hxxps://www[.]mediafire[.]com/folder/cypyvtxsqqefx/Mawfi+Tutorials

Analysis

user interaction
yes
max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/cypyvtxsqqefx/Mawfi+Tutorials
Sample260805-dfmdksak2x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303722400296658"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1ECD7B52-B315-40EA-9E14-B3504810A93E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 5100	2732	msedge.exe	87
PID 2732 wrote to memory of 4444	2732	msedge.exe	88
PID 2732 wrote to memory of 3740	2732	msedge.exe	89
PID 2732 wrote to memory of 3740	2732	msedge.exe	89
PID 2732 wrote to memory of 3740	2732	msedge.exe	89
PID 2732 wrote to memory of 1368	2732	msedge.exe	90
PID 2732 wrote to memory of 1368	2732	msedge.exe	90
PID 2732 wrote to memory of 4720	2732	msedge.exe	91
PID 2732 wrote to memory of 3840	2732	msedge.exe	92
PID 2732 wrote to memory of 4720	2732	msedge.exe	91
PID 2732 wrote to memory of 4720	2732	msedge.exe	91
PID 2732 wrote to memory of 3840	2732	msedge.exe	92
PID 2732 wrote to memory of 3840	2732	msedge.exe	92
PID 2732 wrote to memory of 3808	2732	msedge.exe	94
PID 2732 wrote to memory of 3808	2732	msedge.exe	94
PID 2732 wrote to memory of 3808	2732	msedge.exe	94
PID 2732 wrote to memory of 1192	2732	msedge.exe	95
PID 2732 wrote to memory of 1192	2732	msedge.exe	95
PID 2732 wrote to memory of 1192	2732	msedge.exe	95
PID 2732 wrote to memory of 4516	2732	msedge.exe	98
PID 2732 wrote to memory of 4792	2732	msedge.exe	99
PID 2732 wrote to memory of 4516	2732	msedge.exe	98
PID 2732 wrote to memory of 4792	2732	msedge.exe	99
PID 2732 wrote to memory of 4776	2732	msedge.exe	100
PID 2732 wrote to memory of 4776	2732	msedge.exe	100
PID 2732 wrote to memory of 4776	2732	msedge.exe	100
PID 2732 wrote to memory of 1068	2732	msedge.exe	102
PID 2732 wrote to memory of 956	2732	msedge.exe	106
PID 2732 wrote to memory of 3784	2732	msedge.exe	107
PID 2732 wrote to memory of 4780	2732	msedge.exe	108
PID 2732 wrote to memory of 2236	2732	msedge.exe	109
PID 2732 wrote to memory of 2236	2732	msedge.exe	109
PID 2732 wrote to memory of 2236	2732	msedge.exe	109
PID 2732 wrote to memory of 3808	2732	msedge.exe	110
PID 2732 wrote to memory of 3808	2732	msedge.exe	110
PID 2732 wrote to memory of 3808	2732	msedge.exe	110
PID 2732 wrote to memory of 4920	2732	msedge.exe	111
PID 2732 wrote to memory of 4920	2732	msedge.exe	111
PID 2732 wrote to memory of 4920	2732	msedge.exe	111
PID 2732 wrote to memory of 3100	2732	msedge.exe	112
PID 2732 wrote to memory of 3100	2732	msedge.exe	112
PID 2732 wrote to memory of 3100	2732	msedge.exe	112
PID 2732 wrote to memory of 3008	2732	msedge.exe	113
PID 2732 wrote to memory of 3008	2732	msedge.exe	113
PID 2732 wrote to memory of 3008	2732	msedge.exe	113
PID 2732 wrote to memory of 4324	2732	msedge.exe	114
PID 2732 wrote to memory of 4324	2732	msedge.exe	114
PID 2732 wrote to memory of 4660	2732	msedge.exe	115
PID 2732 wrote to memory of 4660	2732	msedge.exe	115
PID 2732 wrote to memory of 4660	2732	msedge.exe	115
PID 2732 wrote to memory of 3316	2732	msedge.exe	119
PID 2732 wrote to memory of 3316	2732	msedge.exe	119
PID 2732 wrote to memory of 2292	2732	msedge.exe	124
PID 2732 wrote to memory of 2292	2732	msedge.exe	124
PID 2732 wrote to memory of 2292	2732	msedge.exe	124
PID 2732 wrote to memory of 2960	2732	msedge.exe	125
PID 2732 wrote to memory of 2960	2732	msedge.exe	125
PID 2732 wrote to memory of 60	2732	msedge.exe	126
PID 2732 wrote to memory of 60	2732	msedge.exe	126
PID 2732 wrote to memory of 60	2732	msedge.exe	126
PID 2732 wrote to memory of 2636	2732	msedge.exe	127
PID 2732 wrote to memory of 396	2732	msedge.exe	128
PID 2732 wrote to memory of 396	2732	msedge.exe	128
PID 2732 wrote to memory of 396	2732	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/cypyvtxsqqefx/Mawfi+Tutorials
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,1478843523879378654,6598296178369713852,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16799146252079091320,16152348012219677022,262144 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,16559320609557030232,446984874293381100,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,12347513298299961316,1132924156395603072,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17452176518582710844,4851051467864621947,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,180269995240967091,10495074419671671397,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4412223354579538338,5470732718707752017,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,12128285187666992345,3352053853249134781,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,6108993931889557597,11374503380906849934,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5600,i,10152901549893993107,10521667058505381016,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13918835583931021925,13488007421429671750,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13918835583931021925,13488007421429671750,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,16297265033087943585,12978345963111236649,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,5445409009655653838,16837817259706320574,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,15253585487988376807,2361294398960541306,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4500,i,416811939489213030,6131267747516881287,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6588,i,17960857479926352406,1960812132274639086,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6120,i,13950262828030583301,4633635801749064075,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6520,i,7370527189640016324,14304811991608424324,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5196,i,9122253402566481250,16259972604298562036,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,15144863556663011855,12565455127255626669,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6992,i,16187655669960829211,11876574554698833468,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,16959188810961987676,3056996086190270735,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6092,i,15093882221382066500,4344343391562293107,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=764,i,10876576494671815363,11478462916225373935,524288 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5356,i,17129226260095872315,16298468391449315920,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7112,i,11905681546172122069,1528293058842791233,262144 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3348,i,11004155463336368834,3472926611989380098,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=1312,i,4407620923968923717,11208311937466309734,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5676,i,16427573093362943150,7809112704889178167,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5784,i,649090806746108159,4548021208151111566,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5068,i,11741677193876500834,8407358872146213330,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6924,i,3966241263974351235,333712978416858828,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7236,i,16691806199980835605,3833646031238907298,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7412,i,8898499536587479505,15694541180977075485,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6736,i,13365141826391028184,14589601870343131477,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7004,i,13373484604196855555,11368662449960380041,2097152 --field-trial-handle=2324,i,18302914948085727043,7725598278330298710,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c6f6dbfac4af94c94c915841ab3b25c901e88a7b1b28cd8491522ed4b7d67c64
MD5 3b90cf452e69f70433d34335f71641cc
SHA1 632107012ae0624b2d681f90570566b98c551a00
SHA512 d8bb5729680591ad3193116589be611283f7862bda4a1fa0f4cbaa7a9b0fe559859dc7ebbc67cab4fd46913ec91701a7a37ec27648437ab02a27ec6fbca89036
TLSH
T1B0D02370B5A9ADA0C82C0030803002016E66867530DB9B032045880D98B02C0F2DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a5ae04b41ecb5049023bc35a530b81f32c859318dc8f92e0de0879ae2169d0a
MD5 6b0bed924465aa3a519fe7dfe0efa084
SHA1 a2f2db88ccd0e13168134807472685f8b8ac2608
SHA512 31671a78c9e3227e038757bcdc20862030afff1807834bff175e38385b4d7408ebc13315899c0ee9031fe940744fe305e45b34ee4615c5d3adcf8bc93c34a6d6
TLSH
T1FE816E0D45D20482E7E52F30F4D23AD3743284B90A479EBA02A0ABBDEE06F2D0D701F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1e08d6c953bcbb12fc054212eccd76a5f343e36f4076dcea3f6ae7aeb5662820
MD5 072ca0ff13c1ce743b2d398152a8ed53
SHA1 47eb203bed76ab1566ff2cee88d8221dcf61140a
SHA512 b67ab95083728111106dc34fbff725a3873f433b650facccc57125ce7eb75706f6c64c461d365615f8286f7bd86c4d5a932516cd5550e88f01e1900183b1c3e5
SSDEEP 48:sGhmoXwWs7blho1CyzSrcERQMTPk3iCFE8eoW52ryNl2ech/gA72Vfajvn:/h7XE75yCfcTMTc3LFEv2BhkVon
TLSH
T1D2914D4D44D15082E7E50E32F4C23AC37532C47849076EBA02F0A6BCAE06F6E0D746F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58944c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58944c.TMP
Size 3KB
SHA256 92b14c4f1b1f45c0f23ec117ef0be337aff85180864da489effbff5aea74c3bd
MD5 0511c86b284a3d970acaa4f5f9b4add9
SHA1 c87eb0eaa4580f8b47ce159b302c93cdd59cb968
SHA512 d3113a1b34ad40cf1d282002d30be3b55823cdf1fb39c4045a4e8c0012bfe079b364dfc31b1b81b17c2390d9852418257ed65c166375267d7564db4d9ce425c0
TLSH
T10671800D09D20492F3E51E31F8D236D7753280BD4A470E7206809BBDAE16F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 57fc61182c4e93309574b324d4c7ad3ac638f318aa61a383af684bb7b014c61e
MD5 b8b4f69761f1e45a21fda7689183a3af
SHA1 3376d2a217ae256b700f6b4daf6da9ddbab81ff3
SHA512 3bcf3a4e6e3839db50ad11023045e6f6a9d57bedb078f9af32484fbf434ba508621385b9da50db55b498f15ef9f18ede8c353eb8247319f7ea243cf50b209b57
SSDEEP 384:DVv0ZwmVmCUZFujTomODe8GaC1tnRpUdpaVYSsw2GumvG4OylkhY42Ym4erdWwfl:xiP4xsYWsM
TLSH
T129628CF393D5D61EC81117F49614AE1BCF1D0B1583283D2688D5EE8BE3E2432E16AA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a0f6a95b761574c44361b9615df7cfe3e367c0a4bc50ab27a95ac79df428c5e6
MD5 583339683e7fd130fa275351ca8d0d7d
SHA1 d375bf1219e9263356f71cd8e4c93be2cdf5fcd7
SHA512 fa3a6ca25c983351edd5e4da045b93bbc02caad1824ff2ad4a005dace70b42f05fa25720c447f72cd67b4ae982c284c469f40bf5e09ea3c0b6b3a35c2345b539
SSDEEP 192:sxZWROyM/jK1Ml8MkF/fUsBm3SIdp8lHW6+WNmyR/YwaV+nIgrJ:sxZW8MF/fUsA3bEHb5/J9
TLSH
T1B242F811AB34997BCCCBD209FA51BF53D6F5147292940E84AAFCDA1C01E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a22e46ca4c177018fc5d43461c1d06c841cd1bcafabbed375edc9b5a623bcc06
MD5 889a5b47677b26d5e72959c173f0838e
SHA1 b6134b08514ca6824082956c99b9f2d54410a6af
SHA512 e0a791f14dcb4b1e8d4a1e9fa85391e8d2b3c80f8624378b2d9fee25139983a7a85813ae494f54c518bea98aa7f4dec991d1306efa8996d390291bb93acf9d6a
SSDEEP 192:sxZWROyM/jK1Ml8MdF/fUsqmbhIdpSOXnWyiHW6+WN+I1mCGKZYw29+nIg5UJ:sxZW81F/fUsnbKKHbcKZT6
TLSH
T18D62F702A674597BCCDBD209F951BB53D6F5607292A00E94AEFCDA1C05E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6fc3a5ba7542f0197514efa5aabd8117814bf2c56b7a4f1d0ca37991b6cb6397
MD5 a2e96c37af0fdfa24483a93e0aab385c
SHA1 7637a92337c0d2d01a067761c5133c1558973d2b
SHA512 ef69b031489241d52fd3936a4f3cd32570b19d7ec6b3ff9f5748cc1e543b386f847fb45f7f4822247b7105bc491592d8cfd73ba535fa06e9fde641be5100c647
SSDEEP 192:sxZWROyM/jK1Ml8UQzdF/fUsqmbhIdpSOXnWyiHW6+WN+I1mCVCdYwM89+nIg5UJ:sxZW8qJF/fUsnbKKHbcXdqT6
TLSH
T1BC62F802A6745977CCDBD209F951BB53E6F5647292A00E94AEFCDA1C01E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51e06d103a8a0efbe8a323897c56ddc7beb8113077ef6fa5a547ef20f1730827
MD5 df7f46dd8a8677437bc9e61ff1f53a16
SHA1 bc3402ba973ce921759c7bec2e534efb81e8fa5b
SHA512 1a6659ddfae6df08ab12e72d34c9714dc7bc60757874a8c1f8ca9b7ecd8da6060d2e361434690beeb6e11201fbf7b6ab33a4bf7775169c569958d51f74d667fc
SSDEEP 192:sxZWROyM/jK1Ml8Mf6F/fUsqmbhIdpcOXnWyiHW6+WN+I1mC3UXYwSO+nIg5UJ:sxZW836F/fUsnbKsHbc1Xc6
TLSH
T1BB62E702A6745977CCDBD209F951BB53E6F5607292900E94AEFCDA1C05E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5104fcf758baaac7b6556e366532a1f7aa60a38b105a6b27c800f7457e74c59f
MD5 89df7f64b34fc15f09cd7871147a1a6a
SHA1 b5c070c2f4c98aae0842e398bc06a431a271227c
SHA512 b186c6e66fe85cb1d42b267d1dbf38514d2847ccafb11f17f84609d96b93a3756fb92b1b637ddfca49ffdc321b37ef9657c225f5727f0354a06c0a6d4875204d
SSDEEP 768:Hc4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d8rohSnaK:Hc4jeXmWvmKxEu1jacPLZQdnE
TLSH
T1A0E20A3B240CCF7E4F844E5DEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f38dbd67d83cd7c2f2622242cf943f1530f269c6ddde7f29b33440cb55023d01
MD5 feed3528b9e55e1f10955aed368f688b
SHA1 7b40dda15810588480dddc4aa9a0ff6b3ca90a22
SHA512 1a945fecccd36a814318afff18d1121bf46126b4ecaf3ee0cf7e6a8d5b23741584b30fe5c36f73f12dc3a96960a38d0501921948c8deaa9b464b49783ea71821
SSDEEP 24:Kd9f4LiandPrD4bf+yIj3DKiMhaZD1ElTSmtMI8LAyXY0fbwRaudmWy4uK+BIjcE:KsiIfKnKQDyN1IRK+0MGYI/KFucLyW
TLSH
T1BC91B49A70BF1A023D7E2F0C9158961A5B41B163305DA62B77EC45A14FAAF261CFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592272.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592272.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 94a573ec477a203a41b7266a0ae20ddddc8fbcc235ceef53d0dba026a9f86f13
MD5 1eb359dac968687dc0b5c5da59abcc23
SHA1 7bcd6de9c66657229d70a33cf0d8ac21bc458cd0
SHA512 336623f58f8e99925f34f883821a2e1cb7e5656d3cb36c03031b9025d56f7c4ca3da70a348f126a1f32df60af546990354c2836c4d2f97637b8a9b7e4d35e7f5
SSDEEP 384:bZcIhsNyq7RrWAdP2f+xOE1hpxJrOFaBeRs9JKgqijU3hOGF:DhwWAJmYOshLhAaTjKgqmU3hOGF
TLSH
T101928D3068689C3799E7B681F48636134FF85067EAD47FD4A1ECBF1D029699C131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cfa16b13c04a2fd071b9cdab216dded46eead79a82c97d481f33b2da625db34b
MD5 c27b6e244c0f705e50a52b6b5c984ad0
SHA1 2ea47995bac66ceed90632312fab335fd2241142
SHA512 7ce1447b8fe8c9bdc85b341adf45f046cb88040837e4bc2f29541235eca089f7576d0fdf559ad3125cd4b4556ab6b48a5f8af73935b2027dd30a8529181aa2bd
SSDEEP 384:QiFiZcI3rsNK8TUNTUlIls7dteAdP+f+xOE1hpxJrhFaBeRs9JKgqijU3hOGF:rFQ7fwgqeAJOYOshLh7aTjKgqmU3hOGF
TLSH
T147D218F144DB8836D9EE5B43E77D2E034EBCC067B590AA94B3986A0CCD465BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba3ff44e60fc77282207407c33be2759fcb060217c59108b8bf6f4a15e44fefd
MD5 ea99fd9b24b19f16663f00bfb0a28fab
SHA1 155ed08bf6af5967ea8b7660a6858f3353e34765
SHA512 f4019712a0453e4f96c3435019f4f5333528dad420c9a458e5c75936c10e7320b7d3b5fbffb43e16dd1f1c2291f909ba25250405a5f03cc385feef6f02ebee2a
SSDEEP 192:EONa6hZ0QmiUyftXpc/+jVnO1u1m5wOZJ5fvU6:EONa6oCXpu+xOE1F2rfvU6
TLSH
T17902E93568686C778EE2AE45F48767135FE5217BEA916F84D5E82B1C00C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77cc337a24fbbf51998936e00fe26e82fb39183ae247cd1787c95c9774dc97a5
MD5 29fb3373c75ad239c3a01a72c3971ee9
SHA1 fbb80af956ea411a3e7bd35583eaeeeadd1a194c
SHA512 1001389c801914ca5040ab20ccf1ed5b41f168cf7433cc1f60727cf39af5adaef25df68c7707660a4e7cce1a84b822d81f35113cfb1804241d5f8a803241594b
SSDEEP 192:wONb6hZ2QmiUyetXTc/+jVnO1u1hjFuSJre5cOq1qTU6:wONb6OFXTu+xOE1hpxJrR9aU6
TLSH
T1CD120B3169A8AC374DD2A680F48732139FE5126BEE957FD4D5DC3B1C01DBA6C230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c2973404b97b0520ff3d408e0d928be94dd9891eb1280ede2a4794a4ca8d2fad
MD5 0e15f7af6cd45cb7e8c0dd29d4539014
SHA1 64443982d9234fc4f9a80ff3f46bafe751e08d81
SHA512 312330a0f7f936373bb54e89a1507046c187e3b43930eb2ae4b187664edb4fdda4164ca11bdf55485dc613087ed5aaf45f2cc17d88633b8c72b8b1de4c290914
SSDEEP 384:ZZcItsNys7d1eAdP+f+xOE1hpxJrFFaBeRs9JKgqijU3hOGF:xtIeAJOYOshLh/aTjKgqmU3hOGF
TLSH
T103928C306878AC3799E7B681F44636134FF85067EAD47FD4A1ECBF0D0296A9C131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 22b9b58b911e73121ed781ca2ebecc38e7344a88f75afaf292aab4254d387041
MD5 1a82eca92fb6559f06637084599b787f
SHA1 b52ddd03f73bc648362b816a3a7be4663d9e9a59
SHA512 4dc5a0d37264ed7ffbdc7eef5e5d977e4ffcb85cbd5d5061e29129fb4718b993f747038cdcf00a6e61683267a72bf6d285fd20f695bc0fca7e46229a54c608c0
SSDEEP 384:ZZcIhsNyf7RrWAdP2f+xOE1hpxJrOFaBeRs9JKgqijU3hOGF:xhPWAJmYOshLhAaTjKgqmU3hOGF
TLSH
T18E929D3068689C3799E7B681F48636134FF85077EAD47FD4A1ECBF0D029699C131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2ebdb754da63fd2d0584a5a1992ed04aa52454ad7dbaf90302e83417c79e0e6b
MD5 7a852beb8056252f6ac049127f3d7ce1
SHA1 d06fa9815a25d6245d9f4a2d6b3e9c72f940e543
SHA512 370986b786db2a02343b35ff94c62e07765c634c9eb0fb1cd396cdca614ee809153543d31ecf55db02b0ec9b8e08e2e8c5a635671d66d963fc1463c54e355095
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d52911af9499b91c578e44c3883775aeb9974210a5ffd1ccac8aa8e9b631a78
MD5 74b7c80ee4892cce408a3c9b97c2eccb
SHA1 f00af7296e403936436edabcd6794d43e5fe104b
SHA512 328f4984e160f3ad702039e82b090441fef3282442f0039257d1b989978dbf9dd5dd1e089fc5a5c83a9423cec025ab159e36afeca4d5fb1631edf2f53688cc1d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe591061.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591061.TMP
Size 392B
SHA256 f1d7c58ae72b4e6a30f659bd21973f5f349d91e2c7b2efdc0cee2412bab0006e
MD5 0c8478e254a82b3b0a04f56dc87154da
SHA1 0b94a5568b4d7287fca973baa730208a1b95dd49
SHA512 7e3b4d5ff65abfec028f562508b4954e7b8259c607ccf36eefa6ab752faa5e6a77e7d20230d3ab4d20be8642539769b5fb8508ccbcb5a7b84d6ba5763276d751
MD5 SHA1 SHA512

Submit Download

cd69618a-82eb-4c94-898d-12cb6bbff831.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd69618a-82eb-4c94-898d-12cb6bbff831.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa7af13839c8f63efff130c0d1ebd7791f5893c91c0f7a6e4c3052c5a66fad93
MD5 3cffb8238b3373fea127212006968ce8
SHA1 851d551112f03f66b371d3d231799a4a76086d2e
SHA512 649e00f15220b2bdf55c2bb61423f219e7e36da81985eca8298bb845891fd25cafbf5b1bc798f70f9647cd413a51c739fd0bdb917b7352c715c51ba909c26f07
TLSH
T196412B586AEA1148B3B36F5AAFF7656D487FBD772F0AD45D10010E4F0A22B41C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download