hxxp://yfdnza[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://yfdnza.com
Sample260803-r4e63ascmb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302418879624141"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4268F7C9-DA90-4BA6-AAD5-36F698FD55C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5304	msedge.exe
5304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4608	2204	msedge.exe	84
PID 2204 wrote to memory of 840	2204	msedge.exe	85
PID 2204 wrote to memory of 2568	2204	msedge.exe	86
PID 2204 wrote to memory of 2568	2204	msedge.exe	86
PID 2204 wrote to memory of 2568	2204	msedge.exe	86
PID 2204 wrote to memory of 6088	2204	msedge.exe	88
PID 2204 wrote to memory of 6088	2204	msedge.exe	88
PID 2204 wrote to memory of 5996	2204	msedge.exe	89
PID 2204 wrote to memory of 5996	2204	msedge.exe	89
PID 2204 wrote to memory of 5996	2204	msedge.exe	89
PID 2204 wrote to memory of 4092	2204	msedge.exe	90
PID 2204 wrote to memory of 4092	2204	msedge.exe	90
PID 2204 wrote to memory of 4092	2204	msedge.exe	90
PID 2204 wrote to memory of 3208	2204	msedge.exe	93
PID 2204 wrote to memory of 3208	2204	msedge.exe	93
PID 2204 wrote to memory of 3208	2204	msedge.exe	93
PID 2204 wrote to memory of 2256	2204	msedge.exe	94
PID 2204 wrote to memory of 2256	2204	msedge.exe	94
PID 2204 wrote to memory of 2256	2204	msedge.exe	94
PID 2204 wrote to memory of 6100	2204	msedge.exe	98
PID 2204 wrote to memory of 6100	2204	msedge.exe	98
PID 2204 wrote to memory of 3756	2204	msedge.exe	99
PID 2204 wrote to memory of 3756	2204	msedge.exe	99
PID 2204 wrote to memory of 4796	2204	msedge.exe	101
PID 2204 wrote to memory of 5240	2204	msedge.exe	104
PID 2204 wrote to memory of 5240	2204	msedge.exe	104
PID 2204 wrote to memory of 5240	2204	msedge.exe	104
PID 2204 wrote to memory of 5100	2204	msedge.exe	107
PID 2204 wrote to memory of 5100	2204	msedge.exe	107
PID 2204 wrote to memory of 5100	2204	msedge.exe	107
PID 2204 wrote to memory of 3004	2204	msedge.exe	110
PID 2204 wrote to memory of 5488	2204	msedge.exe	111
PID 2204 wrote to memory of 1732	2204	msedge.exe	112
PID 2204 wrote to memory of 4228	2204	msedge.exe	113
PID 2204 wrote to memory of 4228	2204	msedge.exe	113
PID 2204 wrote to memory of 4228	2204	msedge.exe	113
PID 2204 wrote to memory of 3676	2204	msedge.exe	114
PID 2204 wrote to memory of 3676	2204	msedge.exe	114
PID 2204 wrote to memory of 3676	2204	msedge.exe	114
PID 2204 wrote to memory of 4724	2204	msedge.exe	115
PID 2204 wrote to memory of 4724	2204	msedge.exe	115
PID 2204 wrote to memory of 4724	2204	msedge.exe	115
PID 2204 wrote to memory of 2836	2204	msedge.exe	116
PID 2204 wrote to memory of 2836	2204	msedge.exe	116
PID 2204 wrote to memory of 2836	2204	msedge.exe	116
PID 2204 wrote to memory of 4216	2204	msedge.exe	117
PID 2204 wrote to memory of 4216	2204	msedge.exe	117
PID 2204 wrote to memory of 4216	2204	msedge.exe	117
PID 2204 wrote to memory of 5456	2204	msedge.exe	118
PID 2204 wrote to memory of 5456	2204	msedge.exe	118
PID 2204 wrote to memory of 5456	2204	msedge.exe	118
PID 2204 wrote to memory of 2440	2204	msedge.exe	119
PID 2204 wrote to memory of 2440	2204	msedge.exe	119
PID 2204 wrote to memory of 2440	2204	msedge.exe	119
PID 2204 wrote to memory of 1788	2204	msedge.exe	120
PID 2204 wrote to memory of 1788	2204	msedge.exe	120
PID 2204 wrote to memory of 1788	2204	msedge.exe	120
PID 2204 wrote to memory of 4240	2204	msedge.exe	124
PID 2204 wrote to memory of 4240	2204	msedge.exe	124
PID 2204 wrote to memory of 4240	2204	msedge.exe	124
PID 2204 wrote to memory of 6008	2204	msedge.exe	129
PID 2204 wrote to memory of 6008	2204	msedge.exe	129
PID 2204 wrote to memory of 5304	2204	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://yfdnza.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff85254c188,0x7ff85254c194,0x7ff85254c1a0
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1824,i,4930166260120156,4379601196729587760,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,17693019517705617040,13489114010507948443,262144 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2548,i,17419781092915659970,13411293391310240124,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,10382441233619183445,14825193954779237087,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,15058535103085142672,2674213410359739000,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5068,i,11373932444029432658,17688795007978923309,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5204,i,9539245675922438151,10101419431984222249,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3796,i,578884307982071206,8500622152025945550,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3784,i,7521014286697171781,630053510328598251,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6064,i,2664203351262435700,2189576479251947792,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6064,i,2664203351262435700,2189576479251947792,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5832,i,9631067223993377104,7328310169142506997,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=7008,i,3869434085927299396,18368527702821737421,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6716,i,13187948485951995979,9871910865645931591,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7004,i,17975027195785444242,493381850073602370,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6264,i,6468948197617696223,7830033264802355341,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6608,i,11424255367717137225,17712970044699482305,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6576,i,16972700231835511949,8321151220468839932,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7084,i,14028135170910421737,13549781877412076841,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2160,i,15360193033046411754,12206357080211442818,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7028,i,1185600484294825480,3702667996033139902,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7496,i,7431572009717321661,11358312420279500621,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7448,i,14535440760631490181,944290874499091321,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7028,i,5237322328517743278,9398715692390316683,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7332,i,18372907663008097000,13493944821525058046,2097152 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7252,i,16182345699897773800,7684114501483347621,524288 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5612,i,8253751419467621703,15960346177298374270,262144 --field-trial-handle=2244,i,9033836877563325954,13113882617323628846,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 102KB
SHA256 2f581bcfe7140f763b05a914ff397dcbca0de303aeb6b544a8f3b55c3b37356b
MD5 e48b6139dade00fff72952608730a8e7
SHA1 6253c6ae13bb916043a5ad7e5687cafbd99a4e43
SHA512 d3b1cca1836b76641264f73c45b0df6e9d90272ec53d3e70ac883efa2848e12473b42867fdb293beedb0ee363d1ca36ad3c69b642a49e827773d3ea658bfb131
SSDEEP 3072:Dsrbe0WLMhy/LzMQV5WU25Qvs1Q4qbA+c:D2bsGEPHD25eshSAx
TLSH
T1A8A312CBB1D763A3B49941C467E047568775367F14C47C422FEA0A60FAEC6806F31B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 23KB
SHA256 202b0a7131490c4cd49273a1f838460ebdfb8689c30334f4322135df655bf0bc
MD5 6b478081e42cba74494c264ff7a2163d
SHA1 8263b37043e3d1cb6f334e90c0c6702ad1fc2ca6
SHA512 66f7f2d3e7258437115cfcc285a2a7ae8d7e89703d3ffdd6f301879b096b2637ac9bf44acdba4c5513f1a22441f6093875091344c7e8017c357397937348e505
SSDEEP 384:yy8YVwcd8gSOsmViZsM7xAFfdT6iB8uQ3JaNppapvK5JowCdHZcsFTrQE9ayoCHe:y0d8v5msZsQxoN+uQ5aNbBbUpZcI8CIn
TLSH
T178B2D146F9EA7629D1F348BBDD539E51FFA1480F75309A1B18B3E0860B415C24393A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 44KB
SHA256 ec3433ec2d1b2e85433eae3c17b29089104788ce17243af258b63be7fb72e14f
MD5 b1ab69ce0b3f474d74d62849a600a769
SHA1 5b279a3266facf3bb7b91bb02cb3a89f5b846ec3
SHA512 46986f132ce5e057e49b3599fd0c763772dc947f1fdbcc02274dd15bd9cbe37d74d11b5de63c0ec7e164ba34b8e4289972d365060b91e63fa97c3ae1638a104a
SSDEEP 768:aR1vbcVPOpAlbq1bKBNcsaFv5vUnc7Lnp2XEiWC37tqqr6PZ3K7Z:mNbcM0BfWv5vkcvp2UdywqeP9K7Z
TLSH
T1481302DCF60239715C0A45B62AEDC30807E20616D1174DF9272B467E6EF3BD604AB9C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 65KB
SHA256 5256d55a499ecb71f04dd716cfdf75bf9fe5f863620ec6634e3b43b4e6b11fd8
MD5 c868de85dd715c2cbdb5636546af41df
SHA1 cb10a0cd55f2f6863b2c772a62ed40166c14f773
SHA512 62dc906d3520ab9cf33228795c18477d1feb61556e81006592864f86cfd9e4b5c74d3e05533da387ef41cb0a8f14cb968cbe6e7380a1e2464cea94096615cb08
SSDEEP 1536:9iLlxWp+Zxz8HN2jCuYf24p20cSXgIrMDyblm:9iLlQp+ZxQHYCVf2JIrMDy5m
TLSH
T1AB63027DE15C912ECF4C49D42285C2DD4E0DB1ACCE2250BE976F80693AC62BB9F9583D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 48KB
SHA256 cb05ad5642b867dbfe507000fddd50997f062baa628444a94e689c774b91c2bd
MD5 9ebeac7f17427f7b451c39577f360abf
SHA1 69efae7e5b7dc4b1db05fb3855529b3b0817ddb5
SHA512 7b5ffc73095a318ae7d2799e2ee72cf08228ec58dd8630e7f43aea632990eb69ce8635c87f6fff52a97cbc8f0b93743ab06801cb58fdf48005ed3a62280af019
SSDEEP 1536:q28+p2EBKM/iTVRvjdJwGoE447QOYIjMEM:q2V3MMazjqT47Q+jMJ
TLSH
T1312302B6683D25CFA6D0F53E47696C878161A2907D54129B337E633227FC8045E33A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 102KB
SHA256 39166d1f0270c7709ac44b796ef45595b34ae312d56b04df5d8556814319d3e7
MD5 bf7b0a0f2572dc7cec26d4acbcc78fec
SHA1 f84b03383ec9a84b3b3fe26cd77c81a6a40e7c2a
SHA512 24d990c2dca77bec5a6adcab0f894898952b67c025f5a2adb3239e45eb7257f4e0b736e42fa42ab3e9b76c336634aa69b07b5efe4732fb4d8a2c50aa17edf7ec
SSDEEP 3072:NDerbe0WLMhy/LzMQV5WUFOP/1Q4qbA+c:+bsGEPHDoFhSAx
TLSH
T133A3126D71E75203A98C92C96BE10F42D770337B01C1B9526EAA48A0BE94ED86B31B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 21KB
SHA256 2a0b7c30f0977fb1625451633b6b398f1f2c69d01c655bba3918c961b66a0583
MD5 8a2c36b90c9c621271b5b157ed86e56b
SHA1 f542f96bdc7ea0f2acfd8cd9353ad01d722256a2
SHA512 10ab9e8180698c4f5570b516c20c7282c50755a33c9215c9bb97d58990004f614a95c06fcf5dd2fbb844e24a5d81332ebdffa5c89cd4b22ee46828d5deab1bd4
SSDEEP 384:3YCbDPjmywD3fwAJ2ZmSMqcHbjgog9rfaPkiTOi/dkewSpcE5uW:3sv0YUmSMnHgogxfadFkewc75uW
TLSH
T164A2E17711DD711BF84E9DE82DCE8ED5C8A9A0DE6C618C4047E014A8D0DEA760FFB4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 eebd984eff5d1bd9be4afc0f2799cf94e234ddef8ac8bf91e4cbd1668b598ea9
MD5 9ebcb95a67807902985d65469a7c9f09
SHA1 1efcdebfa4919ef95495aaba9ad53c2b84651327
SHA512 6b34ecb134bd08bdc1fa30feb250548f8680224bb20fb2de6871aea9169b3cecc005e77a9c8ac9ee9d1370032d9b63f0cb9678c67f6df15c9e9b3c1e9e75ceb8
SSDEEP 96:SgwaZAQr6e8PlB73h9n8Je50FCI+6haKDuEpo7:preaR8tBnX50FCiaLEq7
TLSH
T122812B35F689C978EB27037698E03D6879B191C0FBDB0FF2096554343CCAB2847AD294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 cea964d73a18d3145482c93f650a1e0d6fc4bcce4fa7b79cd753a0f96748420e
MD5 9c2f5a7052daee5ae002ca7ff1fc0336
SHA1 fc95f467dca1a4ac1f0746dd96f200a4531f64f1
SHA512 9ab2df08480c810eb2269472f1d26e2a7d3a029395f55e0f49962d1eb3b4c50c324b76f7397ab26a5eca74c2ed9e80df4c283d988b00d71a9a4cfe5b4f92e314
SSDEEP 384:D1YmhxUgnU3XKOsHdHrAFJCJZeUpaaiGg0WWfj0XtGoukwdr7CdFd1xqtjh8nHZ8:OsdoKyIfbh
TLSH
T10A529BF7C3D4866E8C1166F09E14AD2BCE5D0928436C3D66C9E9BF4B93F2471E24264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 adaf245c9626f47a817fc22b9909c8db749d79bbd1d719387b1737bf62e539c3
MD5 70ef7cd2c2d9480af17064264cf76162
SHA1 b1fe6f8b5969ef138394d9b0eb01258374923571
SHA512 fae1292dea441cb3e6b1130d342a174e50b9a88ae376d96d3cfabb38d05de013466a3bfc38a6dbfc0e9fc2a84473c3814e1e848eabe2bb49997d214a9aefe794
SSDEEP 192:sxZtfRzyMqZjK1Ml8UQykn/fJXsEPZdKzodpThqTlHW6+WN/KXAwDoa/Yv9gUcuM:sxZtfoqxn/fZsEPzxSHbsAaj/eI94e
TLSH
T121720916AA74997B8DDBC21AF945BB53D2F90073A1914E44A9FCCE1C00E7BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 40897d1122e8d1fc4884f1c06a0dbb72fa12860ead676f2caf748f2a86079e71
MD5 1058e3fd416d534e9389ab34bf81ae49
SHA1 4d533bcb865b0d7fac833ea83af9b4c9f760552f
SHA512 7c920c381a3cfb0f6d7586a797b2c256d3219274d248fa9193a9f88e564b17b2f1dbaa3db1655883af4ca9fb7ed05c102ddc5e5dbca3ddb674bfc6fd5feb666e
SSDEEP 192:sxZtfRzyMqZjK1Ml8Mkn/fJXsss5aZdVzodpa9HW6+WN/ng/YvvuUguUIgjCJ:sxZtfoMn/fZsss5az+qHbI/j9je
TLSH
T19C62F9166A74997B8DDBD219F645BF53D2F81173A1904E44AAFCCA0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b2fba8589ac8bdbfe5571bf0916ebe89d516daf2c79cda7960aef1d4cf106467
MD5 1e833630ac9f74238905818d4b70d9fd
SHA1 36223301fb6882f289d54efb11690102eb6f547f
SHA512 2b8d8d5750753dde05b550893c16a1e5d81bd1acdd817dbed18bc4bdd6270a22c8070c136bcb535c83aa92b574d8e014ffb86609caf55955ad57e2c84aa5162c
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG7:05ppxnY753RNBvRJJdt7p5J91dXn
TLSH
T1A0B27D5A703E0212397E3988B39696364F4135637058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c06b6f5a-a817-48a7-b812-60176bde727e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c06b6f5a-a817-48a7-b812-60176bde727e.tmp
Size 414B
SHA256 5cf8b796bf0c6ef40b5910ebc5b5a1f726328658e33c18e11d49b2b71dcb7d63
MD5 ee7aca3fe2347033738783f6a1b2d461
SHA1 9fd5ef92af8dd13c837465462554ee3d3b5d4fbe
SHA512 73f9c9ea08b9b0eef426e439fca00921a5c7e537d4028548b791fe513ffa70594667800b2e305c5f62ff0a7d11e15c98d61d59881fd234ed744acbb1cce147f7
TLSH
T1E6E02B75C822EC2719FD4739A0094646E70013272641895F3B3C91088FB462A85C585C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b4a7fa8fb6e45d3412e44ab27b61bc41a54d33600c73f85d04d9f623e66c5447
MD5 4f29942cac0ac6d6d4652a6f2b7d27a0
SHA1 4ee4a4e8f57053d17525d639d7630cf474c85867
SHA512 43c6096e97f225978df1bf1e139954c11ffb186f1897cb764f95e82cc09ffb012c51a4fe8c19952bc86d0ffdca5641c359da6ba7d29567f3abdf75d05edbd7b9
SSDEEP 384:np4iFiZcIQ3sN88TUNTUlI4QQckCrflDsuphiftGWE3jYpbX6HlytEDq1vKD1tyH:pDFQQ3Rwg5kMDLoGWO2bXoy6Dqpz
TLSH
T1D1D26B32D8A4CA7BEDEB8B89B64A3A03EEE041638ADC5AD4D5DD5D5C00D71ED030B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0f07483959d8e67a77db20609106fd0e7032c30b3b97f338df31c744b097fee8
MD5 bb6309360e1e4959b5aba8a7824b9847
SHA1 d3d4c823bf9a58ad089c646916e7bb06ef4d422c
SHA512 1c5444273be3b5dc464771d18d76f4389a91149ea4beafe0dc172d28ea303310551adb2f8bfe3ba445bfbe1302bff21a2fa75c924214e561ccc8ab2268605190
SSDEEP 384:n5iFiZcIQ3sN88TUNTUlI4QQckCrhCDsyphiftGWE3jYpbX6HlytEDq1vKD1ty/v:QFQQ3Rwg5klDHoGWO2bXoy6Dqpz
TLSH
T162D26B32D8A4CA7BEDEB8B89B64A3A03EEE041638ADC5AD4D5DD5D5C00D71ED030B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 88663791a01a1a5f230d7182497cf9c8ce6c4b6f38779ed5c8dc08dc0f921de1
MD5 8e8cd7f9d12400d85db575380d1f1548
SHA1 11124a9bd6f90d6ea119d3a9b5e88869d083cac1
SHA512 78f5c54a12546d9042916e10c010c8c4d6a4e696a8cfc823214ab296e40d6f65422ca7880f52473e52819b716d6fae941fe0c0001c05e5e41a990a67157977d6
SSDEEP 384:nDiFiZcInqK3sN88TUNTUlI4QQckCrh2DsephiftGWE3jYnbX6HlytEDq1vKD1tq:uFQN3Rwg5kfD7oGWO+bXoy6Dqpz
TLSH
T15EF2C2F198E78977E9AE4B87A77D2D0299FCC113B5985A94B7C84D1CCC860BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0aef65572483a3e8f92cb71a438cce142efec274e093291b8b71b61dec29f57d
MD5 14fdc22ea628b158ac1654fab7cc7e76
SHA1 06fd892d9310409b80aaf050c871ee80cab06574
SHA512 65968dda810592e12abd6311bf35efb29f9b279f35de1dd72f9758526341f94498b40dec04a923b5b79a990071688d0ce005bf09602714cb45de105de0d9d248
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9luKphiftGWE3jy2phe4KV8p0xHDty/8:puFccps35wgbkUAkoGWOWyI8p0hvV
TLSH
T1EBB26C36EC68DABBECE74F99B74A7A03DEE0527785D85AD4CAD85D4C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 52de927702c12f05f17b9fa5ab7d4e0cf47cbbadd811bf5cbe895c577cef869a
MD5 b84ba26235aa0dae7b467a32e04d65b9
SHA1 d2f149b7d3de5c6681c32dbd4ac70becaef1fa55
SHA512 92ca322359aae7273101c535ec39ebf9c6c6f3855d60376be56aca65c18c130e1c007a953f0596e25c0b50ae70834685c6a43ad60e8b11b19593b34321a95a1b
SSDEEP 384:npoiF9CcmyWCs3sNI8TUNTUlIm2QckCr9Y/GphiftGWE3jYQbXe4KV8p0xHDty/8:pzFccps3hwgbkUK4oGWOJbXI8p0hvV
TLSH
T198C25C32E858DABBECE74B99B74A3503DDE09263868C5AE4DADC5D5C00D71EC430BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d9fe7eebea9cd683849ff1a4c1bb8583d32e4a8e064b087c17b62fd592d54de
MD5 6a66606b8a125390329fc3e49dd54a30
SHA1 3f441aa6fadc0bce4ddda9c79252f55f908ec365
SHA512 9343dd39ad72051eb868cb1cdbca66f68170207deb8feab5c606db619c77187cc802cb3d358aa89ab3a7b0149e3cd423386063c76cec6788c5390fe96404a8e2
TLSH
T1CDE00200D500152EC0380B3400C32F307AE2801006B34216433005AD3D26B5417149C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8981e1af9cbd6344c8ba34a3cf1b5357144a592c932a33f90572edce3b3ea7d4
MD5 61e11cef804b25a690504e7fb261ad1a
SHA1 678e945c0848dc57ffdbf6e0f2d04899059b2c40
SHA512 7c96d168a7c3d081cfb517496e1f71b2c55b3379654d643bd4267b598440917ceb8ac278a17090d66955adf040e1b4876c759f4fe5028b6ee3dcc7ab861de3be
TLSH
T149E00903D71415FAC03C0B3400C32B306AE3403006F242954E6049A93D2BB982F34EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2a15209a0a745105b7b877a07320693b32d766aa55cdad64eaf9e9ef5358e1b3
MD5 4bbfc6c9f8ee5473482280fc2535836a
SHA1 1ee321a6a55723a3f8ffecf1ffe4bb80b2dfcc0d
SHA512 858948c0ddfe3e31710f1b611328ee65d69f5305c91d84c5a068262d6c6205a1466e7e270b5316171c82dcf6859d481debd8d3ac45addda8f82986ef26eb096a
TLSH
T1B6E00103D71415FAC03C0B3400C32F3069A3803006E241964E3049AD3D26B942F34DC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 babb4c0cb97bb0e0412498df9af54d093b8f180e3e6db004d53b42295db2b880
MD5 7cf36113e8ee11ae8728f2e69cdee9da
SHA1 ccd15d8ffcb60df4a4600503389043ed5058534e
SHA512 c6a3de2fbf98762b9693ead2aef75495a16d242d170cf602f3db5be266973326b8cf288b3554149bc8a63b7cc7f0a797e372a8cc86d4fdb2cad1c1ef739c8ccc
TLSH
T1DEE00102D60015FAC03C0B3400C32F3069A3802006E241964A3049AD2D26B542B34DC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5895a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5895a4.TMP
Size 392B
SHA256 cc07675ce6e3b94ea3e4af326cedc6523414e462a844094456e87183b05b6a49
MD5 a4c6838dbccab8e71692f5fac8da247a
SHA1 38e1f1397f2f133574182d96d52fadbaa80092fa
SHA512 c7349a04f2ac35b8bf1af004aefd645e3a057dd13dce49d4d51418256858036f62f276c89d1bb9964f4d212572e574709b4a451a87b4740010032686fffd1fa6
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3b92be43ac6e0ed7284c44214d5f51544e63afc7c1805750a1ac5f3ab06988f4
MD5 615a77ce463fa4784affd330d3563cf7
SHA1 e3f2bdc3112b0b8539c7956d4443fa6d8b01030c
SHA512 96b173af7f4203d65af67cb3ae7276b5565c215d3ef10b54a23a402b05221cf3b99630b1598d1c4e367f2d473c118abdb993695a6e01935ff69114092b774184
TLSH
T141414A9CB6E91148B3776F56ABF6ACAD487FBC772E07904E10110D4F0A67A00D861737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4796-217-0x000001A31A330000-0x000001A31B330000-memory.dmp

Download