hxxps://shift[.]com/download/

Resubmissions

04/08/2026, 11:48

260804-nyndpsdq3w8

04/08/2026, 11:22

260804-ng2j1adn2t8

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shift.com/download/
Sample260804-ng2j1adn2t

Score

8^/10

discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
162	4484	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0002000000021f4c-405.dat	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303167933135534"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{05AD51A7-3619-441C-B41F-B92106825710}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1720	2508	msedge.exe	86
PID 2508 wrote to memory of 4484	2508	msedge.exe	87
PID 2508 wrote to memory of 2012	2508	msedge.exe	88
PID 2508 wrote to memory of 2224	2508	msedge.exe	89
PID 2508 wrote to memory of 2012	2508	msedge.exe	88
PID 2508 wrote to memory of 2012	2508	msedge.exe	88
PID 2508 wrote to memory of 2224	2508	msedge.exe	89
PID 2508 wrote to memory of 392	2508	msedge.exe	90
PID 2508 wrote to memory of 4476	2508	msedge.exe	91
PID 2508 wrote to memory of 392	2508	msedge.exe	90
PID 2508 wrote to memory of 392	2508	msedge.exe	90
PID 2508 wrote to memory of 4476	2508	msedge.exe	91
PID 2508 wrote to memory of 4476	2508	msedge.exe	91
PID 2508 wrote to memory of 3508	2508	msedge.exe	93
PID 2508 wrote to memory of 3508	2508	msedge.exe	93
PID 2508 wrote to memory of 3508	2508	msedge.exe	93
PID 2508 wrote to memory of 2320	2508	msedge.exe	94
PID 2508 wrote to memory of 2320	2508	msedge.exe	94
PID 2508 wrote to memory of 2320	2508	msedge.exe	94
PID 2508 wrote to memory of 2992	2508	msedge.exe	97
PID 2508 wrote to memory of 1016	2508	msedge.exe	98
PID 2508 wrote to memory of 2992	2508	msedge.exe	97
PID 2508 wrote to memory of 1016	2508	msedge.exe	98
PID 2508 wrote to memory of 1116	2508	msedge.exe	101
PID 2508 wrote to memory of 1164	2508	msedge.exe	109
PID 2508 wrote to memory of 1436	2508	msedge.exe	110
PID 2508 wrote to memory of 1924	2508	msedge.exe	111
PID 2508 wrote to memory of 4140	2508	msedge.exe	116
PID 2508 wrote to memory of 4140	2508	msedge.exe	116
PID 2508 wrote to memory of 1224	2508	msedge.exe	117
PID 2508 wrote to memory of 1224	2508	msedge.exe	117
PID 2508 wrote to memory of 1224	2508	msedge.exe	117
PID 2508 wrote to memory of 1376	2508	msedge.exe	118
PID 2508 wrote to memory of 1376	2508	msedge.exe	118
PID 2508 wrote to memory of 1376	2508	msedge.exe	118
PID 2508 wrote to memory of 2576	2508	msedge.exe	119
PID 2508 wrote to memory of 2576	2508	msedge.exe	119
PID 2508 wrote to memory of 4008	2508	msedge.exe	120
PID 2508 wrote to memory of 4008	2508	msedge.exe	120
PID 2508 wrote to memory of 4008	2508	msedge.exe	120
PID 2508 wrote to memory of 804	2508	msedge.exe	121
PID 2508 wrote to memory of 4264	2508	msedge.exe	122
PID 2508 wrote to memory of 4264	2508	msedge.exe	122
PID 2508 wrote to memory of 712	2508	msedge.exe	123
PID 2508 wrote to memory of 712	2508	msedge.exe	123
PID 2508 wrote to memory of 712	2508	msedge.exe	123
PID 2508 wrote to memory of 420	2508	msedge.exe	124
PID 2508 wrote to memory of 3552	2508	msedge.exe	126
PID 2508 wrote to memory of 3552	2508	msedge.exe	126
PID 2508 wrote to memory of 1688	2508	msedge.exe	127
PID 2508 wrote to memory of 1688	2508	msedge.exe	127
PID 2508 wrote to memory of 1688	2508	msedge.exe	127
PID 2508 wrote to memory of 3252	2508	msedge.exe	128
PID 2508 wrote to memory of 2828	2508	msedge.exe	129
PID 2508 wrote to memory of 2684	2508	msedge.exe	130
PID 2508 wrote to memory of 2684	2508	msedge.exe	130
PID 2508 wrote to memory of 2684	2508	msedge.exe	130
PID 2508 wrote to memory of 3840	2508	msedge.exe	131
PID 2508 wrote to memory of 4348	2508	msedge.exe	132
PID 2508 wrote to memory of 2284	2508	msedge.exe	133
PID 2508 wrote to memory of 4348	2508	msedge.exe	132
PID 2508 wrote to memory of 2284	2508	msedge.exe	133
PID 2508 wrote to memory of 2868	2508	msedge.exe	134
PID 2508 wrote to memory of 2868	2508	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shift.com/download/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,3695072350516155434,6219269040602979871,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5981074094325141069,11511792825242983973,262144 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,654431733996685781,18158907464102004090,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7476215802598424381,7035645078215982712,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,4398473596011439921,11234218720599220702,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,4392383041953006756,13823124718890735265,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,5266914203836157431,13345720478352945787,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8828425912946809429,5643814287053993925,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16159586036388723369,9921987577475507026,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1952480985972666562,16382865959535319344,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1952480985972666562,16382865959535319344,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=140,i,5154636936465273193,6055757574061777115,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1201584754611170932,18051219617617727810,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,17565206314521667916,7985401046416471103,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,7521133725118883628,1142912726464288769,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5420,i,1145412143615491687,7990807139773894254,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5872,i,10757278246356118805,4058847802875139621,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,15052896195221145817,2448664357268306775,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5176,i,7122628362247238890,13067449620978034942,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,16862179429325633905,12802537975588538255,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,16869063195355585314,7343576028442103993,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2180,i,687787972718068792,1658668151041581319,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,5440147985380478354,11559101795039626665,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3008,i,8950553374146438346,17064656457885891757,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6308,i,4139439311166900839,561349576584946194,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1659337825608763409,1308711463214967499,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5236,i,393223997290206245,13682856139228684968,262144 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6176,i,16367249696396321295,14552242919946313323,2097152 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,2247953205902453967,17685235674838617091,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,6307040255697123233,1207672531782089302,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,3696308016678952486,6821878862952080134,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,96753458886341025,16183243728399857287,524288 --field-trial-handle=2340,i,5164384448623459333,15900958542822426878,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 537B
SHA256 7a6e480721c7cdc218ae5cfe70575990ff637ada140de7b2392ba20e82adfbc8
MD5 5e663070696e64312bb39f507e01928b
SHA1 d8457b01296d4b8dd72e463b780b9f8669b3b5a1
SHA512 87045e842e888a8e2e2504fb100011b2b323b24e52bdb3a4ed53d0b0be1f9b04d0a4075348b6f6ea243a21bf47447f50212c0864f37baabacf4646955a88d1bf
TLSH
T10DF0504D95D4C77EA630A68FA2B4631C41E03B4FDFD8E94D27044D867505940B7D36E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 537B
SHA256 4592cf988378323ed1752d373d13c5facaaf7efeec43543fe5793f85c85c8312
MD5 84ad71e15a01447f84f11bd8745a91a6
SHA1 0f0e858adc09b2a69c636d094820d50f8750a652
SHA512 3ae3d22c18f7830fad0eebf8dd4c87d51a947c29197c3e9f5390a721ea6dc4255371fe4cdcdd80434487bf3a4a36221c572a69640f272ec47a37cda88ee35085
TLSH
T108F05044C6C4C7FE9B05629BD694738DC1D0770FDFE8E94F2708598674021C4B1D5AEA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4dd766dbd834333b24504772f12bfbd4a1381ace57cb84acc6b832c62acd541a
MD5 3537dd3d67c40f3775979cd9d2dbfb68
SHA1 40456a9be80e09c4114398b90c3eb2d74655769d
SHA512 6243b38462c5e77b5ea31bc33542873a9c5195730cdbf03f95754295241bc701539904ac99ce23816cec45f236f51544f29126062fc8e6bd8404886831aef812
SSDEEP 96:YI5um1W1wMgpnws/lXCxniNeA0YBQelcnydx0:YI5um1WaMgVws/1CxniNdLBblcnydy
TLSH
T1EA81E9BD0296EDF6FBD3393044D03A8738F140EAF913BE8E059345B1609AB914A299CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b0ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b0ec.TMP
Size 3KB
SHA256 9350a2c62e5192099feb642367ff46127c05e169c524c05e260420bc798ec122
MD5 40552a65b4d9b3736a4eae6c73fba35c
SHA1 4cbb2d1bbb2eb91ebce0a349bade13a9406895e9
SHA512 3cd169cdf68da955c6d066a87194f6c6259f667866debe59f1db8a4f65d5148eafbb4fb09f07cab0a1a7a4838ad816036b327f41f7dc2771cb206a209daaa7e4
TLSH
T1E061C3BE0582EEF6E3D13A3190C03A8738F190E8F823BD5D01E748B5640AB504A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1219697babbf56480ba77ca11a51aa3d9f852ac398750390605b58bf0f3b9a72
MD5 a5a5afabdb283d35295cf6010c74a02d
SHA1 f776522e730d0e3f142ddc7bdf888bdc6ed5c621
SHA512 2ce06d684fe3565865198cede4e9ca85ed855bc284381ecbebc9b95af282b15c8daa98cf5cc2ba5ed660101de628c9e87af908a913127ad81ded6e0d5b695bd6
SSDEEP 96:DrNOEAdJ0t6J+PzaGNCXAfAj+bVVGbI8WtmlCwB1:D8EAdJ0t6IPWGNMAfAjyVVGbI8UmlCk1
TLSH
T142A1ADB3C7E9851DD91656F0AB14AD2BCE6E0914832C3D7E88D5EF0B73D2472E200A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 68fc6fc64850e9281a3ae24a767bb714b67fa7df5aacc7c251367955e01ce393
MD5 8efe6247333be001e46a0dfe5346cfba
SHA1 34007b53835681b0d103f0df692c1313fbc94de6
SHA512 e4b39bf622067f18054cf688f3a10a65f5351c597306afdb045650d4ab562a5328254926f546679c0b4d80227131054a55ba7573802de5df4330916e22bc35b0
SSDEEP 96:DrNOEAdJ0t/zaGNCXAfAj+bVVGbcW0mVGywQ:D8EAdJ0t/WGNMAfAjyVVGbcpmVGyT
TLSH
T1E1917EB3C7E9552DD91656F0AB14AD2BCD6E0915832C3D7E84D4EF0B73E2472E200A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 052dbf797615df1e7ba959021b572e9beb0f0d8211877d2d8f296d2206780d83
MD5 cd13e36faa224b60ee476b4d9509fb80
SHA1 c9c3b53709dd2a74ac69fd239f2e671c6af1508a
SHA512 0ea90e12dd80ce1fe6fe98a561e67755fa0e4840fd6e114b61a72ad59a4f9c780bd0e7d0deb20cc4b11d6e3b05379af09c19334d883398554ec10d49bad59a70
SSDEEP 192:sxZ3bRdyM/jK1Ml8Mk7/frsUH7zhIdpwYHW6+WNvwg/Y9Ig5Na6LIgrJ:sxZrNM7/frsUH7G1Hbj/29
TLSH
T1FB42F9116A346977CCDFD209FA45BB53D6F91472A2900E54AAFCDA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 03c06395e434f1d9066d792940f04ece6049d1646c4099dce95f09e1e4f51175
MD5 7e2e4b5f628d18d97d94cb7f914f01a8
SHA1 0aa4493a9d2ba033b910d4db84e5a1bc07db968f
SHA512 cf16bb0b707118fa6f249dad43f9616b72fcaa34ee36706b8801cd0f28e623d6f9f863f6e31cff40bcef87fd648761b5e087a9782f616d4d18e0dde204847fa8
SSDEEP 192:sxZ3bRdyM/jK1Ml8UQ697/frsEq7zhIdpilHW6+WNvwg/Y9IZUNa6LIg52J:sxZrNqM7/frsEq7G6Hbj/8w
TLSH
T1F152E7126A346977CCDBE209FA45BF53E6F5147292900E54AAFCDA1C00F6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e0be2c8bdefe2d36975c4249b5020851c3ba99c6f7b2a0296bfdfd79bbcbda0
MD5 0be9e5bc5150f1d56f60d3700cc2202e
SHA1 ebe43a92174f55fdad3f021f76a267ccd7a3bf58
SHA512 4d69783e2ad3cf6aabf0a7c74b408306ffffd006f06f259d1215f4bb318658dc5337e369e63ab0a48a313294783bf82a3195b2d8318561b571d6a97456d28efd
SSDEEP 192:sxZ3bRdyM/jK1Ml8M97/frsEq7zhIdpilHW6+WNvwg/Y9IZUNa6LIg52J:sxZrN17/frsEq7G6Hbj/8w
TLSH
T1DC52E7126A346977CCDFE209FA45BF53D6F5147292900E54AAFCDA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1977e8d847836be037843661ffdb90fbba379512db273bb30922876dc0cb0eb7
MD5 f2207c7305c214314259501bac68006e
SHA1 5035e960ad623f4b5dfc267285a13372e7b8efe3
SHA512 9e7cea073d6dee4c9c87cbd464c8d0dcb115889b9a92f90700e7152bd82ff1a1b2c5f4e1cef9cc4d27134c0ba1a1de0708274a72a4539b9c744c2eed2cca6649
SSDEEP 768:yncv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNZroVg6BoV:yncv21wWvu+Z+u1jaeFLeRNSVC
TLSH
T18ED20B2B280CCB7E4F841E9CED2A6F866ED801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eae741efd7e0030c15dbb5465aa82370277fee83f7d7d830b92bf697bf6e383e
MD5 3cb76fcec239714db95422294c785ff2
SHA1 1f5513aa5432d62d1b90c6ba5519be82b8ce756d
SHA512 545f34bfb4c6e5ed6ece8755f4315d339013e1c9b7edb841c9bff63bb21dabcb24bdff5b258e639af34368be253c757e6052100466be719a20eb70d5dc9187df
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyay4wKVKiR:mTfHXXR
TLSH
T19291B80131BE02A63D7E284CA3A696364E4374A37904E57F7FB840A25E67E165CFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5926d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5926d7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b04ae5c0efc486faa08df5be1c3927518916e20fe5bfe2bbda1d7ac331685ae5
MD5 2493517f5d81a84536cc9a82368fd62d
SHA1 51c4b97911aa4720a1e1b5359c5070e016af2517
SHA512 2b45a48cbec46ab522ab0f8899e16838ddd172bfa9dd6038ed5e18897e225dd7ce8119512c194b0a7d850765cbd8c0995abb114d0f8193f2b83cbfa1b58c7d43
SSDEEP 192:JONO6v+YLNQmiUyibZh+CG6Om9oEusuKlU6:JONO6vz//Zh+CXOme6hU6
TLSH
T18E02D935BD281C7B9FB26E45F58737275FA8217BE9952F80D9E42F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7ccbd76d3739a9c816e75959b645b10b921c2876dbbe07b5d9f5eeb5dbff7ec9
MD5 f2359ddedf607bf18aea79dd0c03341e
SHA1 caf6d39c3c11882744b6adab4f40aa152f5b324f
SHA512 6a7ab991bb5e7a720fcca2c6039c96f0fda5d5f3006fb56b1a89a1d47e3820c8c81e7c5810027dd969bd232228837832cbc0975460a3d403ee2cb0098e663e96
SSDEEP 384:+ZcIhsNdDDziok+e+CXOmep3Jr4qxBeRs9JKgqijUJw:8hwW5vO9p3h4qxTjKgqmUJw
TLSH
T15A928D31AC341D769AEAB5C1F84736579FF89067E6C52F90D1EC7F0C019B59C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 76ce2b404c714bf2985764d3265c1471f2708e73d5c67a41576c3f22a243f721
MD5 8994e38de6e8dffc492f4ed3ec7cd1b7
SHA1 afcc4b253aac015397a9a60df63d5d442a022db0
SHA512 3b58f7f57e65d93129421c4b720b5eb179670969b39595ac208a77d3541ab1b4db5bd070100159484188e6809ad8be0c92a12f1453a99725b9a6ad4ac705d1c8
SSDEEP 384:uiFiZcIfzsNn8TUNTUlIlDDzioR+e+CXOmep3JrzqxBeRs9JKgqijUJw:FFQbGwgpP5vO9p3hzqxTjKgqmUJw
TLSH
T1E7D23AF148D7497AD9AE6B83A77E2E138EBCD053F5806A90B3D8690CCD561BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d456b836f913b546b71c7acc22ea437a6aca69857660211dd7e6aad91392d01
MD5 490b5b2168b52917856421b7ab8c651f
SHA1 630e3fe0ae08878a0e8f764b4e6ae0585e4d035b
SHA512 6db54ff81eb8d5423f3b830ad5424d41b5428df0560e1c36245e98258d0e4e7d086bb849d7c79488e4f6dd0c1754e76168bf96e43ab982181ee811858a1024b7
SSDEEP 384:tZcIhsNdADziok+e+CXOmep3Jr4qxBeRs9JKgqijUJw:1hvW5vO9p3h4qxTjKgqmUJw
TLSH
T1FC927D31AC341D769AEAB5C1F88736579FF89067EAC52F90D1EC7F0C019B59C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 58fd29a3f03889ce36e94fcc4f3f2574b4321c7c7391ec3a77b75880d27c8a49
MD5 c62f38778244af28262cbf58e1b22e1b
SHA1 f2c345ab042707ec669ae74ab84e0e483237e526
SHA512 43cb02b58ebd50ca002fd16f0e6810f367d37b84beeea7b5e440024a0807e65f1328d6f1f05fff244031f91d84c1f0c36b8830628af8c0617c915e833d2234a4
SSDEEP 192:WONw6v+YLDQmiUywb6h+CG6Om9opwSJrHrCHuBbquU6:WONw6vzJP6h+CXOmep3JrYqxU6
TLSH
T1A2122B35BD385C7B5EE2A595F48736139EA85167EA4A3F80D5DC3E0C02EF69C230A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4deb8c82-b402-48e0-b3b4-761a5f62f500.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4deb8c82-b402-48e0-b3b4-761a5f62f500.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 766246268dd24405bdbf8483cac3cbbf2d4414045c8c707a9b666c6f7e57b60f
MD5 e015b49a96d8e0d838510b30683b3d04
SHA1 2f8ebba36e542c9bdb8ebb288084c17335e761ed
SHA512 7d299467d5a0d8ff2e7ba5ca00073bc429d74f362d14ef5fa0ac03de51302d3aa9efe6b35f281303cde0be92f233ea862449cbf905a7b6e590104160d53f0b53
TLSH
T19A412658A2E91148B3B37E5A5BF6B86E887FB9372E0BD49D10110E4E0A22F04CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

Shift_3w7w1b.exe.crdownload

Path C:\Users\Admin\Downloads\Shift_3w7w1b.exe.crdownload
Size 8.6MB
SHA256 4273ce715da82ea41975a1b73cdfd94911717a5f024cb28c3e0a92d4b6e61877
MD5 6ca5774bd1094153d78af6443a90781f
SHA1 f316c0fa1c7c75511b9c70985da38df90baf0691
SHA512 b7d326cdb7670e7f04add0bfa6022e41b8d4df0a86f1a8a0f5ec7dc684213fcdfe67e537ab5d34e015ad9be449dfbb7cf01830f915ff6e2e1ecd988c74db832d
SSDEEP 196608:0DbBa7USdZPWJcLHFzeQQ9/Rg8fvDtuCl8K:0Dta4SdZPEcLHF1QvgG
TLSH
T1C0962317B64E673EE47A46364972A950543FAB60651E8CB3DAF40E0CCE2D4A41E2FF43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download