hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260930-raey7stdjg

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1140	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{3B5321C0-199A-4256-8C53-D37463BF4EEF}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1076	4608	msedge.exe	86
PID 4608 wrote to memory of 3708	4608	msedge.exe	88
PID 4608 wrote to memory of 1140	4608	msedge.exe	87
PID 4608 wrote to memory of 3708	4608	msedge.exe	88
PID 4608 wrote to memory of 3708	4608	msedge.exe	88
PID 4608 wrote to memory of 2100	4608	msedge.exe	89
PID 4608 wrote to memory of 2100	4608	msedge.exe	89
PID 4608 wrote to memory of 5032	4608	msedge.exe	91
PID 4608 wrote to memory of 2088	4608	msedge.exe	90
PID 4608 wrote to memory of 5032	4608	msedge.exe	91
PID 4608 wrote to memory of 5032	4608	msedge.exe	91
PID 4608 wrote to memory of 2088	4608	msedge.exe	90
PID 4608 wrote to memory of 2088	4608	msedge.exe	90
PID 4608 wrote to memory of 4960	4608	msedge.exe	92
PID 4608 wrote to memory of 4960	4608	msedge.exe	92
PID 4608 wrote to memory of 4960	4608	msedge.exe	92
PID 4608 wrote to memory of 1464	4608	msedge.exe	93
PID 4608 wrote to memory of 1464	4608	msedge.exe	93
PID 4608 wrote to memory of 1464	4608	msedge.exe	93
PID 4608 wrote to memory of 1176	4608	msedge.exe	98
PID 4608 wrote to memory of 1176	4608	msedge.exe	98
PID 4608 wrote to memory of 1176	4608	msedge.exe	98
PID 4608 wrote to memory of 4404	4608	msedge.exe	100
PID 4608 wrote to memory of 4404	4608	msedge.exe	100
PID 4608 wrote to memory of 3944	4608	msedge.exe	101
PID 4608 wrote to memory of 3944	4608	msedge.exe	101
PID 4608 wrote to memory of 4464	4608	msedge.exe	104
PID 4608 wrote to memory of 2096	4608	msedge.exe	125
PID 4608 wrote to memory of 860	4608	msedge.exe	126
PID 4608 wrote to memory of 2576	4608	msedge.exe	127
PID 4608 wrote to memory of 5176	4608	msedge.exe	130
PID 4608 wrote to memory of 5176	4608	msedge.exe	130
PID 4608 wrote to memory of 4216	4608	msedge.exe	135
PID 4608 wrote to memory of 3824	4608	msedge.exe	138
PID 4608 wrote to memory of 3824	4608	msedge.exe	138
PID 4608 wrote to memory of 1288	4608	msedge.exe	139
PID 4608 wrote to memory of 1288	4608	msedge.exe	139
PID 4608 wrote to memory of 2732	4608	msedge.exe	140
PID 4608 wrote to memory of 2732	4608	msedge.exe	140
PID 4608 wrote to memory of 4240	4608	msedge.exe	141
PID 4608 wrote to memory of 4240	4608	msedge.exe	141
PID 4608 wrote to memory of 1680	4608	msedge.exe	142
PID 4608 wrote to memory of 1680	4608	msedge.exe	142
PID 4608 wrote to memory of 4036	4608	msedge.exe	152
PID 4608 wrote to memory of 4036	4608	msedge.exe	152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa2243c188,0x7ffa2243c194,0x7ffa2243c1a0
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,15109621319939872500,4826756429324943511,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,13799693158678337420,18351658250243052094,262144 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,13788348549358078559,1565623041915876475,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13224691177779616908,15893511168290772632,2097152 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,378559560425665871,3527237296007039557,2097152 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,3113613330980520742,2420102995699121782,2097152 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,2663503165435383640,2626328983877600473,2097152 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3756,i,13301238619389214939,12431649913938501993,2097152 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,2095562362507614002,18768436860530333,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9135055352164597392,2592629215339675654,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,3465735986452300731,13814995118893650485,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,3465735986452300731,13814995118893650485,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,7741292814989449278,6652014573135345124,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13577050691454769570,9352693052083861158,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16290185624650077553,10864074047406110126,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,10483963896489775871,6935463215296752333,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4464,i,14810647011660648316,10156378265270016203,262144 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,16092874368063906176,10137012979920920597,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,5966749571474872131,11062033105028007134,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,13718812898566229547,14355631285869071110,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1352,i,3041724831533743243,10680091966958288779,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8236723660342531924,11666198163054438299,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,15178432199707281858,8434963930323008755,524288 --field-trial-handle=2904,i,12342407354368597296,17062590289742091819,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 02c631842186a8ca19b0de31ca7d2c060e56851719faa5bfc6bd7af15717c5cb
MD5 4d2a0f9278c790efed6c3aac47055f3e
SHA1 8169813bed5561ddc93b382e5a5109a083e0ac2b
SHA512 232d207ee6f4bae86cd453315de35779e5a40fe322af186cfd779d0c1e206e7cca4fb345cda0f036f2e0ca2e6004d4ee009f326e8275accc77cef4453c0ec72c
TLSH
T165E026A5A7CEC3AFF708648B43A8570CC2A03B5A97CC7E2E6B00CCD97042450B282AD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 51d433da452ff51aa0c6ccc2104af8bdb528a27534a7728f58bcc5c9250d7b88
MD5 8888e2138f310dcb242b1a7fcdd50fa1
SHA1 71ec84b332ba3b737ba4b66e48f16b2258f0d6b6
SHA512 146cfbf76dee500cb01c2f8b088495f96cd7f90c446303b4a22579b789e84bc552f8406cfcd9e257fe284d5811e0f6c386430146dd4c2eaed3d6cd3ca841df04
TLSH
T1A7E020DA45C5C7ADD31C64878275770E81913B0B92CCEE4D2744886DF0018C47EC15D4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f5585f9721063dffa473afa2f7c2c36a8a7d57232b9a44b94a3c7901cf11f4f6
MD5 3aefdd7dc94d5fbd0eb73df7bf7fe02e
SHA1 505ff997095862305a0efd3305b9b0448900a12f
SHA512 c907d247bdae75c9c209de11efcb421342c8676c4faa3e2aeedad117502058afc33475ab99a04902ee11768069269596a185036db097e8d42a9b0e06ddab9fb0
TLSH
T1EB7196B559E49A60F75048B1AAFE32473B3F96F107C35F820950D578EA15B3130D6E82
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d274dc80fa91bcb2c23ce9671fafd023b4bc24c98920cbad32011ff43a96ae69
MD5 a5224261c495e7cc5351e2f800226c55
SHA1 e91f80b84d2397f7e50b8f993f21007c6d73d11a
SHA512 02c6709f6b722cdeb19650d71c3820d830309f1df1354e540f63af1d333bf92348084190b304849520e2d9a46aaa9b68c2990863755a56dda5d0692ce199c5b6
TLSH
T12F818BB7C7D9812DC81556F49725AF2ECE2D0A18431C3C2AC4D8AE5B93E2871E11565E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 111b93e1f8d847f98309d01d196c29634bbe5bb19d535dc040b71a92cf0e57ff
MD5 b39d8149d89da04633600a3fd7b7d5c8
SHA1 82a53b412a8a8c3d41b7f7a6302b839c51ef9f04
SHA512 776242e290f7ac5ff0ed306fe34c92297c0424b6dae32cff7c69ba42c8656e782fda2f723da7274ffbb2a81c94f48f1d3f12a973ebea047f258209959d1ca861
TLSH
T10D5177F783A5822DCA0196F4DB15EF2FCE291614431C387A89D4BE67D3E2432E11676E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d35b355e5ae128a822c9164c9d240d59569bb84cfcfa67333152a6e2c8df307e
MD5 71790f1d473d0dc9a850578efab576b3
SHA1 407d315a5b65f0df9aa71f340dbe47ae676cabcc
SHA512 1abf92adc6a4c3739efbcc2b09617d2e001b9095dcd2a514d280a9e400b465c3890874cd212af11aea656f29c9a8f09b3bcbcae6b74e4912b7ccb27b5a56b2a6
SSDEEP 192:sxZCRhWP/frszirbIdpqGAHW6+WNrPl/Y3ksMIg5dJ:sxZCeP/frs+rEWHbJ/VB
TLSH
T16222B912AE78697B8CCBD219BA65BF53E6F9503291D41E88A6FC851C04E7BDD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b9697936490c0d14868e6bfc8f6422512e04277c56d31dc63a66faa1bc1c5633
MD5 7cbfd91a4c82284d032d0c8a3a5e2d7c
SHA1 7912a4f737f8d5f6187a7557a05289c630261947
SHA512 a596f9aeb55ac467fce952b61bffa3bd9acd820391fb7a034f2b4e37975469e7c9f0eebf5208458d0159a21cc1216ef4dcca559e5d38735fc8722ab9bf8077c8
SSDEEP 192:sxZCRhWP/frszVrbIdpoGAHW6+WNrPl/Y3kAsMIg53J:sxZCeP/frshrE8HbJ/7Kn
TLSH
T19332DA126E78697B8CCBD20DBA55BF53E6F9503291941E88A6FC861C05E7BDD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2d60d0ba3868e356fd3be07cf31fb52a2cdd37359e640a530fe18b2685e37db2
MD5 aa35ba49643fb7c6bf5a2b2df4cc26c3
SHA1 a4df0b346d0aa2a9a148b9e4b595777b8a3e1350
SHA512 51da7c65d04af5fc933d0bcd8a0ad97803654f1c2bc2cfc56ebc01d70f6de578e39d27d6f6f6adeac4949e0c8ab80b5a9615b5f62230cd55c5593f7c0d47b8df
SSDEEP 192:sxZCRhWP/frszVrbIdpqGAHW6+WNrPl/Y3PsMIg53J:sxZCeP/frshrEWHbJ/en
TLSH
T1A622C9126E78697B8CCBD209BA55BF53E6F95032A1D41E88A6FC861C05E7BDD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 bfa422c22a4a47dbbfa4c703901b7cd0725a60f77467d8a018914f946afc0f0a
MD5 0c1573d9528c27bf84532e6b31ac2fe2
SHA1 bee7a43ad7fcd331c53b60a8de6fd81e1e8c2c2e
SHA512 0d0c8f79c077d7fb4fa711c9f87760df94f9d3c4a61b2179178d4c7b7c5a5c62ed0fe0607163257cc3c4a1b4f9dac1d573e57e28f989534e441e2237e5dfa01c
SSDEEP 384:sxZCeP/frs966s8qMpRiYnazAW8pZS15posJWeT++rE8HbJ/7tn:s6eP/fk4Mnc7WeT+mHHbt9
TLSH
T1DDB2F605A924C87B8FC39D18693D7E33E9EC506222C5DEDE16ECCA1C019E1F9AB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f11e1be3fad9f863b17f676f084f2f29865445bca49d7bd6b338d3eb5c32bf44
MD5 111a6c19dbbfb81d89a5c8f2eeb5e533
SHA1 5b949e5e19d4c62e058f7822de60a4ba439eac8c
SHA512 52efb71cb6e4834d8340fb88ea9afe1364b6aa1c5d63ac409fafdbf442a5a972060bd4fd836757c28cd6d760051f3ae3953184b186edfaf84e3d26434ffdba5b
SSDEEP 192:sxZCRhWP/frsIrbIdpqGAHW6+WNrPl/Y3ksMIgrJ:sxZCeP/frsIrEWHbJ/V9
TLSH
T18C22C9126E78697B8CCBD20DBA65BF53E6F9503261D41E88A6FC851C04E7ADD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fd610b43adea20662bf354576f75f0587465a33897975cd0f6a5565c9fcf08a0
MD5 8e754def889a3ef2dca16fcb433e7ec3
SHA1 e727125a12545d77e665ad0275559484a375ecc2
SHA512 d3509cd81444d14b387519ad10e854b121b024d1269a968da1f04f8d93c5080a6387a25d62d68383e8151867d260335a156f10edd8c7fde937e4894939c6c2d6
SSDEEP 768:mS30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72BrolZMb:mS30AbSWvS2l9u1jaLmLZ126c
TLSH
T134C2DB3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796644D4047FA984C02C77EA51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 432B
SHA256 d0c8c656a4e84e7e645df08d7dcaa261f03b29589b55143eee20efb63a19980d
MD5 3a88999cfa4d140f3207ac3f8cd9ed51
SHA1 5f0f8411ea738d2b3f8d172390383d063562a86b
SHA512 089771936756d475054396bef593c3307543c162a3d92e4a2b14a11c45470ea320086b24c48d6121ab15ec8ccd1b3feb2a37fb54bfcccfdd634068e6f784a7f9
TLSH
T145E026E91D138209F8588074707E60629AB125EC92A42B0E60FD905A8C893906E85A5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dcf39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe5dcf39.TMP
Size 432B
SHA256 f9aa21436a5fe08b62c2b7905da76018156e83053cd7083248ada0646df67f63
MD5 a2db8120ea2d4f9bb094e0acbf4d3ee0
SHA1 b24d3508a1a3acb63c0cdf4c6a79d698c5132445
SHA512 81e42fea3994d88a68c7204a13c6dcba0de458eab67362b012fb6f88400555fe25c0a5175ef8e2c8a57750a5298d7eb5b05ee372398aeb1b12cae00a705df28d
TLSH
T1F0E0E7EC42138349F8084130755F5023A1B15458E3603F4FB1FF5056CC86B947E82F74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0163920ab19295fbac7699b766309f7b6a377d4ffb9875fdcd695a6cf8166f17
MD5 43444c79540cb6f1ac1eeef7def90abd
SHA1 b31b61daa283fddb967c92fcb2da9401be7e4826
SHA512 497c79fc84b40820de1f862b2d1fb86ec4731213bbc8d2508e718cd7271309eee09935b10bdf053ef09f1d86f7ab5757a6eb9d98b11ba1af4c882442ab00e3e0
TLSH
T10AE0C0F27DF71950FCEF83D4587088B181097894EA08FC4F50AA63C7B4703113809C50
MD5 SHA1 SHA512 TLSH

Submit Download

fc321dbd79d46c6d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\fc321dbd79d46c6d_0
Size 193KB
SHA256 ac19eff6f81b943f036143c3e1de405bdbac8321048a4200bc9638a5eb3e8ff3
MD5 9787cd04578f59b16ca8d8b4f52ccd80
SHA1 6fea21adf0695c6fad1d6467a6410379dc739043
SHA512 83f3a5c9e82e7d192752538ae27740363a43d91a1e17905ed8331beebb8f26e6490b6fe179fe5fef0dec6926219d67897a1e85dd940a014a34f3786263bc2283
SSDEEP 1536:aoWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:jrFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T116145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 cbf2cf4d5e84f7b84693b49704809cec54f1ae6bf7db9c4e5c26d0d9e04e5c98
MD5 590986185d62dddd92706b12c4994f58
SHA1 0364a07223170f447ee6d5a3379bc3a55d8b3b6b
SHA512 3bce1e668a15bf296a50eafe2108384f1a25409d866bd1655c72b00cd5b63ec0fed8966dbf1a45192b96f05d0cec9c450819146ae45d3927fbd85d24a0bd93c4
TLSH
T129A0021812E05C45CC5947755783055067758A502D1D8E4759A4A084FC62E914542029
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2cc0601803b4c06080c8220183ac509161128348200df0c174e1a2e9a7e96b81
MD5 592cbc7d12964bf0f24f7b9277bb1708
SHA1 13aa25716d2fe960b35819bb86c0048a02bea746
SHA512 0d335254a35e3399a9048bcbd5418ae3253f9978138535e63d33d73c51ad8ffaee624f8075fb576b6e314b46f5b769fcb9bacac8f55830220f5156d844c640fe
SSDEEP 48:KA5ItKSgIPylrIVKMU48hIFKCQYPyzFeh13bX4z:KA56KSgqurqKMUXh6KCQSiz
TLSH
T12491EC12717A02423CBE695C81A6976E428239B77018FA2F7BFC40B65E27F544DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1f80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1f80.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 786c9f6cd4c787b974152ef4cda36d877674986829ae47e7a61e4c2b9ed3cba7
MD5 3a1894aaffd80d87e94da1fffbb09acc
SHA1 5ff91116980e1c3a6fc64431336acd33ea9e654b
SHA512 4977b418265678f43803fb61f191f7f3478e9108e3bbf1501180bc031ca2c345a36c668bc3da290c99fb31cf47b6f5bfb57342207f10aa9397395dbafe5e95da
SSDEEP 384:47ZcIfsNFCQpuusyu9iX5FF+UcnW2tgOIwZOyJLUoO:4jfKMtaZBeW2XsCYJ
TLSH
T1A6826B329CB89C7A5DFBA141B54A36039FB8916BEBC85F94D4FC5B2D05EA594030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b1c78dc7e733c0a2e7b37243ebe6175ef3ca11b37b48f8570286dd05d48da81d
MD5 b67eda3803006aec962b98b58edb681b
SHA1 99351996b70492dbf398805acc6a81eead564441
SHA512 2a464f9d82bc37ed3909066d62508dc98dec3600bd770474b8a26e1511a7c560b80bcec897aa6dd62140853857026d2cdfa4a006e17e34b4d48f8adf843280e8
SSDEEP 384:eiF77ZcIdJsNf8TUNTUlIlCQpuuLyu9iX5FF+UcWW2tgOIwZOyJLUoO:1F7jzqwgNrtaZB5W2XsCYJ
TLSH
T1CFC218F248E7887AD9AE8743A73D2D039EBCC067B5849A90B798561CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8a76290034c1ae3a4929013e043fecda26b4924940394679c0a520fbcbe205a2
MD5 90eede230bc3457f7dcbae7e8d4aee80
SHA1 5db7f821c1e6eec022a73e357102badfe828113f
SHA512 fd821429d8146d0736a950a89b1667300fa8139dbb176c64876ca4e38e91c31fc983f4ccc625ea7c8f9a52b9c72f0d81648670205bb20d5f4bdcf97161c8e82b
SSDEEP 384:c7ZcIfsNFHQpuusyu9iX5FF+UcnW2tgOIwZOyJLUoO:cjfjMtaZBeW2XsCYJ
TLSH
T117826B329CB89C7A5DFB9141F54A36039FB89167EBC85F94D4FC5B2D05EA594030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2be07949ee7206d23c7ee1d3dbf5af3522696be0d43e44567cffaa8a0a6db708
MD5 22a82596281021244e02de45c314b41f
SHA1 f6d68bee12172c2ab6fe1423364186ed25ea46ae
SHA512 37f2ca96e1513dc2d1c55e66b34dd054b464dc7b4f311c3112246caa442e87bf22cb6648109eb4c67585ee05cac36357d00e4ce32beec7d4325d416ffc5cfb51
SSDEEP 192:LONm6AmwprQmiUyBZ6siX5FSY+U9JiynxaU6:LONm6ipdM6siX5FF+UqWgU6
TLSH
T177020B35AC686C7B8EF2AE55B58B37239F99117BEA941F84C9E81B2C01D764C1306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3637c0de2b45b3f8b6acd979527fadd59f0345ac0b5c170beda7c3260d6f2ce1
MD5 044aeb51e8e82adc8f10c5b2fadc53b6
SHA1 a7f6a73f61e7b365801ad0a1c7cf3d43a06da812
SHA512 740d245a2a491793b7c93c0c53876c646d50a6e011d0f576700f56465069f7376fb22cd28008799d45795a2ab2969738f963e4ec9bfa5070a7455b46baeb9fc1
SSDEEP 192:LON46AmwpcQmiUyfZlsiX5FSY+UcXejxlRynyqmU6:LON46ips8lsiX5FF+UcMW2U6
TLSH
T17D122B35A8B86C7F4EE3A550F48735135EA55227EF886F84D5EC2B2C06EF598530BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d736fcab-207e-42fb-8280-3267ef6a01eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d736fcab-207e-42fb-8280-3267ef6a01eb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 88c6fc358817effabb80f245277bafe864f59d18e241683194a015ac1ff65736
MD5 4b6fa563944a9bfef458282cbd47ed5a
SHA1 c184807dbba008a7b9651db4bfc2f98fb2f82925
SHA512 f8b94147907064ff34187368d3aeb9652bbdee0934dc4eade8eb7db2b02d1598443d189392c0fc89c8ad45b80ce7eeff7e7761c65fd335d9716a0c772cb86d66
TLSH
T10541F858AAEA1148B3B77F5AABF6686D847A79771F07D49D00120E4E0627A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nr4b23so.d5h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nr4b23so.d5h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6016-230-0x00000234FF190000-0x00000234FF206000-memory.dmp

Download

memory/6016-229-0x00000234FF0C0000-0x00000234FF104000-memory.dmp

Download

memory/6016-228-0x00000234FE150000-0x00000234FE172000-memory.dmp

Download