hxxps://pygame[.]org/project/88

Analysis

user interaction
yes
max time kernel
78s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pygame.org/project/88
Sample260723-s8dpgafl6x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292952590516651"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5554B9E4-3374-4A5F-A823-56226EFD4069}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4012	1876	msedge.exe	85
PID 1876 wrote to memory of 2976	1876	msedge.exe	86
PID 1876 wrote to memory of 1144	1876	msedge.exe	87
PID 1876 wrote to memory of 1144	1876	msedge.exe	87
PID 1876 wrote to memory of 1144	1876	msedge.exe	87
PID 1876 wrote to memory of 3500	1876	msedge.exe	88
PID 1876 wrote to memory of 3500	1876	msedge.exe	88
PID 1876 wrote to memory of 3304	1876	msedge.exe	90
PID 1876 wrote to memory of 3304	1876	msedge.exe	90
PID 1876 wrote to memory of 3216	1876	msedge.exe	91
PID 1876 wrote to memory of 3304	1876	msedge.exe	90
PID 1876 wrote to memory of 3216	1876	msedge.exe	91
PID 1876 wrote to memory of 3216	1876	msedge.exe	91
PID 1876 wrote to memory of 3720	1876	msedge.exe	92
PID 1876 wrote to memory of 1816	1876	msedge.exe	93
PID 1876 wrote to memory of 3720	1876	msedge.exe	92
PID 1876 wrote to memory of 3720	1876	msedge.exe	92
PID 1876 wrote to memory of 1816	1876	msedge.exe	93
PID 1876 wrote to memory of 1816	1876	msedge.exe	93
PID 1876 wrote to memory of 4056	1876	msedge.exe	97
PID 1876 wrote to memory of 4056	1876	msedge.exe	97
PID 1876 wrote to memory of 1296	1876	msedge.exe	98
PID 1876 wrote to memory of 1296	1876	msedge.exe	98
PID 1876 wrote to memory of 2156	1876	msedge.exe	100
PID 1876 wrote to memory of 4732	1876	msedge.exe	101
PID 1876 wrote to memory of 4732	1876	msedge.exe	101
PID 1876 wrote to memory of 4732	1876	msedge.exe	101
PID 1876 wrote to memory of 2884	1876	msedge.exe	102
PID 1876 wrote to memory of 2884	1876	msedge.exe	102
PID 1876 wrote to memory of 2884	1876	msedge.exe	102
PID 1876 wrote to memory of 452	1876	msedge.exe	105
PID 1876 wrote to memory of 452	1876	msedge.exe	105
PID 1876 wrote to memory of 452	1876	msedge.exe	105
PID 1876 wrote to memory of 2864	1876	msedge.exe	106
PID 1876 wrote to memory of 2864	1876	msedge.exe	106
PID 1876 wrote to memory of 2656	1876	msedge.exe	107
PID 1876 wrote to memory of 2656	1876	msedge.exe	107
PID 1876 wrote to memory of 2656	1876	msedge.exe	107
PID 1876 wrote to memory of 3388	1876	msedge.exe	108
PID 1876 wrote to memory of 3388	1876	msedge.exe	108
PID 1876 wrote to memory of 3388	1876	msedge.exe	108
PID 1876 wrote to memory of 364	1876	msedge.exe	109
PID 1876 wrote to memory of 364	1876	msedge.exe	109
PID 1876 wrote to memory of 364	1876	msedge.exe	109
PID 1876 wrote to memory of 1376	1876	msedge.exe	110
PID 1876 wrote to memory of 1376	1876	msedge.exe	110
PID 1876 wrote to memory of 1376	1876	msedge.exe	110
PID 1876 wrote to memory of 1816	1876	msedge.exe	111
PID 1876 wrote to memory of 1816	1876	msedge.exe	111
PID 1876 wrote to memory of 1816	1876	msedge.exe	111
PID 1876 wrote to memory of 632	1876	msedge.exe	112
PID 1876 wrote to memory of 632	1876	msedge.exe	112
PID 1876 wrote to memory of 632	1876	msedge.exe	112
PID 1876 wrote to memory of 1760	1876	msedge.exe	113
PID 1876 wrote to memory of 1760	1876	msedge.exe	113
PID 1876 wrote to memory of 1760	1876	msedge.exe	113
PID 1876 wrote to memory of 3060	1876	msedge.exe	114
PID 1876 wrote to memory of 3060	1876	msedge.exe	114
PID 1876 wrote to memory of 3060	1876	msedge.exe	114
PID 1876 wrote to memory of 2220	1876	msedge.exe	115
PID 1876 wrote to memory of 2220	1876	msedge.exe	115
PID 1876 wrote to memory of 2220	1876	msedge.exe	115
PID 1876 wrote to memory of 380	1876	msedge.exe	117
PID 1876 wrote to memory of 380	1876	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pygame.org/project/88
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffad6fac188,0x7ffad6fac194,0x7ffad6fac1a0
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,16204026658084390270,2895364130044846613,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7609735291439384500,321761217074567146,262144 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,15252500590554560338,7758902463474350138,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5517528489390486464,17021517650679568634,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4638890334965693551,8026139181074023985,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8007627396407279346,16733031110495566239,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11262741191260004564,15814188868244075717,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12256217760350825846,2619028627992764697,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,7095972687601772567,14791834919412993668,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,16364754651973339561,8825763118726410080,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,16364754651973339561,8825763118726410080,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6192,i,14604633961909790666,8719740182767658182,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,5376380982255691986,13264488818768053466,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6604,i,4999925953587349740,7205991480959935787,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,16223535233922669255,9275226775989742078,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6784,i,5370482009078273096,10581364527000862062,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5100,i,13998729947661741977,10849117884202706415,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7040,i,5027007179985152364,11433622898969041547,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7196,i,16571267217568371369,16512573776212918265,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7352,i,10573117456435714571,8906130728314232051,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7388,i,17880385916070379613,6773800618046577918,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7256,i,2878291962934449088,17753366585806855385,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=120,i,7138567380690203586,7109326078160702256,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7992,i,16449225167471938002,15763427512949349202,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8156,i,6249101671731230355,13711392385650719822,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,3599311008970556948,5151937709527844956,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,9094370754123466373,15476455491298256026,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,14325848775102609933,7461700877426586823,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3008,i,9047254564207814461,17685844969752433892,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,17721858847557947070,7776389079226157477,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8560,i,3156894828320423096,12921660836833241972,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8636,i,8582676849353827276,13348063031267221125,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7212,i,8773129542770024694,7092147539820092706,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7988,i,1804493779295247257,6001066463236423946,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,17831945368743403864,14583635600562993866,524288 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8296,i,6857406050536186350,7976566941558443304,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7584,i,17955842980801670603,7396504240562220099,2097152 --field-trial-handle=2272,i,9207757186867701137,710485536938932338,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6c2a75997e89f05de2a3308d2178bbfcc283b06f1009f80088fad317cc4258e9
MD5 7e3ab1ca9873fe057003d3f0b26f6b8e
SHA1 9d0ce0a32779bf0ed86777f7945b8890a01f51f8
SHA512 914cf315f5d258819a742d8ef354cf5d57000e0fb7f7f711ada0df2179a002d29c5ad61c02b4da05490a93fe0efb0487e16469bd2e18f5d3700594ba99de3a78
TLSH
T10E617F18C62B4492F3E05633E9D107343570818B0BD71FD9E79AB77EA92FB22502E748
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c55bc47e1efb35aea4022b6dcd25d8c1c2ddaf08c966d6b54bf216bd9b4fa300
MD5 249dc301d5eac9bd9aa64cf6f7a2edcb
SHA1 bf503929662979a5f1392c831da7998a332dce63
SHA512 737974d6e5f8264aa3f5f9bd38f9211edddd5edf5f56b69fd791afadf51aa309c50c461d798d26791ccdfeb57f0f423cf676259c0f4c109c1539e31847957deb
SSDEEP 96:3C8OsgzZpCLF9ZGAngSdyy0PKQ2e3kJ6e0Ly/w3/Wwdr:3CZsi3KBngA43kJ6Jy/w3+wh
TLSH
T172B1F815B5B72052FBE00673C9D11B30757400FB07E32FD15A8577BE580BFA2999E698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59ceaea0-48ea-413c-a9b5-5bf065c0678f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\59ceaea0-48ea-413c-a9b5-5bf065c0678f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 35KB
SHA256 8d78d54e7baf67109fa822b2be7697997ada205932a27b5d0fa2a40570c3881a
MD5 3ee9ae9b2a97327119b52cbfbb44ad47
SHA1 212048fd8e34971e559efadfd434753fa1f09de3
SHA512 d5892b985a31e72c7b666c49b3f055227ecfcc3ccdbd3b89c33d51ab3bf7a7f9d86683b4b185230415ecbfe66c11b9ff98a536ab19b713710dbc743289dbd8d7
SSDEEP 384:DMEYgOSlk3dflfBN1YsJSXJrl31ohpp4Beurlieley8ef7FyEOyJFBeTqWFveZe3:66ptkdsJPOuD4jWk
TLSH
T1CBF25BE6C3E4DD2EE81275F0AB25AF1FCE1D1914473C38598DE8AE4693F2860D111A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f7be406b8da21b5ab8a26d4df80ce825e4bd955afc7f66c62942841bb496e9bb
MD5 70e66f8bf2dd013f8532757338f1208b
SHA1 ce4bc8eafa072e24c69f4f02d4deffe616033577
SHA512 f75f22a615c646dc8d7bf52e2867fdd917b77ab55bbc7f7985928329f900c5bfa2b611a4a7d742aaf9988962dde066ce1712bf50580642c797799319c35c4377
SSDEEP 192:sxZmRWyM/jK1Ml8MkU/fxsA7J+IdpP2zHW6+WNDKg//YL9vQjIgrJ:sxZmsMU/fxskJvsHbR/r9
TLSH
T1A652E816AA345977CCDBD209B955BF53D6F50462D2940E84AAFC9A0C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 555b0f32caaa19e0105fc2524e4ad81df9bd25830a26bdb623c4ab2af1274791
MD5 bc22329e5bf29a25e0c673a94bbba7d9
SHA1 0dab9aeb13edbf90c7a5d21c45254dadff071fe2
SHA512 629b68565ba747143e909eff7dca1f1f42ba1bdf541281dcbd7ef21c310871b3f4ca835a12c8eac3c3d412fe9043efd778cad7e0485f63d5da65cf1f91e1f9b7
SSDEEP 192:sxZmRWyMojK1Ml8MkU/fxsq7J+IdpPdt/zHW6+WNDpad8pujg//YLiVyxQjIg53c:sxZm7MU/fxs6Jv/HbWY/vZy
TLSH
T1E952E816AA345977CCDBD209B954BB53D6F50462D2911E84AAFC9A0C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d08c8adc61051431c31cdf1fa647c84bae73f768328945cd3920b5dd23b270ee
MD5 b6959c37a22b3798db0f2c6aeef02b8d
SHA1 2f12141f8e1bd060379939d055594207a874e5a6
SHA512 cf6ce93183d3ccfd653b8f6ca5358566832708baa9d937ff7d9d182bc9e613f35ade41a4d58ba7b29eb1dd6a17088a846b76d5d01119aa93f46436dcacb854ba
SSDEEP 768:Ggs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNxro3vy:Ggs6pD1WvxzWju1jahILIsNK3vy
TLSH
T19BD2FA3B680CC77E4F844E5CEC2AAE967DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 428ce97acd291f0b09539d056ab6f649d97a4eb1525e690f2e0b72e06ea63c10
MD5 a66f445a6e103f7d6bb0d75dd3d05fa0
SHA1 1208688d6802df3d24ba016f45b6dcf443c4d0e6
SHA512 3ba30fb2cc211edd3fefa65fc19f82709d95581048ac76965abffdc8f952308462f8136eeaaf15fef2904e0eba626611beb491a6609d3da6ce8c0ede6ae0f949
TLSH
T154A002623351540AD14613705A9143D03360CC218145434781B110C58CA55C89A17942
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e9a32c22379137fe67a3afc04ecb2289ed77c1e3360b3d86d2b70b9bf7b40199
MD5 fa8fe196fb6cc1c4394887935b8c26c0
SHA1 54296d42f34301988733debefc4e853f213d3227
SHA512 815e3f07cb25afde6c664a5a704b46ee51a9bfb7652fc7ba271ff659d7fd569d1a2fcd281052dad74309b59d0eb9fb2c4e154e0ef1511daf3f2bfca72d44906f
SSDEEP 96:KUAAKtePOP+KsMCq+oKjy4ogKta6qMQKlOp:iiJtPovbC
TLSH
T1BEE1480273BB12433C7E289CA354872B4B4671673014B56B3BE804B61E66E795DFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5901db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5901db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ba5b07f52e89f1f570e23b04e8ebd214d32292affa9a6e743d81bccac81251f
MD5 485ce31be471d79e1e140740401c4375
SHA1 965022895eb98bb2699b99336c731c7714ab8d54
SHA512 6df16871ae994cd39de3b0ce951c1928dbf931e35c375d6cf27e6998bced6b110c08592443ae000b5cc6bf3529a0b185785d5145a3da050336775a36e5b66740
SSDEEP 192:qONx6O7+3hQmiUykOGttb0XO2PxgG3hy0VU6:qONx61mGt9uOUR340VU6
TLSH
T17E02E7397C6C6CB79EF2AE45FA8727135FA5103BE9962F80D6E81E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3c2c387d6986e7ef8ff20ae0717df7b220ab7bdce9d53ce412dc742f1dd898fd
MD5 c7ee65af7e4adf30583cc77f4c109b64
SHA1 7312699bb10dc4b15eb6ef624bcc8afbd3f1ce67
SHA512 13ac5a989ec2ddb38da5e7e10e0eae1189e7b4c02b9786e204aa7a845ea256075d88196762babb19b2a72fc875bf81e23bac4a1bd7cc336aa8cb3808431e38a6
SSDEEP 192:kONO6O7+3kQmiUyCOcttb0XO2PtaF0SJrnp/cN3GqjBU6:kONO6mCct9uOUtWzJrnp83pU6
TLSH
T1E1121A36B8689C776EE2A585F58736139EA50137EA8B6FC0D5DC2E0C01EF56C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 fa2847973cbd17547914f0c362a5115731f091390a420b704d9eb186f1aac9d5
MD5 d66df473d50525d2d9e1d4895e42080a
SHA1 80785345146412828acc641aef76b8c61ac54748
SHA512 654ff4f83e55cb664de94fd58011c013f855d94f0779e2c7d26efab91a9a70d7c9080ffd7e6ae45cbba48cca82aff9cfa14ee8c122d20a75c022cfabe145fc13
SSDEEP 192:uum+xasuheOwQxMGsNTuQEWciZ7+3vE/QmiU1xwj4atb0XO2PtaF0SJrnpfLM3G4:EZcIhsNTuvtosMa9uOUtWzJrnpg3puI
TLSH
T1EB726C366C385C77A9F6A541F98636134EF88073E7DA2FC0D0EC6F0D01EB5A8131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a270a4d2a38bafae0d286847f058d99e281a2c3aa406d8a62a52996c19bc5527
MD5 4a67a58f0181c973504f872f0c5d4543
SHA1 45773b74531c440b77fdd211a972d45eda204397
SHA512 9ca18c5e9f94f919c2273183934188295d7a86d23c4efe33e0653a89ce11d88f43158b13b862a4922bc091f999eeefcb05760045ea6cab19f74c4f118396b42a
SSDEEP 192:uuLsNTqQEWciZ7+3vE/QmiU1xwj4atb0XO2PtaF0SJrnpfLM3GqjBub:rsNTqvtosMa9uOUtWzJrnpg3pub
TLSH
T18D42393A6C385C77AEE2A141F54736139EB44067DACA2FC0D5EC6F0C01DF6AC235A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 21bf0221421f334c87bcc13487ab6646d784ca547d96557d8cb421c1ff247893
MD5 fae2515ba2d033b72e4a04a2f6102d51
SHA1 aa04e3f34529bbf3b6c424e8a41579f2cd1c4c69
SHA512 e0ec470780a8cfcd38177e815e842b3731aa4ad607c418f133bcc6e6b006cfc114de2c8b087cd0856dd28aeb166ecefe7a70981dc47b179a9d78b6e0aacc3345
SSDEEP 192:u4m+xasuheOwQxMGsNTuQEWciZ7+3vE/QmiU1qwj4atb0XO2PtaF0SJrnpfLM3G4:KZcIhsNTuvtoRMa9uOUtWzJrnpg3puI
TLSH
T1C9725C766C385C77A9F6A545F58636134EF88073E7DA2FC0D0EC6F0D01EB5A8131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 63032f33dd173d03bf3e5196f979e8c3a52d96978cf8dfd29a005cfad913d967
MD5 9065239603437622284344a373851d54
SHA1 6b67ce840066ecc03a15593fe779cff8f6b838a0
SHA512 1658ca3d9f75affa8259c67623942dc3a457e74db8a7158a17c3155906deb44abdb28b8cae18bb52e8cf356ae0e071bafef1507a921f0e949bab9d99bd11bbb8
SSDEEP 384:3iFiZcIzzsNt8TUNTUlIluvtoHMa9uOUtWzJrnpR3puI:yFQXkwgDV8OY+hnj3pb
TLSH
T112B208F258D74836E9AE5743A77D2E134EBCC063F5966A80B3D85A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0de5531f0dd30c74b288b39f099d4f0e4c4d84cf005db0311b153df15c52d99f
MD5 46ebc7bd0ab9fc25d8ed659d7a2958c0
SHA1 bdf7edf1030ff890495ffb43bb6c332b8c149f6a
SHA512 c44a1357c615413414affc1c998cbcbf505b141cdd9dce45204c94df5993ed8b7bab63de6c5bd6efc27d022b6be47b83a4b6c2c41d6653c12393b7a757a9746b
TLSH
T187E00203930004FDD13C03310043163116E7803402F103469D1041542C136001F31FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a22c78e8deca4bf60b77db5b96faaf8de621788969863791f3da124c616d1ee5
MD5 780d5de6d48a85123844e5f2c231373c
SHA1 93719d6dfc0573a4b0a3f65d3aa9661bfdf517d1
SHA512 202349778e95618672fbf8cb0a9c64b1573a58ef467c5f8dd0d5ea85f56d0365b39fdca07e48a5fdb3bb027cf8ae8d7d8f8b8ca797de5a730bea95631c41c628
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe588865.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588865.TMP
Size 392B
SHA256 7e3a70adaf951e47e6b7d4f0c77763069470a214f03af7631c5f0b91ded2c3d1
MD5 7ef46cc6a35072e9574c451d51ecf2b4
SHA1 23e9649e49bf88a63ac2aa5f00cd147128f3ce81
SHA512 3d9e70f2aec3ccb063308668cce4fe8ee635fdb019c3df99e339ab1e6807505da57b34f29173c005890c36f8488faf57b039b459bff4cfabddce9ce93e23e5de
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b52597e78d9953510da0a1ed46a7e6831f9858b4a007ff692180137d609e9f4e
MD5 4ec48e86c405176c405f192d12c65075
SHA1 ca35e13b4cf72c57398a79f4ab9695bb6be20dc8
SHA512 9e1d87bb247c940de45dc1eabcbf5af1b3cedcb044b4c9703155a31ea7538542bbec27d51e88d7ad4d83902d5ca9236a52805533f7657c46053429192dda5d01
TLSH
T10F410B987AFE0158B3B36E5A9BF6A86D487F78771E06D45D00010D4E0667E40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads