hxxp://zefoy[.]com

Analysis

user interaction
yes
max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://zefoy.com
Sample260802-2pgfpagg93

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301843295457325"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{44D06028-B012-4360-8EF6-9874656EFC66}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{E57F60D1-EA23-442F-AD3C-623195A34A66}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2432	2144	msedge.exe	88
PID 2144 wrote to memory of 1072	2144	msedge.exe	89
PID 2144 wrote to memory of 2896	2144	msedge.exe	90
PID 2144 wrote to memory of 2896	2144	msedge.exe	90
PID 2144 wrote to memory of 2148	2144	msedge.exe	91
PID 2144 wrote to memory of 2896	2144	msedge.exe	90
PID 2144 wrote to memory of 2148	2144	msedge.exe	91
PID 2144 wrote to memory of 4172	2144	msedge.exe	92
PID 2144 wrote to memory of 4172	2144	msedge.exe	92
PID 2144 wrote to memory of 4172	2144	msedge.exe	92
PID 2144 wrote to memory of 1720	2144	msedge.exe	93
PID 2144 wrote to memory of 1720	2144	msedge.exe	93
PID 2144 wrote to memory of 1720	2144	msedge.exe	93
PID 2144 wrote to memory of 4240	2144	msedge.exe	95
PID 2144 wrote to memory of 3048	2144	msedge.exe	96
PID 2144 wrote to memory of 4240	2144	msedge.exe	95
PID 2144 wrote to memory of 4240	2144	msedge.exe	95
PID 2144 wrote to memory of 3048	2144	msedge.exe	96
PID 2144 wrote to memory of 3048	2144	msedge.exe	96
PID 2144 wrote to memory of 4032	2144	msedge.exe	98
PID 2144 wrote to memory of 4032	2144	msedge.exe	98
PID 2144 wrote to memory of 4032	2144	msedge.exe	98
PID 2144 wrote to memory of 3604	2144	msedge.exe	100
PID 2144 wrote to memory of 1460	2144	msedge.exe	101
PID 2144 wrote to memory of 1460	2144	msedge.exe	101
PID 2144 wrote to memory of 4760	2144	msedge.exe	102
PID 2144 wrote to memory of 3404	2144	msedge.exe	103
PID 2144 wrote to memory of 4760	2144	msedge.exe	102
PID 2144 wrote to memory of 3404	2144	msedge.exe	103
PID 2144 wrote to memory of 1756	2144	msedge.exe	105
PID 2144 wrote to memory of 4360	2144	msedge.exe	107
PID 2144 wrote to memory of 4360	2144	msedge.exe	107
PID 2144 wrote to memory of 4360	2144	msedge.exe	107
PID 2144 wrote to memory of 4492	2144	msedge.exe	108
PID 2144 wrote to memory of 4492	2144	msedge.exe	108
PID 2144 wrote to memory of 4492	2144	msedge.exe	108
PID 2144 wrote to memory of 3736	2144	msedge.exe	109
PID 2144 wrote to memory of 3736	2144	msedge.exe	109
PID 2144 wrote to memory of 3736	2144	msedge.exe	109
PID 2144 wrote to memory of 4268	2144	msedge.exe	113
PID 2144 wrote to memory of 4208	2144	msedge.exe	114
PID 2144 wrote to memory of 3184	2144	msedge.exe	115
PID 2144 wrote to memory of 516	2144	msedge.exe	116
PID 2144 wrote to memory of 516	2144	msedge.exe	116
PID 2144 wrote to memory of 2504	2144	msedge.exe	121
PID 2144 wrote to memory of 2504	2144	msedge.exe	121
PID 2144 wrote to memory of 2520	2144	msedge.exe	127
PID 2144 wrote to memory of 2520	2144	msedge.exe	127
PID 2144 wrote to memory of 2776	2144	msedge.exe	128
PID 2144 wrote to memory of 216	2144	msedge.exe	129
PID 2144 wrote to memory of 216	2144	msedge.exe	129
PID 2144 wrote to memory of 2044	2144	msedge.exe	130
PID 2144 wrote to memory of 2044	2144	msedge.exe	130
PID 2144 wrote to memory of 180	2144	msedge.exe	131
PID 2144 wrote to memory of 180	2144	msedge.exe	131
PID 2144 wrote to memory of 4184	2144	msedge.exe	134
PID 2144 wrote to memory of 4184	2144	msedge.exe	134
PID 2144 wrote to memory of 452	2144	msedge.exe	135
PID 2144 wrote to memory of 452	2144	msedge.exe	135
PID 2144 wrote to memory of 3268	2144	msedge.exe	136
PID 2144 wrote to memory of 3268	2144	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://zefoy.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffedc68c188,0x7ffedc68c194,0x7ffedc68c1a0
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,14677758201803277168,16796267517402664741,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,17075795406958147859,9220299363100975340,262144 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,8260483228311054022,6337896341870285225,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,6212013570339623682,13965157842761727699,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,450914164752284713,9063271993561912503,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5046294184895628286,11886649844606007028,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,17760087477248886917,18153145636345419730,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,3244100229282463213,17568348133419961350,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4166602487826165817,15444672341678016997,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13381728816616751976,1722970709107493171,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,6207806243678870854,10504120446097331129,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,7593242518237222006,3341944775951107603,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8852437308256305233,1504235413221675743,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8852437308256305233,1504235413221675743,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6488,i,9516574538224588774,12728115317724353747,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6692,i,761520387558913618,13772989463715637594,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6816,i,3989470197817333820,9242186677401399523,2097152 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,10246803808357922491,7932828012258322980,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13613744765241014875,13641216974048492350,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,1648008685007524081,764251349898892204,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,14666892416326220020,1649276253283372798,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,10581386017122766143,1689155591935547631,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14431566544236064306,12796757980950493363,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,6948309919092173999,10116265134821199600,262144 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,11418668667974265692,9121315252420930247,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,8373824684259092254,14399522737038213688,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,2058970250758493738,14250357245087432695,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2062524133928141975,9353393693237233427,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,17680115047033983879,8391245301385022272,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,4725400225150817538,6563514543035967857,524288 --field-trial-handle=2916,i,13065441923669004389,17372391595427423744,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 64de14b3e53404ed55c8cc273319614628f7e193eb9e22c99c425da8777db719
MD5 fe2e0b87ed94acab690032273f466e1e
SHA1 afea6c1983f272d7b31d6003129bf8913162d7fa
SHA512 094680041e5e4c5e3a8babadf8852113c34751a8a8734a5677734699320f63b10940784f577f06135bb2ea25a2be4dae72abf39cf530d814133ac231149d7289
SSDEEP 96:2smJjnmSmJ7JmJdJmJdCmJd8mJdZmJd2mJdwmJdwmJdwmJdwmJd0mJdRmJdTmJdq:2Vjnmv7UdUd/dFdEdDdJdJdJdJddd8dd
TLSH
T15791194282F9D3DA9F1720CF6EA4926C44B03709EBDCD548135C8DD9314E4DEE9F2AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 51fbb94e55e685213178773e3558b371b028cba5ef34f21a324f755a75526741
MD5 22c6c8d4e6e37dad8322c198c7cb821c
SHA1 e2158a7159b18e2366aa9157f88dd3c7f6fb7c60
SHA512 2dad21a369089bb577f85340bd4d154fbe81eac11d24fe25c8a956b5333b2f01433ee46e1c74be2dc2d3beefc7ad44114e04a2e47f3d2b19a9b7fa07d59abd9b
SSDEEP 96:dmJjNmJsmJImJImJImJImJImJImJImJImJImJImJImJImJImJImJImJImJImJImK:YjoVBBBBBBBBBBBBBBBBBBVLO
TLSH
T1C9912A4686B4C3DA9F0B10CB9DA4D65C40B03B0AEBDCD60C175D9DEA304E5DFE9E1AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 57fcf3c87a3363dc1c2ec5f3c77674127467328691978b6b3c924da2e700cfb8
MD5 7711967569324a15412c63663486ddff
SHA1 294bd364948fa9ec6c5bfdfd55f44f93ec6c49a7
SHA512 a51d67e9bd678fdb4c4987cb43e2314c5c413b57af0bc67f0fdbde631d37d31d09f9e0fdae43ef4321f6635450a885e7c1be8025cd66653f032149b9842238b7
SSDEEP 96:NmJj9mJrmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmJlmc:oj4aAAAAAAAAAAAAAAAAAAXLO
TLSH
T18F915D0386F9C7AB9F0A108F9DA4D39C41B03B0DEBDCD649139D89D9314E4DEA5F5AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 df7d66250399efc1f5d376ecd6d95e96f6c620f35164dd1caf5182b3dec1455f
MD5 8e8a8949f8c1b7642160c43e6d3b804d
SHA1 3526141de18d4e0ed649881af92245af40856884
SHA512 5886590ebeb0fb713da9125d1001c5da7986193c13bdaf8c8a742ddc7edf824a413cac30e99d2e74469b5e8aba2ca1e8ea5987ffbece19a48677224a45a5cddc
SSDEEP 96:bmJjOcmJtmJTmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVmJVe:qjOlIiQQQQQQQQQQQQQQQQQeLO
TLSH
T18B911B5282F4D3DAEF07108A5BA4925C40B1370AEFDCE549539C8DDD30CE4EEA5F6AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 410b063972baf48fa9ef275fb02e69684836667de70298b146881a2b402912c0
MD5 f28a934c90f6051f0b9de10ffcbe07f8
SHA1 0c4878fb94d17acbcd0facfaab0d1239e6c6ec68
SHA512 2d2b047e7630642658ad86d9a9a954d0ef0097e4620129e55d9f0f517ec05a230d85fab0f5f7b4517018526378758f4fc4111876d67025714894018f623dcfe4
TLSH
T1BC7170385711308DE79641F2BAD30CA2B07AB2C1F5D3DFFB57929071C91E3AD8406646
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c093e095fe36da7c2aaf282f5e4d6b15ff47b89108bc6d02261f8215d74e7b2
MD5 b145db176a65750f337ee3213677acf6
SHA1 461474625e2c8622d90ac1f7177949b790363b92
SHA512 21b1db66790fe97101f577a94f4569bb560cc75f346977735f5ded5bab4a5ac3f906e5cde49651a0720b907975e15379f1c7b40443e3161562a46936d5ddd6a7
TLSH
T179615C385B11305CD79611F2B6D30CA2B07AB2C0F9D3DFFB4752A071CA1E3AD8456652
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bdfc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bdfc.TMP
Size 2KB
SHA256 84b8da7a940186a8616dd2e13ee393589dec336927cc3501178a9447775de8cd
MD5 0630018f9cf3747c0f3388b98c7f6c8e
SHA1 d4118935731c86169d50bc5359c9f342e9b01b8f
SHA512 ff1ef0107af27430eea30ee6c0b0d7260f28726b30595c2f507ce73bf1db7f0e60f0c0427f840219cc411f7e22bc02ff21a836c476a88441a59b0b0efbe97aa0
TLSH
T16051B3384702345CD35900F1B1D30CA6B0BAB6C0F9E7DFFA0B63A475CA1D7AC8814654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_zefoy.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6c1c7913c881b2501923c24adc9d9b0e01062a5a891fe4c4a6ad04d9990cac8a
MD5 5e7d7824a1bf5705d2c48b4f7f6393f2
SHA1 4f648d0fd515280879a029fff3c0b541a2f11680
SHA512 d5907c348c0006e3fd1e8c341a889d04829f5b3185ad804579f173a929b5d153d246dec2ce0d0f7245992be7320feaee7a5223075033f149462ea8b33cebdd02
SSDEEP 192:DWEXu3JpSRiFeTrX4JspJSJJ31UwpVRoKv8Eo76PiiPq/PitPijWwMTeAGj4v:DWEXuZQRiFeTrXkspJSJJ31UwpVRnv8U
TLSH
T14CD127F753F5821D982292F0D618AD2FCD991424832C7D7DCDF4BE5693D20A1E241B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 54eb0fdbe890b1dfc53fd641efc9c79b90859c4bf370ef83dc1a4b51cd731586
MD5 0ba414c49a6ad740afa5b6d7ff0abd91
SHA1 c345935e1e276f2991638ab1790e1c95dc38a84b
SHA512 9d335bcc0815ec936b7e2ee977db2842fe83eec837c1918cd368de7e65b97dba97fafb62335c7f24daeb0f88363dd2e1189bcf50a11b952f8734b4d23ea25880
SSDEEP 192:D+2/j458JvSaagewS9+JW0JYJHxkweFeMVXoQz8Do76PsYP2/P4tPijAWTyZ5:DZL45Y6aagewS9mW0JYJHxkweoMVX1zg
TLSH
T1E6024AF7C3E9821DC82253F197146D2BCD5A192483283D6ECDF5AF9A63D2071E24179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a7e2d5e0-858f-49da-9192-fd808821377e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7e2d5e0-858f-49da-9192-fd808821377e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e6cc007fdd6ab13c7efebb50e9e13149bb1f906a7498d4024750a34050c1c99
MD5 963bff0002f37621405eea8ab5f4de66
SHA1 bf8fe44bb0a6d24c6f7bd0a886390f0a67fedfb5
SHA512 73533c65bea6e577734148cbb190fea050f673c3f46ec1ad982685c77b1a698195cf41ffb268862e3e65f4040f425dde58274eaf2bff2d1bff1f841a8c21bd8c
SSDEEP 192:sxZlRXyM/jK1Ml8MkK/fcsGY7/iEIdpp9HW6+WN+E7/Y9I0+ajqIgrJ:sxZlzMK/fcsGo2XHb9/Yq9
TLSH
T1B642F9026A34A977CCDBD209FA55BF53E6F9447292900E54A9FCDA1C04E6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3ad15b1516d2982f66a864f6c52b9dcf6041f60419d7b90e286597836dc9f023
MD5 a08cd933e74a66ed57aef76522cebc31
SHA1 90e82c0d94dbe31286c4737f79887b1ac0908d4f
SHA512 87cf14c2d14dfc09146ba0651e8f50f9d8c058655ed7ec8e38f209513b3418a238f6932ef5f77ed2197b67e3d4d240acb3e17e65d52c42cc0a876842fb112613
SSDEEP 192:sxZORXyMojK1Ml8MkK/fcs+Y7/iEIdplj9HW6+WN+59XY9IR+ajqIg5+J:sxZOQMK/fcs+o2HHbmXlqs
TLSH
T18B52E812AA346977CCDBD209FA55BB53E6F5047292900E54AAFCDA1C04E6BFD320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7cbfcebee45002d57f99174ce6cf68ae5b968995e4e82b5d75ca656a24ffc5d1
MD5 bdbc26e83c5681022c722cc411752e11
SHA1 8d9c387d123bcab1d5fbaecedcbf3693fe47cd2b
SHA512 8c05853a630f4c429556db3abede95987156643ddfb85905cf4c8e799814496e1f22f2b14225d1964e459567ded057e54d9cfff2e823a88df14d4d24d6663982
SSDEEP 192:sxZORXyMojK1Ml8UQtkK/fcs+YX/NEIdpfjtHW6+WNG/MQZYD4ZITlajqIg5UJ:sxZOQqGK/fcs+kXZHbgZLqm
TLSH
T1EE52E8126A3469B7CCDBD219FA55BF53E6F5046292900E54AAFCDA1C00E6BFD320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 20c5e9438a19864ebf56784cd5d3f4f7bf5db9beb0985c2d2c46ee89606bd119
MD5 435dd88e8949d43d872d22d5605c5f1f
SHA1 368391df92a0b679708c23601e25e6deb05d2e17
SHA512 44de42b407431f745cf4bc33c4a42e89d65e4173e34985b7e2282ae5e831d34a906cb3678983a0d5e208eab96ec0bbb23212576b0a1c597833d2882c469ae9f2
SSDEEP 768:KXcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNNroKg6X:KXcv21wWvu+Z+u1jaeFLeRNmKH
TLSH
T12BD21B2B280CCB7E4F845E9CED2A6F8A6DE801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e82f27c9-ede0-4460-8499-869f1aac6d13\index-dir\the-real-index
Size 552B
SHA256 11193c9ea17a81e8b5ec4fcaa9a9f917ddcd449c8ed25806f65a281fef3dfe3e
MD5 bd6050a5ece5af0ef6817a9d003f9ac8
SHA1 87cec4f4fa9ab444e017c42f3fa96031a80b995e
SHA512 94da853b6d249a94afaa1d6ba84187311844dc90eefdb3c5a94d689c797ac97ccec4ebb709b28d4ffab10b42d60e7d9667cca60adebf3c5ee264650fbc1fba71
TLSH
T119F0AB508F91582AFD540AB220F510F073B0CEFC7322C59A652C663A2C2630860271C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cdc1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e82f27c9-ede0-4460-8499-869f1aac6d13\index-dir\the-real-index~RFe5cdc1f.TMP
Size 552B
SHA256 5a435220af6702edc173aea46622475a18fb8b49acd597da0250269ee40c829f
MD5 f178b8e262417a11778c08aa6651d240
SHA1 a023d2f2b73a864b64c067c5f6f30f153d227e47
SHA512 9d2d3973b29f0ad469254319dab4cfc0e0b5b086b4cea01b9e744f459e5295752d39c1eec8c5362d6c0dcb88416ee58dfce2013bf26bd2b64ece489abd62da98
TLSH
T1E5F0F8C6C7A28813EE600AB224F504B5B370C9107232E883203AA82E2C723CC95230C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 830e99dca0cedc1d2535a2d33789a32386b0cc98512e0cfa92d453350aa1315a
MD5 964711b31a6a70be79971782129660dc
SHA1 f6fcc467a4ac010fc9fdb4f52dec00bc0353310c
SHA512 93e206110e2a6b136d3f8eae3b1f19f325aa705b9b874d11935c688c6795dd3632f91782113588873bf0a19579ef2dd879b9a0a0f0317d4ecd0677fa4bca82a4
TLSH
T142E0687A2DF62430FD6BD7D2147144A4006478B989C6BC8F683AAA8650B23552846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6be95d675b9b608d427714c599d33d87c18e6ed570363f87bdfb75060eb1ee39
MD5 918da0903ec30f59aba2a9be537265f5
SHA1 7d633c9873c3aa893cad1f6d1b991be388c6e305
SHA512 0b45de292d1869b5cf658de496a213462138cc290d9ae47e412cb9b93b4e5ef3d4659ab8ec12a6ebda3486bbd1fff0f9b3dc5b4bd7f241b8885cad3cea2da50b
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+HyKokuK2EKnq7M:mThJ3N
TLSH
T19A911E16317B0682387E7858A39987375E4136A37818A8BE7BF845614E3BE113DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f543ce13-eb97-4a38-80ab-7d52562d02c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f543ce13-eb97-4a38-80ab-7d52562d02c7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bf6f1e004b60df16008c7ae689983ff72e3f91f1458665f697bf889764d48b19
MD5 4ae3f05d3f6e62ff9a98471d1f949d18
SHA1 dafbae168cf6dcf8bed97dafa65d9987ffd27cd7
SHA512 4ef59a4d62e2b967beb0fb8f61236066d69946c632a8bf1412333a34a8656c60ab5f5de51102a8e5921c74415d0d072179622137ddb301e5d16943754aa38c8f
SSDEEP 192:uwLsNOtVnQF1O4+YLeYvQmiU1Q+c4e+CGVgOqEl4/bJiHqHU8:fsNO32DziEhze+CnOqEl4kYU8
TLSH
T191323C32AD746C779EE3A540F4473613AEB85127E6852F90D1DC2F1C01EF7AC230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 579ac6ce7e5fc1124f01c8bca4d7b0e58b50b9e83d3439d6d45224ead4151b4f
MD5 ac02110cb25fcf510890906235528ebc
SHA1 39f862729c7fc74c034352de8743155b3bc793fd
SHA512 3fec3d9e8e3fd8c1c1fb56be66b480158e73deed48a9756f3a55db20a18bb2f76c9ffa04df78ca70e444dc875201957c07c8759066a750892efad0a65a3921b7
SSDEEP 192:JONt6v+YLNQmiUyoTZh+CGVgOq8usFT7U6:JONt6vz/5Zh+CnOqyFPU6
TLSH
T10102E935AD782C7B9FB2AE45F98737176FA4213BE9912F50D9D82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 16f2dadf78affd9a6bdbbf32b75d776d51525223854b6a690e4bbbf0f498147a
MD5 ea1f1e99222b71b1c31fa03753abc491
SHA1 75f49a765e876562b32bc1998be5fb3f3fa58404
SHA512 5e81221538003735d978a5230909f0bac53e376e84c8f6a2304163b2e162febc1bcdc48e93690806e9ca1d027fef465dafeae8bee18f56634590c19a5b9ec4f4
SSDEEP 192:WONn6v+YLQQmiUymThh+CGVgOqEl4QCHHqHU6:WONn6vzU5hh+CnOqEl4xYU6
TLSH
T15A122C31BD786C6B9EE26544F48736136EE95227EA857F90D4CC3E1C01EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ade5a20056e0959f34e5f3ac34872a6c1aeaf6df8ab63cf4f3f63599b6488e57
MD5 b472ba7dca2a24306e54b97c26126dfa
SHA1 fa5494f23b307a48fb75d05be4f3478d8df40070
SHA512 72f8bbf38b98a5d87e8dc1cbeff12da1a449037bccd1e2b99bdd5481b7e2440fb81316888ceaf6b06c1d6fb6c2ef56c2fdc58dc54928a53d5834bd216d44979b
SSDEEP 384:uQZcIhsNO62DziEhze+CnOqEl4kYnTKwBODNZOCEWe:bhffDS/OHlPYnewBKZOFWe
TLSH
T11F928D756D386C779EE2A144F84A31079EFC9163F6852F9491DCBF1C01EA6A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1e93596e5491f51455ae61d2150b48f8f99d632832158b5120f830b0f87415c9
MD5 9b71b42bbe7c2cf4e9c19f07106e202f
SHA1 38c8f35602e67ab230caaa4fca891d6df1f68763
SHA512 f3c562b78be2ced37547855f8db444225afbba3fba0c3989494c231e0dc209333d18e270ab3198940f856f2aebfcfae8e54fc008d81897ecbf69e857e3fd3815
SSDEEP 384:W4iFiZcIHzsNe8TUNTUlIl62DziEGze+CnOqEl4ZYnTKwBODNZOCEWe:AFQTzwgLfgS/OHlcYnewBKZOFWe
TLSH
T175D208F258E75876DDAE5747AB3D2D035DBCD163F5806A50B3886A0CCC9A1BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 31463b4c8acb3df00ffa5ecbe99ee8ab007fb7eceabaa9c08afc26f250c78cee
MD5 0aaf28ad0334e9282e61a99d4d83c360
SHA1 e58c6a029c65c880961f541f7e8836f6ee4655b6
SHA512 ff4220239e667af08d341d1892588452e44ee88d1a59c52b01fec363b02d14c328fa11b9e2ed97a1d0327f796eda4f62e1d5a104240bc98cd0330289622e7e75
SSDEEP 192:u/TLsNOtVnQF1O4+YLeYvQmiU1Q+c4e+CGVgOqEl4/bJiHqHU8:uvsNO32DziEhze+CnOqEl4kYU8
TLSH
T132423B356D746C779EE2A544F4473613AEB85127E6852F90D1DC2F1C05DF7AC230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47d1c6cd-43b5-4f81-86b4-99a594ce48c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47d1c6cd-43b5-4f81-86b4-99a594ce48c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3fc35141195356c13375956698045679b80defd03f376c0d14c74a68869c6067
MD5 50a5de6463fbbd8ccecc73b8cb971aef
SHA1 c2522c6be177485b3a5205e9b6f282268daa508f
SHA512 22d3241f652dadc3af953c373ccfee7936b7cae9ea5ea9de54a9ba03544cd7147bb489b9e3116bb05a177f1e79a4585506bf7563fa2e8e82f46380e809b8ffc3
TLSH
T17F415F9866E91148B3B76F5AABF7B86E487B79772E0AD45D10110E4E0623B40CCB1733
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download