hxxp://accounts[.]google[.]com

Analysis

max time kernel
899s
max time network
880s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://accounts.google.com
Sample260929-vbvmtsxgra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1964	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{30F720E4-737E-4311-81BA-809DE3BEAC18}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{C727CF18-7573-4F8F-92F2-B05A5A8D3B9C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4352	3240	msedge.exe	89
PID 3240 wrote to memory of 1964	3240	msedge.exe	90
PID 3240 wrote to memory of 5928	3240	msedge.exe	92
PID 3240 wrote to memory of 5928	3240	msedge.exe	92
PID 3240 wrote to memory of 4276	3240	msedge.exe	91
PID 3240 wrote to memory of 4276	3240	msedge.exe	91
PID 3240 wrote to memory of 4276	3240	msedge.exe	91
PID 3240 wrote to memory of 1516	3240	msedge.exe	94
PID 3240 wrote to memory of 1556	3240	msedge.exe	95
PID 3240 wrote to memory of 1516	3240	msedge.exe	94
PID 3240 wrote to memory of 1516	3240	msedge.exe	94
PID 3240 wrote to memory of 1556	3240	msedge.exe	95
PID 3240 wrote to memory of 1556	3240	msedge.exe	95
PID 3240 wrote to memory of 4872	3240	msedge.exe	97
PID 3240 wrote to memory of 876	3240	msedge.exe	96
PID 3240 wrote to memory of 4872	3240	msedge.exe	97
PID 3240 wrote to memory of 4872	3240	msedge.exe	97
PID 3240 wrote to memory of 876	3240	msedge.exe	96
PID 3240 wrote to memory of 876	3240	msedge.exe	96
PID 3240 wrote to memory of 3464	3240	msedge.exe	98
PID 3240 wrote to memory of 3464	3240	msedge.exe	98
PID 3240 wrote to memory of 3464	3240	msedge.exe	98
PID 3240 wrote to memory of 4676	3240	msedge.exe	100
PID 3240 wrote to memory of 4676	3240	msedge.exe	100
PID 3240 wrote to memory of 4676	3240	msedge.exe	100
PID 3240 wrote to memory of 4256	3240	msedge.exe	103
PID 3240 wrote to memory of 4256	3240	msedge.exe	103
PID 3240 wrote to memory of 1132	3240	msedge.exe	104
PID 3240 wrote to memory of 1132	3240	msedge.exe	104
PID 3240 wrote to memory of 1688	3240	msedge.exe	105
PID 3240 wrote to memory of 2688	3240	msedge.exe	106
PID 3240 wrote to memory of 2688	3240	msedge.exe	106
PID 3240 wrote to memory of 2956	3240	msedge.exe	108
PID 3240 wrote to memory of 1624	3240	msedge.exe	112
PID 3240 wrote to memory of 4912	3240	msedge.exe	113
PID 3240 wrote to memory of 5516	3240	msedge.exe	114
PID 3240 wrote to memory of 2708	3240	msedge.exe	115
PID 3240 wrote to memory of 2708	3240	msedge.exe	115
PID 3240 wrote to memory of 2768	3240	msedge.exe	117
PID 3240 wrote to memory of 4772	3240	msedge.exe	118
PID 3240 wrote to memory of 4772	3240	msedge.exe	118
PID 3240 wrote to memory of 4100	3240	msedge.exe	119
PID 3240 wrote to memory of 4100	3240	msedge.exe	119
PID 3240 wrote to memory of 744	3240	msedge.exe	120
PID 3240 wrote to memory of 744	3240	msedge.exe	120
PID 3240 wrote to memory of 5960	3240	msedge.exe	121
PID 3240 wrote to memory of 5960	3240	msedge.exe	121
PID 3240 wrote to memory of 4756	3240	msedge.exe	122
PID 3240 wrote to memory of 4756	3240	msedge.exe	122
PID 3240 wrote to memory of 2412	3240	msedge.exe	130
PID 3240 wrote to memory of 2412	3240	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://accounts.google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffa321ec188,0x7ffa321ec194,0x7ffa321ec1a0
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1941213916397314465,17867157679517275639,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,15377224478082069839,10267857488366299175,262144 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,6382911289330715314,10105973745864956995,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,9564034396478303249,3449541438642947926,2097152 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,14464190139666722728,5640086488693234333,2097152 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,18025544234160075603,8209224607207472661,2097152 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,14365261454262188647,18255680542163647399,2097152 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3956,i,16241412074492331679,11110936451302747168,2097152 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5344,i,17402652592183033917,5024717837307072374,2097152 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,2732676533199888057,2767550460606369733,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,10754743248360292427,1248434552519085282,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17109221960915168311,13407730037480972057,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,3440430884617068408,7338185220610582051,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:12
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,15818541790915098037,7147490056182131705,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,15818541790915098037,7147490056182131705,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,14079259209418809895,17295691705188564091,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15897850424391402049,14163830812240238285,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,8089775816429396793,2573356255965384581,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3153497586516968834,11197756211892576385,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6704,i,16477521676888569426,16521708661684134603,262144 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,8181234066862747504,3149749411618435888,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,3510600431056347132,1643179869438936595,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3064,i,12213688327213608611,4045845880392753392,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9591911668390586226,5620321136479053861,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,8922727783765336311,9019922030726234267,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,4055233183708194602,4715880113236902904,524288 --field-trial-handle=2736,i,4028666180402176693,9749785773778299129,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1132

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c9f4df42bc7816b43381bb75924e382123fbe55e207191fea83b0f8bc6cc2445
MD5 cac7bbf2b77b4b30350c9dde532a2314
SHA1 1b0b2922a80ad680567a82a5842e47cdffd045bc
SHA512 7869ec481f4ca5d28c22aff8a0c89d6fe7fa360760fd3be0a129d3f589fd635034b9f390082710e9c0e7f46b9662ab9238db739ff4f5d2c9dd5675823200ec65
TLSH
T15EE026AC04CBD22EE60C748782FCFF4CC2C0371A96CD6B0A1700C88A7486448A6C2B92
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c5b7c6a8216dd606bf193da56e478387ba53148075c1afd175a64ea97361a60d
MD5 9c21af0e01690d530141a2cc581c5753
SHA1 67d1548ea9b6faf1978c7d9e226952336c88622d
SHA512 a857e4d2f81bfa76145b205134e6beaacffc04023ceca39d4807e8b85e1408491c9483307be679be83f84f84310c8f0af3bde41dc76c1321124dfb957cecb95e
TLSH
T1C8E0269D86CACA7EB708B447527D6B4CC2883B4B9ACC7A9A174084877406448E6EB791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 77705f4b8474c3674426c3447ccb8a3cee19d1f2cf43b1dec9ab2aa89ed32d34
MD5 e3a91418aaa84d411775117eaba822eb
SHA1 23e2b92fbb3720a19d90ef6da6b3f7d4b0011702
SHA512 fa8d9f3d2062e45f341a3cff88e48f591b2cc5c1ce08948c6c1a53f061b88fae9e444f8eac735f9c68ea61361672a0f5cd9207d41a817ab854e0f64221851ae9
TLSH
T1FCE0789C15CDD25DB5087467437C5F5CC2D1374BD7CC7A49170C84C6B40345572C5E51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 88609811ef9b3b2d4dd22c113c2db4f05d02cf9015ed7ed094bdf0b88615ea04
MD5 b60cfcabffb8ef7cf85e7b3d1fd51d0d
SHA1 420d67321e4244d8809b0a6933379624aec33f95
SHA512 6114c47fb7645f3f4985db3d08a602099aad234758d8aa2a979ce7be860c11042af64aa48611e28b6c4b941fc7e7dac8afd82cc5a389093f8c0aecea3108e6b8
TLSH
T187514301ABE2E14DDBDCA0320980F493253C64B0D2A7AEE152D4D1F5E97BB3F8A0D188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598bdb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598bdb.TMP
Size 2KB
SHA256 aaf90dea758b504d4ff1ed47a87ca9457f9f7d93e8b89fad9ea70a76aa5928e9
MD5 7d2c02d87b389ab273494b09382745f1
SHA1 16185552089b76fd60d5e131b5409fac364b2db0
SHA512 3bd353ebd531137e5151d77ead1befdb50250e37617e93cef66288dd516518ed2bc6b4ee57e40998b3836678ad5288dcc1af469bc3fd15b7c211e0f8e49865ed
TLSH
T123512F05ABE6E04DDBDCA4324C80F0A3713C64B0D2A36EE216D8D1F5E56B73B8A4C198
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f1ecc91ebc2a3106fb3d3cef3758ff391909e10e09cd69943f054ad0bb75aab6
MD5 9971203f47e700a16e5716129efca5d1
SHA1 8d8df6998b3aa65362a368052aa023e8b856625d
SHA512 882c6daf581425d9eee4c59f093877447bb0c6162ea895942cc0ac1b59d1fb5a7501b16403315a2eb68466740184888accfe5b23a33e04fb16c0e495e9b9cb24
SSDEEP 96:D/OeZwOLO9aXFizBuq042OZNwWGj4/QCR:DWeZwOLO9aXFi1uqJrZNLGj44CR
TLSH
T1A28199F7C3E5822DD91196F4AB15AF2FCE2D0514432C3C6A89D4AE27D3E2472E105B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2681a61b3a391b37eb69848c2ff343205944a508eba317363b29f777afcd0a2c
MD5 2b450662984156f09e69e43abf675ccf
SHA1 6ad7a01a9278cdefbc23a2b210abf8c347ab52f8
SHA512 a85a2eaf5c5821d00fb6a6b283813a41710622fb91717608af18255e2d145e5473ab1fbdf39996d75e9b0de5a4abaceae633da4f1c9ed4567a509aea6d3b589b
SSDEEP 48:YALlNdOh8nh8hbNhuhoAs1aCZsTfoKsKgmzs/zEsjEuC90Esc2Ns0csSf4sQCKsp:DbOaqRNsO9aXFcznEuq042TGQY6mwQ
TLSH
T145918EF7C3E9852DD90156F4AB15AF2FCF1D1918432C3C6AC8D8AE5B93E2471E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ff0eb4429858a9e85170a2026ca3622bea81bb0b152adfc003e19f1320341502
MD5 babb69785ecaa53ea7fcdd7b52c4842b
SHA1 9af3dfcfecfe90a0edf1265fe79d31b621a750c9
SHA512 62060503f222e2a9df214195e46253c5f6f7968664d706698802a12b2d05c10ce490b1489f7a51305ce3281abbdd5923f3ceb1e14c2f34e9ee87276860d0e56c
SSDEEP 96:D/OeZwOLO9aXFizBuq042OZNwWGj4/+sR:DWeZwOLO9aXFi1uqJrZNLGj4GsR
TLSH
T19691AAF7C3E4822DD90196F4AB15AF2FCE2D0514432C3C6A89D8AE27D3E2471E105B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e2f001d6a1d5e1a9cdb1bfcc7b10331a76f68057a4cdc6e3722c063b0d72654e
MD5 920ad1e00413b13da3dd217ad5d3469d
SHA1 506c71825324c31bcb2cd777be12c7333f344c82
SHA512 aec52e35f713cae590aa213a6295c20a3c0deb00cae095ccb89b460878132526c96e8af11cb01ff452cc8ec5b64e95ed523fe90b8e37338aef3daf07d11f19b3
SSDEEP 192:sxRURmpbh/fusBnzoA8pWNA/g6+WNkdS/YoaFG/OIgDRJ:sxRUoh/fusBOV/5X/Jm/
TLSH
T14E32C616AD28A97B8CCBD21DFA55BF13E2F91032A1D51F48B6FC961C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fcecf9d6099c83d99725cc9ed2768d1b6fdde448bfdaa763872c4f2e85217d83
MD5 377d8f152faf7785bbb05922f55a95af
SHA1 9f3d87e21bd98ce3355b69f8bfb03061129915de
SHA512 8075667590d87e4d6d62bbf30429cb9284ed2f4aa1a3c00ee1e8b7fb2bc85455d03a6500eb89f8b21e6aa284a03b43bc2d09012679ac3ffce7fb8b864022697a
SSDEEP 192:sxRDRmpbh/fusZnzoA8pWNA/g6+WNkdS/YoaFG/OIgIJ:sxRDoh/fusZOV/5X/Jms
TLSH
T1ED32D716AD28A97B8CCBD21DFA55BF13E2F91032A1D51F48B6FC961C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 f5e70afd7030ef5332f4aafb31ff9c9718caf3f77f27f929ea65669211179de5
MD5 7a7d962be2e8ea4ecf511525a7aa2250
SHA1 20226d37374550c6b342aecec1d4c168e7570cdc
SHA512 cd95a01e3be95f772ec4a137c0315bbad5bdef2a63b7ab2309fa919b160f0e77cd07670b21b434fdbd79b75e20f8e856b6cad7d0a246dca1c99167ce493d1333
SSDEEP 384:sxRUoh/fusJ66s8qMpRiYnazAW8pZS15posJWeT+23Oj/5X/jmt:swoh/fD4Mnc7WeT+23w/5PjE
TLSH
T1EFC2F605A824D83B9EC39D1C693D7E33EAEC506222C5DEDE16ECCA1C019E1F9AB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 784781c5102dda46dd054166e78781d96e90079e9d7f9ccd74faf527ea5aac5a
MD5 99aac78917f7b2af58c6ddb507d848bf
SHA1 a7a882f7d63cf229f9bdc127b8fa2613fa1bf5f9
SHA512 7926b16f8af32246da90bfa0902ef54daa8ad815bee91297398ee5ba7b9d74c27d0f30a9b446429f9ac2c4eb7434e11ae8ecad6d9b284547fe83bb35813678e6
SSDEEP 192:sxRURmpbh/fusBnzoA8pWNA/g6+WNkdS/YoAFG/OIgDnJ:sxRUoh/fusBOV/5X/jmt
TLSH
T1A632C616AD28A97B8CCBD21DBA55BF13E2F9503260D51F48B6FCD61C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 bd163944b34280e906a95972558ad326839a4fe981865c74ccf41fab0507e898
MD5 0398b1548b6a0ec7a7c022ec0c89b838
SHA1 88640963cc4469ce3245fa3831d365dca5f07c14
SHA512 a9b69a2371f603062e8eaa7e34661fa3bf0456246f30840008997f38cad0da5d14c0ff1f86f88df4d51fc8bb4cf9cc2b41791321dd3c1db126ea815af4db2fe5
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUProndm:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0VZ
TLSH
T13EB2EA2B704DCB7F4FC04A9D9C196F9B6D9802C796588D8047FED94C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 4f53ef76645f2b8d5ade8bc2028712b48ce8384ac50f19b13d512ba88021c6a5
MD5 e50332dd1e6735f8fb2251699b821dfb
SHA1 04a5921180fb2db2a92d9127ef27525b56a1e4d5
SHA512 14cee4fd3e5b97a1dc8dac108dfe23a8c69732fe6197b75c848adca48a82489d79ed5b8d5c0a4c781ddbaedcbbe4bd179ac32b2c46a41ae7e38ff9541fa19491
TLSH
T19AE0C07F2EDB7C90E85FD7D228724490020974D8D980DC8F2037DDCBA5B23512405C23
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4e94bfdfea31505ff19aa5756a8b62a684054712a31830a158f135d63ec78237
MD5 e58041836fe62f42006b2ee5426f8813
SHA1 dbdc31c8c7263550e5fbf0a4bd4cc46509051697
SHA512 675a8343a389f63d9bf5ca266840c02776c1c15c3f45367716fc6f05618817a9a5ce5c38ae0d499669061840204756d1ffcc0ace647b3e8f1af4b420abea7f38
SSDEEP 24:Kr1OJk9I/KZhq12S0LfyXgrMXsHIDKjh61qSqBLyX5K9akoItKGhc1eSH4cwTwz:KMCI/KfqQrypUIDKF6cfy1DItKwcAYz
TLSH
T1159117A0B1760644393E290A92E49B2FC5423163B038E53B7FDE11A59E37E050EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

eaf7d3cf-4f20-4a94-ad26-6c438f6cb587.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eaf7d3cf-4f20-4a94-ad26-6c438f6cb587.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a08bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a08bc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 24d1ce3992c611dd397aae6d5f5f3524f4d6c6a253d83bdce87684fee89b19ed
MD5 200bd11311e8baae4ba9f9ab66a0ea64
SHA1 c8886677c5140cbfb2ee602a120f76ead6104680
SHA512 54dadf864fdecaad57e3dd7356e2f4b6c8f542e48abe52b1912aef1c3d98b0eacdbdef89b5ccd15b5d50cbfe25a3adf9584c4bad05cccb958a0fb942bfecaf66
SSDEEP 768:5U3XOmwOKMt4he/9OA9at01j0iq00+IaiX2sNs:5U3XOjCHq00NaQ2sNs
TLSH
T1CEF2AF72ECB59D77ACE6E284720A73525FF44513C6CD9B8089ED2B0D01579AA130BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9f2c5b1e633bff73ec39a01173e661928c7872839632265875295f07c9342280
MD5 3963e88cbca0050e2c1ff94b248847b6
SHA1 d6ca277f9816f347ff896ef5273e40d8bb229c28
SHA512 8265325676ce8de4b9afabf6da9c26446808435d7d1cbc9d1c9c73ca201aee016c66d09aff7e6d9767161eda9a1953e2d1d8c1a0591bd7706daaf790b0f666ec
SSDEEP 768:XU3eRwOKMt4he/9OA9at01j0iq00+IaiX2sNs:XU3eACHq00NaQ2sNs
TLSH
T177F2AF72ECB59E77ACE6E284720A73525FF44513C6CD9B8089ED2B0E01579AA130BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 0e04ce5a33e28fceb37125e8c588593ae0827ea21ed197150696618d75bed0d1
MD5 70b4d20223a0a42f145be5256d678a37
SHA1 2bc601b2d2ed52e88768576b204d4587ccab6c84
SHA512 75bdf17589708be93a7fdd8ee8da854bb96e3c04cc44a3e937fa3bd1a6be973495bddd707d500d54ac3fa288fe6f546b996870565edf7921c445321019de5748
SSDEEP 768:X/UxvxjgC+H3unVOKMtS/9OA9at01j0iq00+Ia2PvSHxRz:KZj3+H3ugCHq00Na+vSTz
TLSH
T1E903CF32ECA15D779CF7B384730A63979FF44663C6C95A904AED2A0E01476AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a0be3e84c1079e666e68080f2b41d05f172ebff2b7016d352a1732329e9f166e
MD5 4aff096cc00e9b036552e32e0e42cda1
SHA1 6e95ba864f813b3773961b8342ba7ccc41518f9b
SHA512 29ecb21ac9c5e4d8f92f02cb94543167f49fa44a3717fd59f37cc7c1edc05db84bd8ca9e5b5b2e00310dfbfbe2f5741f3e11c920c530c130be1e06ae1304366f
SSDEEP 768:oFQ13rwgrOywOKMt4hd/9OA9at01j0iq00+IaiX2sNs:L13lOOCHq00NaQ2sNs
TLSH
T1EA134AF298D38977ECAE9787633D2E019EBCC113B5899680B7D9190DCC165BFC306866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f2b0fa7-5975-4c31-8d5a-9391d91b93d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f2b0fa7-5975-4c31-8d5a-9391d91b93d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download