hxxps://signin[.]zorvixa[.]vu/serverin/cuvvv/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://signin.zorvixa.vu/serverin/cuvvv/
Sample260803-bfzykavhrd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301927700402445"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{404EDBA3-5511-41F8-99B8-24AC507ACD2B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 5600	5316	msedge.exe	87
PID 5316 wrote to memory of 4484	5316	msedge.exe	88
PID 5316 wrote to memory of 5952	5316	msedge.exe	89
PID 5316 wrote to memory of 5952	5316	msedge.exe	89
PID 5316 wrote to memory of 5952	5316	msedge.exe	89
PID 5316 wrote to memory of 1564	5316	msedge.exe	90
PID 5316 wrote to memory of 1564	5316	msedge.exe	90
PID 5316 wrote to memory of 3612	5316	msedge.exe	91
PID 5316 wrote to memory of 3424	5316	msedge.exe	92
PID 5316 wrote to memory of 3612	5316	msedge.exe	91
PID 5316 wrote to memory of 3612	5316	msedge.exe	91
PID 5316 wrote to memory of 3424	5316	msedge.exe	92
PID 5316 wrote to memory of 3424	5316	msedge.exe	92
PID 5316 wrote to memory of 2064	5316	msedge.exe	95
PID 5316 wrote to memory of 2064	5316	msedge.exe	95
PID 5316 wrote to memory of 2064	5316	msedge.exe	95
PID 5316 wrote to memory of 4144	5316	msedge.exe	97
PID 5316 wrote to memory of 4144	5316	msedge.exe	97
PID 5316 wrote to memory of 5788	5316	msedge.exe	98
PID 5316 wrote to memory of 5788	5316	msedge.exe	98
PID 5316 wrote to memory of 5648	5316	msedge.exe	102
PID 5316 wrote to memory of 2848	5316	msedge.exe	116
PID 5316 wrote to memory of 2848	5316	msedge.exe	116
PID 5316 wrote to memory of 5912	5316	msedge.exe	117
PID 5316 wrote to memory of 5912	5316	msedge.exe	117
PID 5316 wrote to memory of 5912	5316	msedge.exe	117
PID 5316 wrote to memory of 1568	5316	msedge.exe	118
PID 5316 wrote to memory of 1568	5316	msedge.exe	118
PID 5316 wrote to memory of 4556	5316	msedge.exe	119
PID 5316 wrote to memory of 4556	5316	msedge.exe	119
PID 5316 wrote to memory of 4556	5316	msedge.exe	119
PID 5316 wrote to memory of 2188	5316	msedge.exe	120
PID 5316 wrote to memory of 2188	5316	msedge.exe	120
PID 5316 wrote to memory of 2212	5316	msedge.exe	121
PID 5316 wrote to memory of 2212	5316	msedge.exe	121
PID 5316 wrote to memory of 5652	5316	msedge.exe	122
PID 5316 wrote to memory of 5652	5316	msedge.exe	122
PID 5316 wrote to memory of 2836	5316	msedge.exe	123
PID 5316 wrote to memory of 2836	5316	msedge.exe	123
PID 5316 wrote to memory of 4088	5316	msedge.exe	125
PID 5316 wrote to memory of 2964	5316	msedge.exe	126
PID 5316 wrote to memory of 1864	5316	msedge.exe	127
PID 5316 wrote to memory of 1804	5316	msedge.exe	129
PID 5316 wrote to memory of 1804	5316	msedge.exe	129
PID 5316 wrote to memory of 2980	5316	msedge.exe	130
PID 5316 wrote to memory of 2980	5316	msedge.exe	130
PID 5316 wrote to memory of 5752	5316	msedge.exe	133
PID 5316 wrote to memory of 5752	5316	msedge.exe	133
PID 5316 wrote to memory of 2188	5316	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://signin.zorvixa.vu/serverin/cuvvv/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8cdfac188,0x7ff8cdfac194,0x7ff8cdfac1a0
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,7355354715724237156,9573499339959077612,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,4367796719791607103,14647351038100367112,262144 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,1457067303059987606,7447377155768905357,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4654393533962343820,8638575440229101849,2097152 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1309087978848669667,5987233717013291697,2097152 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,9848500007949567771,14636894773132660097,2097152 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,3519814020456457727,3131165140008165335,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,14140283635392821350,14324073243617178781,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12910199600541351173,2983205353179109608,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12910199600541351173,2983205353179109608,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16261957207651244293,6985117117042800959,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5880,i,18388658342844771979,5825978652986461762,2097152 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9305756796092967672,8547167319804791520,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6684,i,5621184323572692210,7732286222896373824,2097152 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6674181203276912952,4407200762228489377,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,1586588232138811898,5051119786867731643,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,8757651333900984925,4648407259067606660,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,18130308308715462195,14019334948233827448,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,8531544584454820009,14985033920945292406,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,6081292622449299612,12107735344041807760,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,13226048816147915987,6166453221310801703,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9458517465975412050,3960978509703143035,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,15198070702668862145,10747792810383171185,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,13543295928738308141,15515850621287442181,524288 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7052,i,5048370268669978287,2573642709933318456,262144 --field-trial-handle=2192,i,12543690811771727836,1053401479512763847,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 e96ed25f60f0ac9df14dd1376fd8ebb84dd02b8bdf9cc7fc7373450f26f613a9
MD5 ac61b33831bec9e834252ab4ae9b2219
SHA1 f54263c1c4521a18af981e805f0bb862da874ffc
SHA512 03af1f88b689be246bbe3ee3657ed994a2234ddb455a1a2511ab81718bad360cfb1c42e16dc00ab488fa4ed7197b8360703df0a92a7eb2fc31df87e7a7f8432d
SSDEEP 192:Kjwo5hhfffffffffffffffffffffffffCCCCCAZh:Kjwo5hhffffffffffffffffffffffff7
TLSH
T157F16B1A82D4C69A9F05308B49E8639D50F1370BEFDCD608138D8DDE718E99FE5B5AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 04f3ddb7daeb9dbcae64d811eea4f8a0acb38c1e81e77ecd0b621bac7723d69a
MD5 395a2f8511e2a03a76bf748313be3822
SHA1 b772b2b88068db94358774d9d5e30de9415911f0
SHA512 d289d8111b16e450b97d695d93ad9888b60ebb1d77e6fef657f5fe0d32f418aeaa0f16054ed70eaece480c9daa61f5b0fd9d2a1658eb2f7d7fed56467a6bf9f8
TLSH
T15FE02B65CC21EC374DFD4758A0094B57E750131736405D5F7A3C91088FB063655C585C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5829155ad8dc4561e13a311c8071bbae3aa1f9450b2987c58dc869d262275702
MD5 ffb5185c285df82403b53a1fee596cef
SHA1 d5fcd768383085e939120d804caf925e038c9753
SHA512 74f99c1b07bfaca8f3f8c684954651cdb79682ed179f3a7eb336fca259b8e89519133cc53d6ee42f2fed43293ca2b57419d69d4e2a153ea4835225e059e1e898
TLSH
T1E1717D3A6F7D48F1E75D0030AAEA22613CB54DEAFD13DEC38110F4BC6AB97528389600
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589af3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589af3.TMP
Size 3KB
SHA256 b48b45fe17d07d70c65e2db9ca39d17fb3b1116629ef17a9992a3a0f89fe506f
MD5 60645c15c10d243649068a7a0c780696
SHA1 b996967b53ff702ebbce9eee1d4de35ecccd4f9a
SHA512 20b01d63eb4c55ddd837187979974a08d3ad1b82f3f97a8707481e488301c455fe5538cbee647287a7f8791fc4ef27cd46a9e14bdc405de6202f5180f6714fb2
TLSH
T1CD617D3A6F7D48F1E71D0030AAE622613CB14DEAFD13DEC38110F4BC2A79B518389600
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5316_822093016\CRX_INSTALL\_metadata\verified_contents.json
Size 2KB
SHA256 6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822
MD5 c7182c4ef7a2cd6a57e48d44bfd4af9b
SHA1 2e1e4746da948d83baf4bcebee618784f8ab209c
SHA512 d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83
TLSH
T1BA419322CCA5BC1F293173704EB90662AB0595AB2081295A70FC099D3FF15666436EBD
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5316_822093016\CRX_INSTALL\filelist.txt
Size 134B
SHA256 543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b
MD5 3bf6b4eae5af15288bf0d79702f9cb78
SHA1 b8a052dc4973757ae865661ea0300dea1d27f3b6
SHA512 25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c
TLSH
T1C9C04C206C0494B7810CEF55C5F9FD34940616007E33DC8913584270101B68E8DB5324
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5316_822093016\CRX_INSTALL\third_party\babylon\LICENSE.md
Size 9KB
SHA256 4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63
MD5 e57b8dbca804bf4a2db759fa1a70b3cc
SHA1 8acc131b3698964249b08a0178f7c8c467337048
SHA512 d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627
SSDEEP 192:agW/NVo4UTo1YE+FNzFE6GGfGb2y1CVzho1oHqxQJbbLwY:a7hUk1+bXU4qbQ9l
TLSH
T18E12427F7748137B0AC30172B78BA4DBF32E903C3B9556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babylon.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5316_822093016\CRX_INSTALL\third_party\babylon\babylon.js
Size 1.2MB
SHA256 b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d
MD5 e1adfd8f62854c2d9ce65f13268c1ac1
SHA1 d564ea1d59305bbec12995ee43f1c28838e82519
SHA512 ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa
SSDEEP 6144:j7WIrpHJ1yA3d0xEWv/v/82mXgBYdnU7yTGpjGp8MTYgANTJCpzesRGvJaGpLsXW:vC/ErriNqfGp0KV
TLSH
T175450999B3217926478390A5143F090BA33B68DE940540BCF299D8DFACFD149667BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5316_822093016\CRX_INSTALL\third_party\typescript\typescript.js
Size 10.4MB
SHA256 986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959
MD5 d931cf27eb964f239e5bec661810abf5
SHA1 1616508213014fa7cdb50e691cf737169019c6ed
SHA512 9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6
SSDEEP 49152:noUsnsTsUGJR5dZjSB1FBUWx3pZzoYzuQRlbVbOFeWSeoMTNKtsL4IMltR6SMF9K:BTsUqRIb3nYz1q3X
TLSH
T1D3B6E6BE79E330B16A5B2136672F8001B735D257220CD8907E9CC3A95F1587462EBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7010a7aade3b3181575e9fa8fe5aebf52cf10b98727f197706cf5daa3d253b8e
MD5 a9315209aa2f9a90eb14a42c8b22d86a
SHA1 a2af10a958ea5b065e5eef4a8c715836fe2dce02
SHA512 d7ccd912c9d9b37e5887ee92aabcd2d97cb63324cce00eb294a4fd80137b40294f203d2e7ab21c85240531ab55e214dfa78b192227d21966865e224d0c65c295
TLSH
T1715181F7C3F4866E8A1156F0AA146D2FDE6D0515431C3C6AC9D4AE1B93E2471E141B4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 a4a22b8ba0cb8efd14e3fc3f79dedbb3999dabfc46c6285744fa0c9431ed1ab0
MD5 1d2e4d34b93e1f31f8bf727f88123a7f
SHA1 833acc5215c83f6139a3c099e9307fb731032088
SHA512 bd10c590cd8a99b14c9da1a0c4ce3f50b2d6f372349e1587ce88b3641b59c4ac70efecc388d8d24c7338b543d76fba561e0c39549ef103535b1dfb5112f74f69
SSDEEP 384:sxZZ4qq1/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfoysE+s7AMLiHbJ4XK/2:shfq1/f3jfW9RC8wAefoysE1AMiHbJuX
TLSH
T194A2F9099424EE77CCD6A21EE6B57F73D6F5421682806D286DFCCB0C40A6AFC711782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 8e0da4c975493911cbdf40482f0819456a34d9b349690480065bc2e4c25580ab
MD5 c855ae8cdc0dbfaa4479af419ccec58f
SHA1 f8c6bd5f90d63adb9c75c64cafc07f32315d7953
SHA512 00a2efadf03476ba60664cd11d5b0c3eced49a4f9e40dd1e9f0b558c4ba1064c8e003f86ef695829edb1c8d87df7e4fe9536e207a11cbbd18c2f5966d72a2e0f
SSDEEP 384:sxZZ411/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfoysE+s7AzcLiHbJ4XK/j:sh41/f3jfW9RC8wAefoysE1Az8iHbJue
TLSH
T1FFA2E8069424EE77CCD6921EF6B57F73D6F5421682906D286DFCCB0C40A6AFC611782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 38c9a5c7c2ddea882ae9c7221ced5bc4ed3bc0ce501fdb6c274144b87f692de3
MD5 196d438e864bbb16cf94d611a3350e8b
SHA1 65c65d8991fdfa2045ea0c8d33241650b174e4a9
SHA512 2f3f769fd543e87ca6bad19357aa8ec885c5fdfdc79c131029ea912df78d83091740e4de30974cf7ba10fc9aa1ad1aee197e7550ba945a2760eafb15af50b183
SSDEEP 192:sxZZRvyMqZjK1Ml8Mkn/fHssHqaZd3zodpuOK9HW6+WN7ZIM4/Yv0uQmtu9IgjaJ:sxZZ4Mn/fHssHqazcLiHbJ4/CtsjW
TLSH
T11E62E8166A3459778CDBD219FA45BB53D2F81523A2905E44A9FC9F1C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 8cc6b874ba3f006c6dd7991415d57f319dbbc18924d5cf23b41a669d765b58e2
MD5 3a36a198107c5bdc40dae7d56f8e93e9
SHA1 8ad34f0291934f9c457c41fcaa33ea7335e05b74
SHA512 4ceee65d2bdd06f47ae435d900d754d991c123bda31c3c61fdcbfb32779722e00515835bbdf689ba0a46c2e5b3d60eb38209a6cce7c5c1f63207b4da84c42206
SSDEEP 768:ZYszKt8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMS0LlEe9NsQroURLL:eOKt8Od/hWvFvmXu1jaTS0Lm2Nu8P
TLSH
T17DE21B3B284CCB7E4F840E5CEC66AF9A6DD801C766588D5447FA884C02C77EB521759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e6430c06ab4c103107080cfbe12161f09d9c18edaed3620bb74cc4cf8e60c478
MD5 c067c236e7a0dd4f8ce09899931a2987
SHA1 57e28c1c956f5c97b7f7bb39a28039080c5ff5df
SHA512 bf6bfc834662c87abcaa62a0dba9c67c59dd62ede88dde73cffba2093c6aa57f7c797bb5a6e244319097e98213b69ae8566835e477e916e89853c82357e0f797
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGz:05ppxnY753RNBvRJJdt7p5J9E5NA
TLSH
T1E5B2995A713A0211397E2888B39696364F4235A37058E4BF7FB814A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5d2c548cf4e3d04b1bbde9e11e6ce6bceb6d64c0e139b2198f0e46c9bd9db967
MD5 05a88a06b51ea7a50b979cc008ad03ab
SHA1 a23f5100fd16d5f5409517c32021fac3bf29f3cf
SHA512 54fe69440e77aed3792efa6929e81598dbd8b1fc452efd14e7e4f317f9e50a1971f37695a71e2118b60fa869662da160818eaf2932e8f5fb8a6ff58f59f4d15a
SSDEEP 384:npPiFiZcIv3sND8TUNTUlI4TQckCr1DPWpvBfxGoVY7kLzj9kGjs6HlytEDq1Nt1:paFQv3SwgKkIbIDGoukLzmGjsoy6Dqf
TLSH
T1CAD26A36D8A4CAB7EDFB5B85A64A3A07DEF4411399DC9AE8D9DC5E1C00871ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 742159e5534625f38486eb37e907153e53dcf0d07c41423262be40a9672b07c9
MD5 8899e7d7400b86873f447e91451de982
SHA1 19908a16ec2c93152a8879668c1c768387cdd5dd
SHA512 1fdc611660d009a207b107fdee00a8af3432daf2c5c9ff972c1954cfbbef972f7f2bfa95aa5f76bb8d7d9a0f9601568516a40ac69a3f0a4f55b385c3c791b0d4
SSDEEP 384:nyiFiZcIRN3sND8TUNTUlI4TQckCr1DCWpvBfxGoVY7kLzj9hMGjs6HlytEDq1Nz:5FQv3SwgKkIOIDGoukLzwGjsoy6Dqf
TLSH
T1B3F2E4F598D78977E8AE4787A77D2E029AFCC113B5885A94B7C85D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a018418a03d16ea02618409def38c5c9c3d27fc3dd8b902db87aa25f13a7f922
MD5 9cddce957678594995539833d5b1dcc3
SHA1 0e2fc454e09aef05a272fd680e9e13a410c31530
SHA512 981d26515f4c2e5c5cbd9ae9228742e7ebc27fec8486f92046fdc96c7c1b34f1094d362a5e2931c773e4c65b3ad7f96c4d8e3b3a4da9445d3002609e7aeb23ff
SSDEEP 384:nXiFiZcIv3sND8TUNTUlI4TQckCr1DPWpvBfxGoVY7kLzj9kGjs6HlytEDq1Ntyg:SFQv3SwgKkIbIDGoukLzmGjsoy6Dqf
TLSH
T166D26A36D8A4CAB7EDEB5B85A64A3607DEF4421399DC9AE8D9DC5E1C00871ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 51706864f4d663b42a9f4722b2f17230e46aa125554d7531a8036f780dd68efa
MD5 dabd1531460fba92511cc05e2fe35a5a
SHA1 787dc57e55d28d4a47b97e557c94f9374efbe151
SHA512 f980387d099658039165cc4f0c3b289987ef7e43a50398790d1f241658156200965053522a5a458daf7c2803c2ded812c316cc81142636fadbe089964838b706
SSDEEP 384:npPiF9CcmyWCJ3sND8TUNTUlI4TQckCrUPWpvBfxGoVY7kLzj9aGjsrMFoty/7Ie:paFccpJ3SwgKk7IDGoukLzIGjsrMd
TLSH
T137B22A36DC98CDABECE75B89A75A3607DEE0426785CC5AE4D9DC5E0C019B1ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ae41678a6204b6966f4e66c8821eb9d024f2a4860b88019b2bcce930bc2a7df7
MD5 ab237db26cb0d6967cde647fc6faa406
SHA1 eedec3fbc0d2bba3adf9557eaf07358772f1d006
SHA512 b88a51477407d0616ad7b477db990b241465c98c105e5734096097a524d3c6f20515ec44e99700a386d16722bc1e708d818e376fef797b676843413bc76db678
SSDEEP 384:np3iF9CcmyWCs3sNq8TUNTUlIm2QckCr9ltKpvBfxGoVY7kLzBepme4KV8p03HHl:pyFccps3nwgbkUzkDGoukLzBdI8p0XF
TLSH
T159B24B36EC58CDBBECE74F89B74A6A07DEE0122785D85AE4DAD81E0D109719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e72f3b11-1e92-4c06-984b-8b42153ff283.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e72f3b11-1e92-4c06-984b-8b42153ff283.tmp
Size 25KB
SHA256 bf11ce5eb082d562e759f6917bf25a08b360c044c685a759c0c651c655f0e6e4
MD5 e47a858d0f87bdf9697b0b933e21b57f
SHA1 2e1c5d6b380459a126fb9fb66c721bb53e3e3c2c
SHA512 4a8a257036d9b8273d2d666d3b8533a5826f27d69fac4f02526b05f74e103bd17ac88f5f6c68cd1d746e115ee3aea017009ab4b534ce42fe6fa2adee48b2f636
SSDEEP 768:pIFccps3iwgbkU7ZDGoukLz8GjsI8p0XF:+s3k79ukXYI8p0V
TLSH
T1AEC25C36E858CDABECE74B89A74A3607DEE0522785CC9AE4DADC5E0D10971ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75a66dbe-1db5-403f-9411-f81ac033e7e7.tmp

Path C:\Users\Admin\AppData\Local\Temp\75a66dbe-1db5-403f-9411-f81ac033e7e7.tmp
Size 2.1MB
SHA256 efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07
MD5 4cd67032e35fa92f5182df10df289906
SHA1 9210bfc66bd808ffcd7c6443e160dc8d6754c416
SHA512 f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd
SSDEEP 49152:ykR5Xz/3zNOm3NOHF4+n/UlfmCSJdm8IKXmiQeujzX:DVEkNOHJQOtICGb
TLSH
T166A533BB93AD6C15F3A88C67DCDD498641C2798E6161B7F619837C282ADC07CB47CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec95bb07-486b-4ebb-8764-eb0bce09449e.tmp

Path C:\Users\Admin\AppData\Local\Temp\ec95bb07-486b-4ebb-8764-eb0bce09449e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

973c101d-5c59-417e-a88f-78d7072f50f7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5316_1435915748\973c101d-5c59-417e-a88f-78d7072f50f7.tmp
Size 3.0MB
SHA256 2d69203739eca77886457d27c0df44eca47da02810061a7f5e15288c2e643f23
MD5 06f47f5ad37fb94be87982adc116d012
SHA1 4899ca7b1be75f8607b00b59b8469c8072f514ef
SHA512 b9ccbc3f2c45eaefcc4e157fb19eafd10eb54465f514ad16ada25e81390c3d577fa52aa6fc03461de6726694cdfda15ea96c5420609ac7a426e7b5afa43cab46
SSDEEP 49152:nqSGYpZHVTcorMCTt7OQvYilFbQ0NyNLvTAIPvWcfbcFlTfTGquf:n5pXTcoYCTYQAybMg7cfbcFPc
TLSH
T159E53395F69FF0F4D9A5F3317F8C765F16AAD387A30091D84283204A7BA9E210A5DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5316_774197513\CRX_INSTALL\manifest.json
Size 658B
SHA256 fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430
MD5 2cf796650e5ad5bfb6c4a421d81734be
SHA1 79298d3cdd584b290d825d6fff4b857012e71992
SHA512 1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33
TLSH
T17A01233A268140F238347640087155A4F176620B9100F8053835E36EC460BFDBD79A6D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5316_774197513\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5648-207-0x00000195BCBB0000-0x00000195BDBB0000-memory.dmp

Download