hxxps://fqozvz[.]axshare[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/07/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fqozvz.axshare.com/
Sample260707-ege7bsev2q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278700776151620"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{1FE81168-0744-4B76-8775-466EDE094B66}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1100	4800	msedge.exe	79
PID 4800 wrote to memory of 3428	4800	msedge.exe	81
PID 4800 wrote to memory of 1736	4800	msedge.exe	83
PID 4800 wrote to memory of 1736	4800	msedge.exe	83
PID 4800 wrote to memory of 3460	4800	msedge.exe	82
PID 4800 wrote to memory of 3460	4800	msedge.exe	82
PID 4800 wrote to memory of 3460	4800	msedge.exe	82
PID 4800 wrote to memory of 5012	4800	msedge.exe	84
PID 4800 wrote to memory of 5012	4800	msedge.exe	84
PID 4800 wrote to memory of 5012	4800	msedge.exe	84
PID 4800 wrote to memory of 1616	4800	msedge.exe	85
PID 4800 wrote to memory of 1616	4800	msedge.exe	85
PID 4800 wrote to memory of 1616	4800	msedge.exe	85
PID 4800 wrote to memory of 948	4800	msedge.exe	87
PID 4800 wrote to memory of 764	4800	msedge.exe	88
PID 4800 wrote to memory of 948	4800	msedge.exe	87
PID 4800 wrote to memory of 948	4800	msedge.exe	87
PID 4800 wrote to memory of 764	4800	msedge.exe	88
PID 4800 wrote to memory of 764	4800	msedge.exe	88
PID 4800 wrote to memory of 3772	4800	msedge.exe	89
PID 4800 wrote to memory of 648	4800	msedge.exe	90
PID 4800 wrote to memory of 3772	4800	msedge.exe	89
PID 4800 wrote to memory of 3772	4800	msedge.exe	89
PID 4800 wrote to memory of 648	4800	msedge.exe	90
PID 4800 wrote to memory of 648	4800	msedge.exe	90
PID 4800 wrote to memory of 2280	4800	msedge.exe	92
PID 4800 wrote to memory of 2280	4800	msedge.exe	92
PID 4800 wrote to memory of 2280	4800	msedge.exe	92
PID 4800 wrote to memory of 1672	4800	msedge.exe	93
PID 4800 wrote to memory of 1672	4800	msedge.exe	93
PID 4800 wrote to memory of 1672	4800	msedge.exe	93
PID 4800 wrote to memory of 2340	4800	msedge.exe	94
PID 4800 wrote to memory of 2340	4800	msedge.exe	94
PID 4800 wrote to memory of 2340	4800	msedge.exe	94
PID 4800 wrote to memory of 3248	4800	msedge.exe	95
PID 4800 wrote to memory of 1448	4800	msedge.exe	96
PID 4800 wrote to memory of 3248	4800	msedge.exe	95
PID 4800 wrote to memory of 1448	4800	msedge.exe	96
PID 4800 wrote to memory of 3996	4800	msedge.exe	97
PID 4800 wrote to memory of 1452	4800	msedge.exe	99
PID 3996 wrote to memory of 232	3996	msedge.exe	100
PID 4800 wrote to memory of 4448	4800	msedge.exe	101
PID 4800 wrote to memory of 3536	4800	msedge.exe	102
PID 4800 wrote to memory of 776	4800	msedge.exe	103
PID 4800 wrote to memory of 2620	4800	msedge.exe	104
PID 4800 wrote to memory of 2620	4800	msedge.exe	104
PID 4800 wrote to memory of 2864	4800	msedge.exe	106
PID 4800 wrote to memory of 2864	4800	msedge.exe	106
PID 4800 wrote to memory of 2864	4800	msedge.exe	106
PID 4800 wrote to memory of 4668	4800	msedge.exe	107
PID 4800 wrote to memory of 4668	4800	msedge.exe	107
PID 4800 wrote to memory of 4668	4800	msedge.exe	107
PID 4800 wrote to memory of 2684	4800	msedge.exe	108
PID 4800 wrote to memory of 2684	4800	msedge.exe	108
PID 4800 wrote to memory of 2684	4800	msedge.exe	108
PID 4800 wrote to memory of 4544	4800	msedge.exe	109
PID 4800 wrote to memory of 4544	4800	msedge.exe	109
PID 4800 wrote to memory of 4544	4800	msedge.exe	109
PID 4800 wrote to memory of 2792	4800	msedge.exe	110
PID 4800 wrote to memory of 2792	4800	msedge.exe	110
PID 4800 wrote to memory of 2792	4800	msedge.exe	110
PID 4800 wrote to memory of 3204	4800	msedge.exe	111
PID 4800 wrote to memory of 3204	4800	msedge.exe	111
PID 4800 wrote to memory of 3204	4800	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fqozvz.axshare.com/
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffa7ea7c188,0x7ffa7ea7c194,0x7ffa7ea7c1a0
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,9580147569702084841,2139324465419725224,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,12826735472895576474,17125351209693465821,262144 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,5261869110104099565,14165908258385242666,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7020573531751086101,12617776215061547543,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,9414049557804031689,17967568567143419949,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,3361700350770840500,1249247069079996001,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,12195604050778522370,16040642684527906542,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4304,i,5454316915149008034,6621969491759132008,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,15164705158339119807,17392394676076636043,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3684,i,15428857404632925576,15545926349214980450,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5600,i,4420245739201880,10538444858213132154,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5460,i,3252570421756515274,6485888277709606058,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,6171375542910549174,16636847712477366572,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,869372051390983359,594262346624119924,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17237472284467413693,2565666557749602825,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,5316885628048047786,17673681471404874956,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,5316885628048047786,17673681471404874956,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,10331057379867855488,1458251273140797984,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,15806127623897348704,901062394999250521,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,8995345470857035873,12260034766344774230,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11127337237647820835,9211424000444747448,524288 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4328,i,17929907333151406873,16473303212243865305,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5864,i,15857612553995592092,9802613236697241265,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6908,i,14489437682176653064,14918408770531823591,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5840,i,4803161527750588663,4153694956099271489,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5676,i,18217006016543418796,12170838001718732218,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5108,i,17798103632675807115,762234883873649063,2097152 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,12050683455873035910,4184623905238130493,262144 --field-trial-handle=2536,i,10684024103409521172,10127565823806177854,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8e09724858cc0ccbf6aa53ac22c81f616b0c1876ae831fb31f8b88d5fbd382fb
MD5 3c958db9c09ba9acb3448910d12acc7f
SHA1 71a08320907cafe135a391705e90c853f101671b
SHA512 962247e116befe00bbe8c23830916fbcca84e8115108d64c3e08630eb5701241b8356d45e811f0d66807f64346c8243da4c009b817b433875298f76922e3fba0
SSDEEP 48:woT/Z+NR8u0KvVMXK0gjCLREoRTnaS6v+uAsxmiiWXI5hjbgQhyavv9M:wI+rNN0gjyRNTnr63DxV1Oh/bHvG
TLSH
T13A914C37CE91C6EBD3B1943890F3014DBABCA89435734E1889A4F879D5267A7FC21847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 73a744d64e62550bd1f89b33cbfa95c7b44597498dd3a0d12f348d1e2122bab5
MD5 06fb2fdf83c06a1f3f7ce36fb284c33a
SHA1 2517a537b8a99fdbbc9ad01b23bda677ed26718b
SHA512 b1efc84b6f084751ef44da8afd37f158d571f3bf17146eb8a6027ac628398496dd2de2578d0fac1e2339ad9b233dd272036b3db433d885cf0a590014e485a1c3
SSDEEP 48:cEoT/Z+NR8u0KvVMXK0gjCHREoRTnaS6v+uAsxmiiWXJ5hjbgQhyavv9x:TI+rNN0gjCRNTnr63DxV1Ph/bHvP
TLSH
T129914D37CE91C6EBD3B1943890F3015DBABCA89434734E189AA4F87AD4267A7FC11847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe585148.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585148.TMP
Size 3KB
SHA256 222dadf17ec4bcc20d2147040adc4be7ea0e9c848488a6a72d07f51c9b21fc89
MD5 1656fb082e8317a294a23b549fa0c841
SHA1 bd116d8a4a011f502e34210685aced2537cb89e6
SHA512 66d6f9b3ce776249da31618a511dcbba7e9aaa1746dd71f013c2c772b806e61347b8d5992af1af4e0b4a6f58b0822874e273bd4e3fa31411cdb8a7f12308fdaf
TLSH
T15D616D37CA92C8EFD3B2943994F30145BE3D849834734E5910A8F4B9E42AA27FC12C17
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 917124193c8b563c67c0a1aecd4f651d87d8c7e0022ccb47b187b1637871c35c
MD5 14e7bd16d8b1ce400d1b740cafedef02
SHA1 b7120e3fd02f391d4f21d08f77ce4b891e711bbe
SHA512 214fc6d55330b50d4b670a51e6b258ab2df45b9d2ec0671c8cd8dd8781fa4e86e8831cd3822f6aa6ef72b97cb7e1478f04a4cf6897a6d292decce9bea218dbdc
TLSH
T104518BF7C3E5866DDD1252F4AA18AE1FCE2D0924473C3D2989D5AE0BD3E2571E10168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 72ac7c7f6c400d59d343ffbbbb52c190683bfd691219d07102743bc4938d9b7d
MD5 30273a7af0c67158cb6765bfb741530a
SHA1 0c5cbec25fad6e85db736991553e67ad1d2bb67b
SHA512 94ab4dcb27dfaec0819435c6f45d2ee49d43f6f5a80a05c6bb62962d1cc5d952ddc93fbfcad3464ef3ff0bc1c555823224c3fa0eb6f8cc3d50811b8e105ffd5f
SSDEEP 192:sxZTR/yM/jK1Ml8UQU8FK/fcsNPNrRzIdpS7uzEo/W6+WNLTSwDwgHg/Y01TL0V+:sxZTRqUKK/fcsNPPsP/bqDV/5IJE
TLSH
T14F62D556A6345977CCDBD30AF941BB53D6F51572A3904E48AAFCDA0C02E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2df7e1e72eb7a5656181191ba41c7220e027d81ab89e0238da4be3510655aae8
MD5 0778b5a9ac49e4c791e65427c6d3f6d9
SHA1 3ed2124a494c3834fbb39e9c0a8aacf07c022648
SHA512 abca795389662ac4da8525441911d56b854d93e70da9b0684a886a50ee44c90b7924ab043ed475a2931680fee82215719d05d1f46667f406603e47836dba955a
SSDEEP 192:sxZTR/yM/jK1Ml8MFK/fcs3PNARzIdpPuR/W6+WNL7Dw/Y01JSvVFIgrJ:sxZTRdK/fcs3PKsG/bU/5+J9
TLSH
T15F52E616AA345977CCDBD309F905BB53D6F91572E3904E48AAFC9A0C01E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 7322dfc1c07ac665628d594dbb163da558510358e7e46eae79da617a5f6a669a
MD5 93b3467cb8652832d437ba33b55d3bf0
SHA1 7d788a55d72c8e2abf1fe616379e92c7ceef5348
SHA512 dd65c933d87ba7926de3e9dbf8b02c65372f0e1bd42eb78c55a7f2348b100928f742c301679bdf2cf6287803d572e76ec7e7ee8dc7f01eaf129cf7c4786075c8
SSDEEP 768:sd4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4y:s2u+68si2y1WRmlzQqju1jaKDILpZ8UT
TLSH
T1CFE22A3B280CCB7E4F844E5CEC26AF966ED802CB66684D5447FE494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4a5f29d0c86c241acc95b1fa99fc72828a02f3d632a2708c448abbf2dc687a52
MD5 051de7ce2675d29c0ca9904a9a21a976
SHA1 9776efb475a83fd466c762c577339b16c083757e
SHA512 eb81eb0df20eda927baccb51e4ee4b6832006102d089776a1d89f642f21a75678e4f353bda14c50339ba43130a9cac75e8b5c2511ea567777f072f62575a9324
SSDEEP 48:K8SI/KLq8DyZmI3K7aYby5GI/KrCgcklQUuSz:K8SIKLqaam0K7a2KGcKrC5klQUuSz
TLSH
T1B391269272BA46013C7D291C9260DB174E4776A7302CA82F77A858B50F2BE547EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

193a5b57-5b25-4aa6-a245-4f9c879a664b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\193a5b57-5b25-4aa6-a245-4f9c879a664b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 600eab287c9aeb44bf222421d7a6d893c911885f1edc6f963c280c5e3a54cec9
MD5 492de9ac7136f7036aa883c78f7e6268
SHA1 7dbe677406c5b0ca2ac2312bdc9488eabf91a9e1
SHA512 2b561a627256a2fe8980fbaf025d571e8c1c834953087bf70844b50357b852f40d2b41d2a7da50f480ff741a1329c3c4d91b6ca324921f4dedc6388070ea9849
SSDEEP 384:6tNn/s3n9Sf8NEQx6cvr3b+AC8YbXEyJoJOObjI9G6w7j:6j+9UwDrpGEyq29Mj
TLSH
T173928D3268289D775DE39659B44B36138FF4427BA3C42F88D5ECAF0D06CB6AC431A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 23fd5c8ab61120cd3beeb5ac642b17af04f30c0176d6d5d6327c732050a6bf79
MD5 93334151ee886e8a6e75d24b23786079
SHA1 952734f3930d21ca218580eb924571f797009135
SHA512 3233841d1af0ef82e0f79b7cbfdbc39448463c0d1888a80aafc17512811a0c479fa633de933b272f0cb204cd30ea5c796f3cbdbdcb611c2d79c1ae4533b23fd7
SSDEEP 384:xtNn/s3n9Sf8NEpx6cvr3b+AC8YbXEyJoJOObjI9G6w7j:xj+9UfDrpGEyq29Mj
TLSH
T14F928E3368289D775DE39659B54B36138FF4417BA3C42F88D5ECAF0D06CB6AC430A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 107f3b87bca64b1d0716702b1dad5e0fffd3110dff5bcd68bfac679b3f9d330e
MD5 c7a5feb75612c202e74df62401c262cd
SHA1 73033ab1d789444e32fea3c31228e40182e468c8
SHA512 7eb480a76c9b6149727fe7413ae6370bddcba28ffd1d043a58790f8dc8fee2305a20fb8a83c551be7f52a0e5892ef34fe34da87d352449d69219e91712587363
SSDEEP 384:yiF1tNn/s3n9SA8NM8TUNTUlIlpx6fvr3b+AC8YbXEzJoJOObjI9G6w7j:5F1j+9lZwgyDrpGEzq29Mj
TLSH
T1EEC22AF248D78976D99E8B47B73E2D028EBCC167B6846A44B7C85A0CCD861BFC305911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e7e2bcf14ec479ed51918610f1fcf4cc48972011ad871290daa774aadaf4ca32
MD5 d84c90317439599f94e0c90e2a2f7b98
SHA1 0222670844b78f6b0b098888050b734936c9dcee
SHA512 096471deab65969aa74224739db463338497921674b068c3ee70326a92b04ea01f7a8cb99964b23563eab3d211581507ab9ef3c936cbb7c1613f0cb9dee7951b
SSDEEP 192:nRGN/6yMQmiUyXJmZ1Y3b+jcejzorrsfRNMnN3U6:RGN/6x0i1Y3b+AC8Y6xU6
TLSH
T1F502EA35AC686C779FF2AE45B58737139FE4116BE6956F84D6E81F0C00C725C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d85775db8a5a378efa85e9164309d1cc298234a33cfe71c44126b4dd4bea2a2
MD5 c0c15ed632311688fa927ba9e6b22a5c
SHA1 73bd7a04795c42f28381fc5ab4cefd9b6bd7f561
SHA512 8ec89d706a781783b36023efb0f4df057ddcd0f4b9fc76b2b1c69bab7feedad30666b85f8b9010ad59102584a074dda5c2b44793138a6e772b2809d9516ad83d
SSDEEP 192:yGN96yXQmiUyh0ZtY3b+jcejzorrsfR9XEXg4MJgquJU6:yGN96EDtY3b+AC8YbXEYJoJU6
TLSH
T1F1120B326868AC7B5EE2A945B44732138FE5012BEB857F84D6EC2F1C01DF69C530E966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download