d3e31ed56c608dcc4abc01ff6d9594a02956e0
TLSH
T121E0269D05CCC22FA240748B42FCAB0CC3A0376F92CC6A8A170485CA7483448A7C2691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 75f9072cca57b98bbc2729b59492579d9c0a017094e492aa209125a06ee60bef
MD5 739400b648f888aa43a405b535adb90a
SHA1 c783b77ab6d73f252549ab2d97d3e0b76031605a
SHA512 8c7bf31d01b8a73dc053e468a9a8fc0f3d6e8916fdb2fa04f35c65b4021dd6cd5cb9fdbff79d571881a2f0fa648063495db161338e0b100e5f1804c1966a80bf
TLSH
T1CAE026AD44CAC2AFB248644743BE570C83A1375AD3CCBA0B3B0084C97286080A3C2792
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8615308bd32ac3324fa94b7fe669d6deb35553cab83b7ede208af6ea7acf8890
MD5 7bfa011565cf42eee7824291ad80d510
SHA1 5004e25edaf0c93a268a5e5ce9663c5a4c2cf0fd
SHA512 792f4aa7567250943161910b21b7367ffe81c13942c99568087ccd17d145eb0a6db72b54e0a461205bad0885d5523a0fc6622ca2f950294f269aa71289cb0f95
TLSH
T17F71FD45E194BA50FFA8C17855C215F736376BA0B1430D8E0F87D87A3C57795B1B20B6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596642.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596642.TMP
Size 3KB
SHA256 aea8768cabe3842e2a8a9fae7159b0b8052484a6b8fc7f1b55254408380a5822
MD5 f838d31e00faa7fb412587896ea241c8
SHA1 d2b4a9e2f9b0f133a97b1e96fa1fe5c3632aba9a
SHA512 d93fed6541e2657c164858e4d0c20d67481f240441325f1f27bc7af9b64405212916395637a5c7cd13249b0853c24fe3dfaf27b670a9284c7ee0c35db990ba33
TLSH
T11B51EB81E554FAA0FBA8C03886D616F732376BB1B1831D8E0FD7C4785857755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6dc1a39a1ff7a799c86dc650b82b933e1a294791fe8fa38433cc677e3694fa77
MD5 8824ec1e6e6bdc1c14c38782798f2c12
SHA1 886a08f26484fd13bdfc4b0183400a065deb4c13
SHA512 39e18f7fc93df3f4306b742c8138a44bd614020a14b05267ed8b2a42560e7b1400b2cd2c3d229eea42a77b919cd037c38e84679922ceabb708afa9cbddf8e331
SSDEEP 192:Dp6pVL1e6YrNDNobNGjwgVsYEfRWZ9K6R:Dp6pVL1e6YrNDNobNGjwgVsYEfRWZ9Ko
TLSH
T1CDE17CF7C3D9862DC80156F49B15AF1FCE1D0A18431D3C2AC8D9AE9B93E2471E2157AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d610053ea4dc78320d4462a6dcaff70c580ca9ecf69d66a5c39a74241a8adecf
MD5 48e6150e5fcbde01f6c9569946533ad9
SHA1 a4e9124a865914f713be699da58152d1ce34b25c
SHA512 6a97c0d00ad368642d8c9d04e9e725d9a0fd792cc0157d831dfe8c431bd49878199f99096ab504b191f251720d3ee7cc95523e27460ae82e818ea640b3a880bf
SSDEEP 96:D/O2U3tjQ5lMOPaGzBqZ0BwINdEPudRKwBm+Gj4/3:DW2U3tjQ5lMOPaG1qZQwINdEPudRKkmA
TLSH
T1CBB136F783A5812DD91196F4DB05EF1FCE291618431C387A88D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 814fee6aff5d5674c711fb65da6d871bcc989dfbeb50281f174ae3b3fd07cd2b
MD5 7453f0ee5d5f858833ad92a5738632c3
SHA1 8696050d2d2b37174eead419f92bde01eb6d7f12
SHA512 6474827e1bca82c28ff8a5697c9e5937839dd3207f599e2637040493ca4b9209eeae842c5f478eb777d0dd44ca6078f17dee354330ffaf4bcd4570b9d829de71
SSDEEP 96:D/OU3tjQ5lMOPauxzBqZ0BwINdEPudRKwBvGj4/xm:DWU3tjQ5lMOPaux1qZQwINdEPudRKkvU
TLSH
T11BB167F783A5822DC90196F4DB15EF1FCE291618431C387A88D4BE67D3E2432E11A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 13d67e576b834f7408006e973dd0039d8fa3255f2ec2a5b83fbf8cd5aaecfbec
MD5 a48f5d51f7197acf07dfd9b704b317bb
SHA1 0c9c1ad75a15ffecd6fbc75882d3843496ede328
SHA512 d0c5c5d5c950fa450a3dd6612259bd09ec539eed435aab6a6a444fbb766512d5011a09aa525895329f698c94b091d66a304a1cab2f35d7778a579d6598cdee26
SSDEEP 192:sxZVRmWo/fFsgfTIdp7RHW6+WNfud/Y36OFHIgrJ:sxZVfo/fFsgfMVHbg/Xu9
TLSH
T14122C852AE34657B4CC7D209FB25BF13E6F9503255D51E58AAFC861C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 02d98536bf91b7f2fdc99a5054b3247f783720ad8232baf0445aa010a45ea1dc
MD5 8a56bc6d599b426af33f33c6c12b03d5
SHA1 bdc6dd2c6611bf36361eb33ed198da522e7a4882
SHA512 6e57368c87b53c51fe03e4663e4ad3f30391991ab5133cc3a23329efecc4ec97d92145e85c23e5dc315692efa1ec97d696f41a5c7d52c79bb5a4618799494b98
SSDEEP 192:sxZVRmWo/fFsufTIdp7RHW6+WNfzkXY36lFHIg5CJ:sxZVfo/fFsufMVHbgXX3c
TLSH
T14922C852AE38657B8CC7D209FB55BF13E6F9503251D51E58AAFC861C09E66CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2c04618d2fe4fc8ec1e61e32701a9691319706a069a15b231addebb37f1f61f7
MD5 85b3cbd48f3eba613697978b33d0994b
SHA1 0de53d058ba83abb167a5ed4c8acca85d9e51442
SHA512 f4ab4cd8483f7f4ea6b7e0b412e3185de3b9b2344a7152827308182a94b5a0d8dce3c7b5dd166416e11acde2e2ee1f5739f0ee5ec60f0d9e1a08ba5dce61d1cb
SSDEEP 192:sxZVRmWo/fFs6efTIdppRHW6+WNfOTZY36XFHIg5oJ:sxZVfo/fFsFfMLHb0ZX1W
TLSH
T10722C752AE386A7B8CC7D219FB55BF13E6F9503251D51E48AAFC8A1C05E6ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e5c7039633a5a90a51b4baabf701ad227e2fc934be5aaa734b49774e7bff839b
MD5 1f7ee5aca9525372acc6fefc802357b5
SHA1 919f1d4695a50be39aed26091694fd605a9f0fa0
SHA512 68e65331da380cacf8cf603afedce3d6a975ee81783fbf7b60694f6bb4ca2510d48aef9bc9b494f717321bbc4bd5a589f639a84a9a493c65cd44c926666b625f
SSDEEP 192:sxZVRmWo/fFs6efTIdp7RHW6+WNfOTZY36CFHIg5oJ:sxZVfo/fFsFfMVHb0ZXaW
TLSH
T17922C852AE386A7B8CC7D209FB15BF13E6F9503251D51E48AAFC8A1C05E6ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 9094b69f1405096ea677b341d135d468423fe8ffcb0e0ca107fe08889fcf0339
MD5 603db4df04cb502cf3cc57bedfa8073e
SHA1 91e0f8252a062c9cd46948b46744ccccf5794e76
SHA512 c9ad49fb7cb700e7236cfd13e4df43941f62821f6499a618133b8c582093499a4aa0d5c5e85127373d06a659a25ec9ac549f8bb53a0665f8e64ab5f397c253d8
SSDEEP 384:sxZVfo/fFsp66s8qMpRiYnazAW8pZS15posJWeT+4fMLHb0ZXHW:s9fo/fG4Mnc7WeT+4f8HbMm
TLSH
T101B2F605A924C87B9EC35D18A93C7E33E9EC505222C9DEDE1AECCA1C019D1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 05df4f5c2bc28e86e02eda67c94c00c2e52b89657d578e76a48f62f136690a3c
MD5 bc1282f5d1261154410eb003779ab24d
SHA1 68485759abed9a369410a9d036a3bfee9fd06816
SHA512 6a2c09cf821d0dc9a7c2200d6a5c6d475f6b6e310a19cca18e85dbe5a62d4a4088bd2ee11b52654a426c035f7a11b88d2ec68634a13a822fa40b155b8e23e949
SSDEEP 768:e4Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/NroTo:e4Klm7QWvUYe0u1ja8/L/E/mTo
TLSH
T1E3C2FA3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EE512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 74d4ea3e44f79a03a922aeccb1073560f829f6b7973face9d9e9f6956daea8b0
MD5 03bdf5f3cdd5db9c18165bf293b67c71
SHA1 0da8df507d32eb075f78d6ea548667ffcc151047
SHA512 0790cb8b044cf414cf426295d26fd754714d563c73f3eceec765a00a348c32cb621325f0e90a9589bef5ebc35a01591f58a3060dafe13be9ac67578c37b86eef
TLSH
T1B0E0C0772EB36400ECBFE7CA207168F000607848C805FC5E142E599710B7754745DC62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c0de3948ff7c7b4b617f8911c9754ed15076abe8eac81b27ac55d2b77a1b88f8
MD5 d06c3734ebdcaad08ec7d73046faa26d
SHA1 2eb595a14fa3ccfbf6ccc953802a7c38c0929019
SHA512 57476de05b2b3af8453df01df34baab79343481fa0d1970fd0acbc1153e97700625065e75178fae674404f821b1e4c778782fbfa947b7a8e833ef3e40d805b41
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/jyL8rKWkmKzb6ZCISOzK9q1IzxsjYhyKb:KEYQKhmOej+KE42WLWKQUTqwK3KGg
TLSH
T191B1144171BF124538BE55488178A71A565231B33098FA7BBFBC11A24EAFE084DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d7e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d7e8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cfd69b99ef2c2bb89a2c4a6b07facab9ee964828deec04701840ed37a00f9231
MD5 e06c6c649b0ea4ae0579e652fa6c3c19
SHA1 84b552d08b79bbf3582c787f91a00a32b9265f89
SHA512 d04d30b25c16fb32cd252b17a556935f43569740ce8b7c4c73b807001ac287a1608e5e681db50f657a043d7a1bc8b50e0c8174f7893a2fbd4f7afc8e83cc363b
SSDEEP 384:BiFiZcIvqzsNY8TUNTUlIlPQbhyVh//cpj5tgOIwZOyUjok:oFQ69wgjL/C5XsXb
TLSH
T114C229F258D7897AE8AE4743B77E2D034E7CC067BA859A54B3D95A0CCC960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c0a696762660b6030dbc90370ff5e81239bf344b18200c3a9de266844cb4355
MD5 3e45fcdc99f994e6557fc376cb36c46e
SHA1 81f60761a67d3eea0873e2bcab57fed1a0a814bd
SHA512 ad55a51b31349d98b83103b340e5e0474d55cb54376743f2244d39aa457d20fdd4847b1466f6a274555091acfba5f0e759935fc6440812ad5ee4c6ea0c7d1c63
SSDEEP 96:KqONkoQsjpfbUmjH5ih/cIPURHl8h4otop5qaDYBKP4v+Y1xf//ojdFxjYpoR1/z:BONw6JUm0QmiUyXsso//ORhaBC+aU6
TLSH
T18A02E734BC68BCBB8EE3AE45F48377239FA4107B9A915F84DAD86E1C01D715C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55f9cb99fb3a16e9ba503cafb2c82e530aeb8575aa36999a8aa17a8fa86955c5
MD5 a8a2c4bac75c577795c08ac5ecdc1bd9
SHA1 1aa944087b63aae8f61b40e9d0e05c342397cdc7
SHA512 0fe4fdb2365ed808544f150dbb02c79789395e18b7c9c21b219c49d8cb63d471a8b592eb6d62323c00c7b9011e4de6aa8d7b6fc69bb45d48024f384b9d320540
SSDEEP 96:KqONktQsjpfbUiH5ih/cIPURHl8h4otop5qscDYB/P4v+Y1xf//ojdFxjYpoR1/j:BONZ6JUhQmiUy9Ksno//ORhpBNxGq9U6
TLSH
T15C12E935B8A8BC7B5D939940F08376138EA4407BDBC56F95D6DD2E2C06DB1AC530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b7375d742425f639a81616644783ac7ab0199d010303f2010521827e760b9565
MD5 63d3eac992b09dfd831e4baf15e79bb3
SHA1 08197c69c0f4b4f1cb59d85246244d609a0ed295
SHA512 0547e900c009815bcc6329896825117bab2272e7017cb708e5b1f422a285f1534474e31fd2995395ca28b61b6356ad28b4cd6116cfd73d6fda1bdd833645a743
SSDEEP 384:5ZcIhsNoOQbh9Vh//cpw5tgOIwZOyUjok:RhJL/X5XsXb
TLSH
T185827D32AC68AD7A6CE79140F58772034FB484B7DBC99F94D5ED6F1D05DA1A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f9dcf5b836cb0faf4c209225c3aa34be0c28ed67512c1c87581320001f005e1a
MD5 6fef9385b83cad390c5775780ef069c9
SHA1 26d5d7d5dee921088ddef79c850b2d9e8defa7ce
SHA512 1d9d69c032654b7ab60143b44e131bd581c2a1de6f0d99149cbec86cb5c0108b65ef61233c8d9e5ad132f7aa46609fc5a67524deb8d4ae7fbc2a8b5c5410da92
SSDEEP 384:uZcIhsNoPQbh9Vh//cpw5tgOIwZOyUjok:MhGL/X5XsXb
TLSH
T11F828D32A868AD7A6CE79140F58372035EB480BBDBC99F54D5EDAF1D05DA1A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fe78aa7-5371-4e32-b273-a31c690395d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3fe78aa7-5371-4e32-b273-a31c690395d1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 21ec75daa8ebc791116cac419dbac5d44f6f685305fd409651ebd6841c89bfa6
MD5 17a3183b7c8995ff6a336c1e5304af1e
SHA1 6e607ad3438a26b214a4526c77c9f186fd03e057
SHA512 3a2e45e51e3e3f39a05333836eff35a1570b237e867cbf673417697b454e7b10d6a75c2ac97af3376e5b99af77b6e2941854480bcc86dc654918b5918238dac1
TLSH
T1AE412868B6E91148B3B32E56AFF7A46E447BB9372E0BD46D10110D4E0A26F40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download