hxxps://uc6e7e1deec4ae7759906d618993[.]dl[.]dropboxusercontent[.]com/cd/0/get/DFCnl4o1PS9sUppGdql6r-f_jloAf_a2Vb4tEyl0UY47Q84MH9qb_JBM6PJ2OAystc30U1NUR62HCOUVIym4It-iwfvX7B4y7o3DF-b2mzPuaJgFwEYq7TT7pZMH5saubRdhrkqm_e8fasgVibyNowAn/file?dl=1

Analysis

user interaction
yes
max time kernel
115s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uc6e7e1deec4ae7759906d618993.dl.dropboxusercontent.com/cd/0/get/DFCnl4o1PS9sUppGdql6r-f_jloAf_a2Vb4tEyl0UY47Q84MH9qb_JBM6PJ2OAystc30U1NUR62HCOUVIym4It-iwfvX7B4y7o3DF-b2mzPuaJgFwEYq7TT7pZMH5saubRdhrkqm_e8fasgVibyNowAn/file?dl=1
Sample260727-mnvvcsdk3w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296222400124610"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{65C8B279-235F-4783-8E22-792E32C130CF}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 3360	532	msedge.exe	85
PID 532 wrote to memory of 3188	532	msedge.exe	86
PID 532 wrote to memory of 420	532	msedge.exe	87
PID 532 wrote to memory of 420	532	msedge.exe	87
PID 532 wrote to memory of 420	532	msedge.exe	87
PID 532 wrote to memory of 1584	532	msedge.exe	88
PID 532 wrote to memory of 1584	532	msedge.exe	88
PID 532 wrote to memory of 2332	532	msedge.exe	90
PID 532 wrote to memory of 2332	532	msedge.exe	90
PID 532 wrote to memory of 2332	532	msedge.exe	90
PID 532 wrote to memory of 3720	532	msedge.exe	91
PID 532 wrote to memory of 3720	532	msedge.exe	91
PID 532 wrote to memory of 3720	532	msedge.exe	91
PID 532 wrote to memory of 4756	532	msedge.exe	92
PID 532 wrote to memory of 4756	532	msedge.exe	92
PID 532 wrote to memory of 4756	532	msedge.exe	92
PID 532 wrote to memory of 4592	532	msedge.exe	93
PID 532 wrote to memory of 4592	532	msedge.exe	93
PID 532 wrote to memory of 4592	532	msedge.exe	93
PID 532 wrote to memory of 3200	532	msedge.exe	96
PID 532 wrote to memory of 3200	532	msedge.exe	96
PID 532 wrote to memory of 3200	532	msedge.exe	96
PID 532 wrote to memory of 4360	532	msedge.exe	98
PID 532 wrote to memory of 4704	532	msedge.exe	99
PID 532 wrote to memory of 4360	532	msedge.exe	98
PID 532 wrote to memory of 4704	532	msedge.exe	99
PID 532 wrote to memory of 668	532	msedge.exe	101
PID 532 wrote to memory of 1548	532	msedge.exe	102
PID 532 wrote to memory of 1548	532	msedge.exe	102
PID 532 wrote to memory of 3564	532	msedge.exe	103
PID 532 wrote to memory of 3564	532	msedge.exe	103
PID 532 wrote to memory of 3564	532	msedge.exe	103
PID 532 wrote to memory of 2920	532	msedge.exe	111
PID 532 wrote to memory of 2920	532	msedge.exe	111
PID 532 wrote to memory of 2920	532	msedge.exe	111
PID 532 wrote to memory of 1180	532	msedge.exe	113
PID 532 wrote to memory of 1260	532	msedge.exe	114
PID 532 wrote to memory of 3096	532	msedge.exe	115
PID 532 wrote to memory of 1072	532	msedge.exe	117
PID 532 wrote to memory of 1072	532	msedge.exe	117
PID 532 wrote to memory of 1072	532	msedge.exe	117
PID 532 wrote to memory of 4176	532	msedge.exe	118
PID 532 wrote to memory of 4176	532	msedge.exe	118
PID 532 wrote to memory of 4176	532	msedge.exe	118
PID 532 wrote to memory of 1252	532	msedge.exe	119
PID 532 wrote to memory of 1252	532	msedge.exe	119
PID 532 wrote to memory of 2744	532	msedge.exe	120
PID 532 wrote to memory of 2744	532	msedge.exe	120
PID 532 wrote to memory of 3920	532	msedge.exe	122
PID 532 wrote to memory of 3920	532	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uc6e7e1deec4ae7759906d618993.dl.dropboxusercontent.com/cd/0/get/DFCnl4o1PS9sUppGdql6r-f_jloAf_a2Vb4tEyl0UY47Q84MH9qb_JBM6PJ2OAystc30U1NUR62HCOUVIym4It-iwfvX7B4y7o3DF-b2mzPuaJgFwEYq7TT7pZMH5saubRdhrkqm_e8fasgVibyNowAn/file?dl=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffe8c1c188,0x7fffe8c1c194,0x7fffe8c1c1a0
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,15816276392112881454,195336303717744089,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15596046880907433790,5625931090480143983,262144 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,16627259280159252319,1759039384127532837,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13531436121810761177,344430170672723550,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16291652725048288948,8294656871864518798,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,8993695656718664567,12164056938134584417,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4745442362828992986,4568210747870647917,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3460,i,7926204520681213009,14865492316476863913,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3000088835488067081,504514350938963795,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,15853124995210160302,14467547039498572528,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14218566302736114568,11148707565944416936,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14218566302736114568,11148707565944416936,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16366656950728037917,12626191029563119613,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5880,i,1704677695901875070,7020452756256338278,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4476,i,2100003538345291821,17476395820047846945,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1571005522230928849,17957338275264884424,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,15857728380280658037,15656007568783177823,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,6307233993704491736,11252054219284900245,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6572,i,13317251727540558207,9233061010708785686,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4336,i,16698581932773118319,15600907704934340386,2097152 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,15721569778116061732,2516867123905440239,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,3417002017802713690,104713233202890871,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,3854450515890442194,2591132332826026124,524288 --field-trial-handle=2276,i,10025955792528695553,5295682403875798841,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 24KB
SHA256 2beefe7293101d64840c308506967e9e2a0b2a6c4500ccbb7871c1342f2894eb
MD5 dfcada20b4cda38d23f6fec8d0260763
SHA1 373ce141ff860592bfc61220e4b5c82480533d19
SHA512 d8b43808a8ad313a54f2418a2d74dcff9f02648519a7637d580e47fea6fa60e8a57c95e3f00643a33accd6479bf0fdba3a858818e38058775b9aa238761536b6
SSDEEP 384:3xbeyInNsrD5LZCzRFwiSmWR4a7tjVwlgtX/UC7duixIaILK7fjzUmcdq7+RCRHr:lRokgcvP7C7m3SBSIjsDkLYd9dL
TLSH
T1A3B2C6985582703CBA3B852167D8AB4C7234DC06DE3228EDF77B662E0FC67D642B3158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 68KB
SHA256 47d91cd0bf170ab1972a0777e1051fe5ee2a840a1d9efbeb0097e338228a8888
MD5 2a1e87320b14aac1134938a0c0bade85
SHA1 3831900aec52ad0da761f20a4fa1069d6434a6fe
SHA512 000744a8dbbc14690245ac7924c7662544bee356b4973075f5e78726fe0848e6aa96b6cf327718217ede7cde98d7874a2a4c934d1c864203a6015df18fac2d68
SSDEEP 1536:6fWZ83jSNyAUf76Z+AGYguWv0KxwhneG/7Qe4rxzhRelJ1Z6EUR+r1:6eK3jS3X9GjuW8KxwhneG/0jJelJX6ET
TLSH
T18C63029CFFA35BB52865C41E9C69A33E48E3E296C97B9721133B01F502116C2E0F461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 37KB
SHA256 84186c94c202c6eaa8cdde14e8bcb82ae95f13413df2852b46bd013535425f4b
MD5 8abcb03d6ce0af82f0e2048c440e6cae
SHA1 b35be41ea1f9cf3fe270d01ce78b4b121f851ab0
SHA512 b6ea20bd67cd7fab5703a0e980ff2e338f195fb851cb6eb511c1e750e193d2887580fc998e5c7dad92839bf2ee6209498ac6f9a6aae81fa1f168784bc2085067
SSDEEP 768:frn6Vqe28sAmi/PwOzwOqHgPrzb0JW1bZwcP5TnHak8yIpxTkHDVChA28g:fOVidcwovb0JW1ySnBEHywhJ8g
TLSH
T1E703E173136772151FE5533BFA9B820D4208A78AC06F438D384965F96E7EDA9003FD68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6d7f47f34f755a951bc93bf49c59d71797a69ea55e39a2879e54fe3b6717d584
MD5 88efe9834cfe630810226ad07065ee6f
SHA1 9163c75ece2a0b54c642e9d612847e811da26404
SHA512 0b60fae4e13d3a3298cac615dab4907790c9a11c695180323ab794904407f1e7713c60b09ee8bd1076d40d5b9f19e97957c6e2b727f385cd2938b8f61b1e9954
TLSH
T173712BDB0D324991E7912330D0C1374471FC89A70B1F9E4D8A689FBFA516BF28E26D19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d579484e408d9eb92158ab5084d4ba41dbf5215c73aa2eb4a22bc68147043cad
MD5 40b227414d1b6d07e04426bb2ea6b5bd
SHA1 cdb24658696a5bb76ddcf2e137c2f6fa257ec258
SHA512 d4ad0fbae5a805a26f35716fb2d0ff066e9639546cb1b8f66aacb1b6bd77563c4ddb26d48341a4b14600cf38d8d043d5c8a9abae066045837c5265f91786d102
SSDEEP 96:iPF/QKjBd8ZdhVwRWM8p4sFaSg+/W/DgSa8WImGlrJ:iPIVwUM8GgayW/DxY90J
TLSH
T196C1C5A708324488F7951630C0E133D378BD2B974B5F5E8D4A565BBFA5023F5ABE4C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588e70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e70.TMP
Size 3KB
SHA256 e7213b65e56a1f563478a166ba978e0c68ac7718e945595e728656037758b8be
MD5 6a0dce532a5beb8ee30779c0b372d697
SHA1 ca61625266a5d77d6e4954a83d158cbdec52b514
SHA512 7476d5bf8b4054908d3497e6e1eccf23df6f4dc8712a1864e0c566eb01b76b656f7edcfb319f7994ff057d2ffe67ed58a4cd603ef8a5a6eaa177fe74a3c2bcef
TLSH
T11F713CDB0D324981F7912730D0C1374471FC89A70B1F9E4D8A689BBFA5167F28E26D18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 44aed287308f669f5cb3ef5b2d8612af7162af58bb2f47908b833cb9c5cb4860
MD5 3bea8ac3ebd61d9154132ee8e0945027
SHA1 0693d5ffde155456d1b6ed5ca406574d809e9783
SHA512 2eba89dc8073966d259634a1be38389d61869522e5cc5091fdc81d88bd9777a082ec01836586fee5a14ac462fb5152a0fb0fd1caeb4eada7f6379a5b88187654
SSDEEP 48:YALlNzOC8tlC8ASC8oC8qC8uFdbtFdSefs11KsUzEs1CVwBCXEsyCSszCes7C+Fv:DVOPl6Su8I7t/fjzJ4wBEGAQv+xLoiU
TLSH
T1B9917BF7C3D9966EC91116F0EA187E1BCE2D0D19821C3D1AC8D4EF5B93E2471E181A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 ec189af060d62f14566234a3e596302537a995caa4685affca9a33a0d51b6490
MD5 8a17c00db787aa768b1f48c430c1af7d
SHA1 d1e0123b94690d733ffed09e059d362bba900a34
SHA512 78826bb89dce20f83e1b76478ddc647b02cca44006576e807200043554bd17a2903a57e79940cc89717b342d6845208f1f09d0853f5852893e773dd070e0ea80
TLSH
T1D3D02223620530B5A6AC7E82A0AAAC9FE73600200882DED620E098AC06358AD464B351
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 0887f4a0578a476461d6e25039caf99b35732d958461d09ac0fa29cc099a3943
MD5 8864a7457f57d4082a6f1505899f0b5c
SHA1 cb9b0fe0f7e63c0cefc8e9aabed2c71c8affd1c4
SHA512 bb98fb10d676e3045324d325ed477852c8056118bae8b12cd3c43e93a3d0e0bb71897a983b687a56ac847c1f3175c3359335e06700d387fe123cc46a7e3aec16
TLSH
T1E2D02263620030B5A6AC7EA2906ABC8ED73A00200882AFD620E06C990A36CAD064B281
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58ba23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58ba23.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f337714c-72d2-4df3-9fdd-8e0a5d624652.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f337714c-72d2-4df3-9fdd-8e0a5d624652.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bdec4a601afd9ac2b3e8beeb8e2e78288d623a2392bee45d062280e022ead60c
MD5 d751f07e793e4a70a65021c72ffd1b21
SHA1 5038df5def8109312212156d5dd4b5e132cdefc0
SHA512 a8e2a5b32ec7636df76ce1b6818eb20b83e96aacf9087fd275a5f1f04242f765a7d66d05b6a678341715a04f9ed14d3bbcf8fd10b70329aea198c8202d799820
SSDEEP 192:sxZ9RnyM/jK1Ml8MkG/fxsQ+LIdpufHW6+WNjA14/YLBFLgIgrJ:sxZ9pMG/fxsQ+UcHbM4/d9
TLSH
T16852E816AA345977CCDFD209FA45BF53D6F91472E2900E44A9FCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 390423cbbe82bd15577fdf63c38393e6f2660304b8f334eefe6ef8749c85ad8d
MD5 0e28ff73e47466d40b921dae7caf0e66
SHA1 0901959c6e2a1d40b35be8f47c554caa7714f81a
SHA512 45672767fb71d6dd7b1b58e0b828bf843c2e9f504f93dd5c2b44bb54b40e4ec88c5edd938e0abbb7247636852bf8a121adfde58d8dfac4d0cec3114edea5c4e7
SSDEEP 192:sxZ9RnyM/jK1Ml8M0cB4G/fxs/h4qdp9ra/fHW6+WNSfXAQfA14HeQZYLFMkgIg3:sxZ9psm4G/fxs/hFeHbD94zZN0tE
TLSH
T1D772D956A6349977CCDFD208B9657F53D7F51462DA910E48ADFCCA0C00EA6FD220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 178c09cabf21caaf83e924c0b1f3632c7f4f626c1158e3bf913264e505cae5cc
MD5 f9af08e58b470cd938686ddc4d309e0b
SHA1 573ccb26c591f805ca5a3eb29821ee0a6c1f93d0
SHA512 f13ec78bdf3d1412678e86f576313e077a5616c250b8b344b5c96b95a06852d81c5aa501165576a14da5cedd6859fa4b6662957438932942ab5465d75a0ad494
SSDEEP 192:sxZ9RnyM/jK1Ml8M0cB1G/fxs/+SqdpTbrfHW6+WNSHA14Hvc/YLGFLgIg56J:sxZ9psm1G/fxs/+LTHbV4k/yI
TLSH
T18352D716AA345977CCDFD209B945BF53D6F55472E2900E44AAFC8A0C04EABED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a854d561fe521c3d4f0ba1cc7946d5e888f922d8339bc139f70d2bf0ff46b59e
MD5 183ad6ac5ae13f089d61cb054341e52e
SHA1 16874c6d71233e219467ab3125e637a61bc258de
SHA512 c5b4af0724cbea1d80f1efbaaccceb0a032f49c8378245ee798f815c55717a6c29e8e472968ee47011844796be7daa66e03920480a228a2378b763a6e1324dc6
SSDEEP 768:rvs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNAro0gD:rvs6pD1WvxzWju1jahILIsNL0gD
TLSH
T158D2FA3B680CC77E4F841E5CEC2AAF967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ba972ff0dbdf4041efa193ebc931007e19c22c25314068529ec20db58be168b8
MD5 fe751f249bf383549845249869f4364d
SHA1 238a002c087d26c9b7863458b0be1c6fb8209192
SHA512 7b243351de204a6cf1972e5faa62ca8d1980fe85b073411596812652936397a1b291fd4bb3f04a88fb403a52301f534835869acee71b2d41949b02966de5bc69
SSDEEP 96:KUAAKteP6OYKTCEK4K3qmq0gK9KaClQUCAQZLEb:iivGr3fClQUCAQBEb
TLSH
T1C6C1221271BF06022DBE291DA254D727AB827167711DA42B3BE910B11E6BE340DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5929b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5929b6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9ad9f4261b8a5f146cb2eed33d6d7a114667e87b6082a2fd995060096480d270
MD5 0aaea8311134d34d32a0ee3524551046
SHA1 043acb4bc1276c7a3b5d00537cb7fb7c909e0f2c
SHA512 28fb1199a9e023558ff626acb795966c6f857c678aa9eefd01854572241a7067a1f5b19ec5cde76f60a52fea2c09be681bd98daf5eb88125ce4ed1bd929cc54a
SSDEEP 384:7iFiZcIrUsNE8TUNTUlIlLMSFGP2a95OVnuzJrRYOObjI9G6w7D:WFQQFwgj83jOJ2hRY29MD
TLSH
T1DBD208F298E78936D9AE9703B77D2D134EBDC067B5855A40B3989A0CCC9A0BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 154b7cedad329f51a6277b7eef450da3e732623f632b4822c59bd36a938814f0
MD5 002940583c98a9d3856b8b3c2319dba1
SHA1 c7f644eb665677fa40d183bee7f86ea50a3f1732
SHA512 7f57ec481b7cec1738eb3a4f865d087b034dc04e71b46c8847859de48bcba61df357abced2bb01573b72aa1add417d73fe51567a262024699360e1be25561714
SSDEEP 192:qONi6O7+3hQmiUy7tGttb0gO2KDgG3qdU6:qONi61WGt95OVHadU6
TLSH
T18E02D73968286CB78EF2AD45FA8727179FA5113BE9952F40D9E85F0C00DB69C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2f79fb9447ee535c398e9cfac9414a6776c3295d26e242fc5b4acf58d427338e
MD5 6c490f22ae929a8f23bd9afde9f604dd
SHA1 90e7e4db18e4e6860139e5d91a63c5a91e50538b
SHA512 e04651d999b53611b2a98790dfff8cff0e2922808dfea030eb4da8efa243b6713814b3caf3c72dd93666f1ad3f461a9840dc468adfb8fb49f81fbc4da7899426
SSDEEP 384:BsNM8jM4EGua95OVnuzJrkYOObjI9G6w72:BFejOJ2hkY29M2
TLSH
T10E726C36E8385D374AB39115F5873A139EF590ABCA892F84C5ECAF0C01DF5AC2346D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5e3884725a3fc7e01fa58ba3869698ff8c3ed4e17238b93fe43397353c27df28
MD5 114e065a1cac7051f20f4ad4e92fd617
SHA1 3b341798255ea97ad0c425394dda22b61044a9d8
SHA512 e68817dbb5d697f3f133bb78c90c0791aa89c8722bb94a95bb5ab3ac60cf557b780ab4c3831e48e4a830bf2092311478cb126ab962db6f49a8e37399c9f386a2
SSDEEP 192:uoLsNMAQRq7+3vSXQmiU17dMDB4atb0gO2KnyF0SJrjLMWq/8jZEgKu:VsNMAM2rGua95OVnuzJrkYtEu
TLSH
T18A422936A8385C375EF6A145F5473A139FB5406BDA892E80C5EC9F0D01DF6AC234BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2a674ceae247fd4695dd05fc2f16f7bdc14d771dde94f66b86fd809ad68f44e7
MD5 2c1fb54144c7cb324737cb738eb28af3
SHA1 1e1cb11e4c53b8463cf2011186d5504887f9ee6b
SHA512 ce8b1c2990c0f005239221bca29f8b05c3dad9d6fcdbb2e9c590b0d02ba62fa4b66076dc22f456c1193acef64c24e96b7304b36b38cd1d370f5f23cc5a134597
SSDEEP 384:SZcIKsNMLMSEGua95OVnuzJrkYOObjI9G6w7D:gK4ejOJ2hkY29MD
TLSH
T137928C36A8385D375AB6E105F5863A178EF5907BD6D91B84D0ECAF0D01EB9BC130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9cb8d817bb083825b676ee5bf038e1823eca35108aa00e298429e9ead93b2ec
MD5 81bfa4a8e53fd61200d1e2ef109381ff
SHA1 03b9e072505d2cdc75bb5d124fa38155cc8461d0
SHA512 b6b607726d0ccd1050051821b3e9833dbc92efe3c9638d519ca739b56c03d1640060ab7bab7658114931f4db235a6db6d793ba06d96dbccbe19eb2f629520abd
SSDEEP 192:vONl6O7+3/QmiUyVtMWttb0gO2KnyF0SJrXcNWq/8U6:vONl63SZt95OVnuzJrEYU6
TLSH
T11A121936B8286C775EE2A541F98736178EB54127DA8A6F80D5DC2E0C01EF6AC234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 83b9adbc9ff3126934301b8f7257ff962b3dfcc3ab14b83535f4ab394156c882
MD5 c84d2421d8bddaf9b1fe8af86565c075
SHA1 75204e63f2ab0f639e8ac2c92cdd7485f643d350
SHA512 06f07334cfe12fb9e22e7a9309f15bfe7cc8f9d315828bc34bc3a1e4c1830929e11660f7d9aa0b51d71c8240b8e5ed0faf0be75d9a14dd628eddef1bdd6aedcf
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58dcfd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58dcfd.TMP
Size 392B
SHA256 4fee7ae09d011b25307b999ace883c5e1a11be060759453d39a927ac9fc534b5
MD5 bbdd162bac490ee5149f95f7838fffe8
SHA1 46130ebd9bd39c80771f89224de1a0b1f19ef3ab
SHA512 ebf75d96cb359d49c43ade0762de71e2f18e2aa7dc12208825d0df9ac9e17490dd2f4b1fc3c889c12d5bb859254d6f84961d7e214ae705dc2d705e52422c1d6c
MD5 SHA1 SHA512

Submit Download

fce82cc0-edb4-4655-8b5f-57734572e390.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fce82cc0-edb4-4655-8b5f-57734572e390.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 739f8203f4e427a520c69985aa5f99efb6c218e1da81823f871f71e9c339bb1b
MD5 73c75858bf2e026a99669a2c4f00b65a
SHA1 4080f41785443c38913d240b2c0c0fdd9aa9776d
SHA512 32d056c048806e621846f38499c1c1d2ddcde897d4d51af7f2a0b40a8d8719409c6b45c0c7c89f40431f3bff1a395312f25f64ede11f20695d998217018f3d37
TLSH
T1A7414C58A6FE1148F3F76E5AABF6A46D447FB9771E0AC45E10110E4F0B26A40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads