hxxps://www[.]filecrypt[.]cc/Container/13DF97510F

Analysis

user interaction
yes
max time kernel
61s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.filecrypt.cc/Container/13DF97510F
Sample260806-agcc8aef88

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
191	api.gofile.io
192	api.gofile.io
195	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304486561785416"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{28A43260-24AE-4FA3-8BB0-C981C472D6C3}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4548	3212	msedge.exe	86
PID 3212 wrote to memory of 2072	3212	msedge.exe	87
PID 3212 wrote to memory of 1548	3212	msedge.exe	88
PID 3212 wrote to memory of 1548	3212	msedge.exe	88
PID 3212 wrote to memory of 1548	3212	msedge.exe	88
PID 3212 wrote to memory of 3512	3212	msedge.exe	89
PID 3212 wrote to memory of 3512	3212	msedge.exe	89
PID 3212 wrote to memory of 5112	3212	msedge.exe	91
PID 3212 wrote to memory of 5112	3212	msedge.exe	91
PID 3212 wrote to memory of 5112	3212	msedge.exe	91
PID 3212 wrote to memory of 4016	3212	msedge.exe	92
PID 3212 wrote to memory of 4016	3212	msedge.exe	92
PID 3212 wrote to memory of 4016	3212	msedge.exe	92
PID 3212 wrote to memory of 4080	3212	msedge.exe	93
PID 3212 wrote to memory of 516	3212	msedge.exe	94
PID 3212 wrote to memory of 4080	3212	msedge.exe	93
PID 3212 wrote to memory of 4080	3212	msedge.exe	93
PID 3212 wrote to memory of 516	3212	msedge.exe	94
PID 3212 wrote to memory of 516	3212	msedge.exe	94
PID 3212 wrote to memory of 336	3212	msedge.exe	98
PID 3212 wrote to memory of 336	3212	msedge.exe	98
PID 3212 wrote to memory of 3464	3212	msedge.exe	99
PID 3212 wrote to memory of 3464	3212	msedge.exe	99
PID 3212 wrote to memory of 3952	3212	msedge.exe	100
PID 3212 wrote to memory of 3952	3212	msedge.exe	100
PID 3212 wrote to memory of 3796	3212	msedge.exe	103
PID 3212 wrote to memory of 2436	3212	msedge.exe	104
PID 3212 wrote to memory of 2436	3212	msedge.exe	104
PID 3212 wrote to memory of 2436	3212	msedge.exe	104
PID 3212 wrote to memory of 3328	3212	msedge.exe	105
PID 3212 wrote to memory of 3328	3212	msedge.exe	105
PID 3212 wrote to memory of 3328	3212	msedge.exe	105
PID 3212 wrote to memory of 4820	3212	msedge.exe	106
PID 3212 wrote to memory of 4820	3212	msedge.exe	106
PID 3212 wrote to memory of 4820	3212	msedge.exe	106
PID 3212 wrote to memory of 2160	3212	msedge.exe	109
PID 3212 wrote to memory of 4220	3212	msedge.exe	110
PID 3212 wrote to memory of 3168	3212	msedge.exe	111
PID 3212 wrote to memory of 3000	3212	msedge.exe	116
PID 3212 wrote to memory of 3000	3212	msedge.exe	116
PID 3212 wrote to memory of 3000	3212	msedge.exe	116
PID 3212 wrote to memory of 2096	3212	msedge.exe	117
PID 3212 wrote to memory of 2096	3212	msedge.exe	117
PID 3212 wrote to memory of 2096	3212	msedge.exe	117
PID 3212 wrote to memory of 4792	3212	msedge.exe	120
PID 3212 wrote to memory of 4792	3212	msedge.exe	120
PID 3212 wrote to memory of 4792	3212	msedge.exe	120
PID 3212 wrote to memory of 1424	3212	msedge.exe	121
PID 3212 wrote to memory of 1424	3212	msedge.exe	121
PID 3212 wrote to memory of 2512	3212	msedge.exe	122
PID 3212 wrote to memory of 2512	3212	msedge.exe	122
PID 3212 wrote to memory of 2512	3212	msedge.exe	122
PID 3212 wrote to memory of 4712	3212	msedge.exe	123
PID 3212 wrote to memory of 4712	3212	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.filecrypt.cc/Container/13DF97510F
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb6119c188,0x7ffb6119c194,0x7ffb6119c1a0
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,18433333752312973640,8073954677640617130,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13821388419594717966,6195282731587059616,262144 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,7168740538625606742,2784339513303063856,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12580446127192969138,277718168739967492,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17475770700244657970,9893349186765103759,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,14162612982221534526,14085736216481437005,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,18438819863009663704,3111072418566808047,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15569537348064073817,902966763397230664,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,5929525578984801452,8784087740576726888,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,5199483475874740242,6126550438001800400,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11429914013700551246,12417336132083874211,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11429914013700551246,12417336132083874211,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6468,i,2300095329639203615,12187587101962771584,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5956,i,8875712274573142937,8432764278578624447,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6508,i,8500399879678449748,3691808348467896497,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,8109991645548164070,16425121444074931895,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,18042851773563441195,5964581252187965429,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15786172832184512925,1978549090002169080,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6812,i,7346905078480905700,18009784829495377948,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6640,i,17176430959901286516,14148684159793558549,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4472,i,2803784514642887776,15995241702183813312,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5824163723486771353,16990314105316752797,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6560,i,6029004629423803796,14666145673599604964,2097152 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,9586115986605694262,5923353728084972377,524288 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7004,i,11279256066064312955,11406134864490330634,262144 --field-trial-handle=2212,i,9358517352016817352,1977919940539800757,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6ac1610274f1a1fe7efb487499493de9e02abb0353ede585200d27e7d566ceb2
MD5 9aafd3c6a631d23d2fc5d16d5786b9fd
SHA1 10c1e74766f4f28594e9176e3314d0468398b076
SHA512 ef9b3fe910d4bf60d05f218e85bed9b85b78b05fbdbf92c9c4ca899b3f0468f7fedaaaa159758ab5ed7e1b6e7be9bbf9c3bfa7b175e3267150fc3e925ed76223
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T182B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 38KB
SHA256 96a874a36a161a53381e9c5b16dcc188a04da68d463130aaf505c0f08de38782
MD5 7edcfc856660cb38268d12020c19f321
SHA1 2681c51f50575a41e511d9466905216b29ed6c60
SHA512 ca7f075f61865b369cb7391113f48038648725b36c7c3b3578d910c0c154b5996788fb0fe56a2b4cb990e1ea54fd715d84d5ceedd539e3b98cb3ab3ab59487e9
SSDEEP 768:XytJ5hkIjw+b89qwAs46QVT6v1G9iXW75Vt/y4biUT/60sZt020:At8f9qt16IwOnJf/60sL70
TLSH
T12003F103AD345B43A628CF7AA59D1B3A22FDC19E95AC18CC4F90181B30D2F780ED6B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 36KB
SHA256 fdc9964050bfa24c27a3c76c6791b3674292a5f352cbc83d7a4dc49595bc3fb1
MD5 50b140b1e97d859d6d0603414f4298ee
SHA1 500e4872ee1ba9cf89f1ba626d64987b0f9ab5c9
SHA512 55ef84e956a7943e3fc61a8a349e64e9f35b7dfc63402ab52b995f43a7cd4b1d2acd300126dcdd610d0b106af426848f998ccf154f712034422d242d6ad9130d
SSDEEP 768:TLreREud92B1C5buEpioxWe6O1ESHFnLQkbknuF1dcjI5djeBX:Tu68248oxWe6O19H1zwnubdk
TLSH
T1A103E0D50DD6198AA53B3F7F467F0A3E1B12C429A57180F44A135FD32E169A7E910F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b00155fb84d16688761827edc8e2f1b433af8e3ed2dfab7c496d5f6e40ce9c21
MD5 3dafe2f7d3b54d40cfefd0b218b1cdcb
SHA1 81bb430128bcfe448efc4d4101ed51bd13317453
SHA512 0a9bea5446d29d357164db95b0f612bfa951b120aac06c483ce1ebd36e9303fcf2c0f904e9c21c81e2dffbc3a5c0f31e2cd9f6867eb93f0ebd0940429074f8e1
SSDEEP 96:PeC1v2paAsk6csSyCCt4GD+EE4tX9DuTt6b3OwfnVIFr0GHgh8Ls2IeqIK+:A0fCEnWGm
TLSH
T149A19304C1824561EB3DE031D1F2B515BDFBCAAF4DC74E9207D6C2FD2929B9D9991007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5951fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5951fe.TMP
Size 3KB
SHA256 7223d2ebd623134f51210b4ed887e4c34fae727c6376fd7da33d219ecb0789c6
MD5 a9614ee0ea5019ed27b1569c298f3ffd
SHA1 49b373d783f5d40274a90f4a83657bec7d0cd548
SHA512 8537756d6e24cc7251a75bda73e8d446e92e1feabd9c657de23958d1598dbbf148d734dbc9757fdc269c26fecc61b5154454821be177032ee5636d3651d3d46b
TLSH
T173614C1802C24972EFBE1072C4F196193EF3599F8EDB8E1247E4C4FD6039B1EA9E6004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85cc1729-a0b2-47b2-805e-52649d299625.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\85cc1729-a0b2-47b2-805e-52649d299625.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6955fd20dd426c68081a0ed72c4f6389d5dda50a879fb93ace3b6d4e4dd81b35
MD5 8b783e4bdca7f903af74c6d5c7171083
SHA1 fbf65b7d2b1485e83d00241edd0aa787676a118b
SHA512 b48013ec6ace224b1b69f93c7d123e4d93cab1b2dcbb81c608bb4f84c87c4f3a7d5dedc47f2b4f84c702bbfdf251421e1a4c64b507b3277003ec3fd93597d3d0
SSDEEP 192:D/3VdN2avHf/Z/GC/i/adMCeAFG6etD10m4BzUF771TgiPShqxIz8byB:D/3VT2avHf/Z/GC/i/adMCeA0HtD10mA
TLSH
T11DE17AF383F4962E9D2256F4AA14AE2FCE1C0525473C393A89D5AE07A3F3571E101A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d6b9cd95bb63e335065763c12982213d8a5949bb96afdca862a0af754569770c
MD5 8c153fcdaad83a0438e68b9a081d7170
SHA1 da6ac44eac71641098721197f17bd2ea9224591e
SHA512 b059b120a572890af8b9ff471bcb1f2439cc0c6bfaf0b32489fe03d7f8ec21ebbe3fc92199219d789733108ec897ea2fdc64b13b6f9e74f0c9d5c80139d4d9ed
SSDEEP 192:sxZGRsyM/jK1Ml8MkM/fExs7LEIdp4NolClHW6+WNZ0r/YwQ1902IgrJ:sxZGWMM/fExs7LdgPHbu/TO9
TLSH
T1015209116A34AA7BCDCBD209B955BF53D6F5163296901E44EAFCD90C04E6BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e4c9a9b45c7097e699aa7ede937d1b705d3196e2a100faf4257184c4d416f348
MD5 12312a1fbedb0163aee89166e46421b9
SHA1 5f1b0c60323ea4c7c6937f9bc5ebe6c9e87db21a
SHA512 282c057c6c954fcc30e48ff9f7139f446df253939716536e742dceca582c02c63549c50730bd0184462b8ba37dd3f32eebe9c06b19c177f2e604073bc4fc3bc2
SSDEEP 192:sxZGRsyM/jK1Ml8M9M/fExs61rIdpEpCeold4ul0bHW6+WNB5DSJq8jXYwqFUJ9f:sxZGW1M/fExs610CHHbc5XoFnOn
TLSH
T1EF62F712AA345A77CDDBD209B900BB93E6F5113296911E54AAFCDE1C04E6BED3207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 79bf5c54143e6ca1b6bc68fc7e3bf446b151bc014111370cc61d6813c6880a83
MD5 497ce269127b7d075a1e54cd68eb24a3
SHA1 5e23176fee79a10265c230b452c55c31d9aca755
SHA512 0407d55bd930371c8a3e10c82f5fbc9d7545d790d85fe227a0c0b3071ffed5dc1f946bb80b7692f9519a19fe1bef40b0b388fd8b5571327aef860f3f606dbbbb
SSDEEP 192:sxZGRsyM/jK1Ml8UQi9M/fExs61rIdpypCeold4ul0bHW6+WNB5DtTW8jXYwUFUX:sxZGWqUM/fExs610sHHbJNXKFXOn
TLSH
T1E662F742A6345A77CDDBD209B911BB93E2F5213296D11E54AAFCDE0C04E6BED320381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2fe88af3c63145b235f22e9f497aa9a71381497f7199d84d400f38d8658eefa8
MD5 5e9176b6b19675bf7fa8111b8da04de0
SHA1 da4c4acd3681d27ed7229e36eb08102ee546f5c1
SHA512 36c8d25480ac66bae207bfc5eaf72d47305e5b4288df242b0bb70bea9bc4e4414785924268e26fcdbec545a77c42cc705036e7e5db81a7591c804c40c0c94544
SSDEEP 768:Va4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dOrohkDai:Va4jeXmWvmKxEu1jacPLZQdFO
TLSH
T137E20A3B240CCF7E4F844E5DED26AE972ED802CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ef19fc4e42c4bce269a6baef4c4d13ead7f61288496e22ce5c99866e559c3440
MD5 dac93e54b242984d419abe7b01446f6e
SHA1 ad8ba92434f8ed16b1f12093b338c91f38692989
SHA512 0d36fa922220db218c7a9c45125d1c4df3e7fe7c3e435e7a8e1d6bcebcfb1409758112c5609e90ee0f84b24a06fac05dd05712ff9c04d79c8bb34db694b0f4d5
SSDEEP 24:KdhfsX+a7djP34HL+uIjL3KighaV31EBnSmZMM8fcyXYsfj45a2dOuq4GC+ZIjkz:KceI3KLKIjy9lI5KGUcKxI5KyE0Dyhz
TLSH
T16791234935BB42013C3F250C9295DE669A82F1633078A92B7F6D04B69DA6E149FFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 901b86b0413bd31cb4fb0f4a3ceec6111814634eddea6eacabbd03f1511b38bb
MD5 b2682ba324a4f8bd3670aa6639b7384f
SHA1 b1257f6a5a835c6747bff6a332522fc39b0e4ccc
SHA512 eb9dbf853d29b7a9d88d2c2c0b860dc0c13d7633a2f7c88d1e8021f54efc3bd681d2f57c6e94169387b330d135ad6b2672c7e58fa09747290c9174195e531dc5
SSDEEP 384:tZcIhsNfSgv/CP2f+j8IMX/+2wFdnTKwBODNZOC/WE:1hEomj/lednewBKZOyWE
TLSH
T159926D36583C6C779ED2B649F44B31138EF89227EAD57B94D6EDAB1C00956AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 343d55dd067eef86bcfc1ae957cec3903b76deecec0ef294a4911bdaec2b06b0
MD5 8960320d40ae4b1bdcd6bfdda929129f
SHA1 d92628339e5e2015fcc6f67f4049290699ea27ab
SHA512 a188419e402424293f29ff295d3c59033e9933efb8b58410fd79234adc95cbeb875d65c9176d92da6cf77dd5e7a145c8f42684fcb04b117594444a723bdb0981
SSDEEP 384:FiF3ZcIEtRsNB8TUNTUlIlTgvCCif+j8IMX/+2uFdnTKwBODNZOC/WE:MF/s8wg5jj/lgdnewBKZOyWE
TLSH
T10AD219F248DB9836DADD9B47A77E2D028DBCC163B9916650B3985A1CCC861BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ddede33abdabd99cde2d6da0c09f3c2b7efafa59275f1b8c088a7e7a2b439094
MD5 6fc93ea31d1ad3dfbcc10d7c9ee39d79
SHA1 c4f6125fdbfe689e01d0bd77d24310728e78870e
SHA512 4207b54fd025f4731dfb5c967e73d40b5107ce41227b379d90473cd6b1f86ba817456368031d3ef18bbaeb72ea02a3521f45a87f391a354075fb4fb1ca36be8c
SSDEEP 384:3ZcIhsNfHgvoCif+j8IMX/+2wFdnTKwBODNZOC/WE:/hIjj/lednewBKZOyWE
TLSH
T1BA926D36583C6C679ED2F649F44B31138EF89227EAD57B94D6FDAB1C00956AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2dd376426b818ba96087f0518557d02ccbb9a34add876626fb82f39f3867024
MD5 cf27cb6b8aa6115f77cb1be32a31ceab
SHA1 89d275fafe4291d706d381378bfa42e573ea16eb
SHA512 c672994cf04b1a2b982c926911822d31c82b555a3fff06f871eee78348ae6fcb38b7587b80a3fb21756e56ad6e5f15fb214df9a8bc4d60cb928280c7f649e543
SSDEEP 192:EONJ6hZ0QmiUyeApc/+jVRjzorIz5wOZQAhU6:EONJ6oypu+j8IK2HhU6
TLSH
T19F02CA3568687C778EE2AE45F48737135FE5116BA9D56F84DAF81B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 68057146d20e6456a90d6c77da1f9c88004e4b78ea5b5bf308b2e78eb4902c65
MD5 bcbba38070ea2673f8b4af9a07fb20a1
SHA1 8e9f503842182eb95b1892d936d472295a2d082a
SHA512 9045031733cec6efe808017d31c8193018324b7a50852083e9b248b1cc059a89bc921e10ac2a0bb0428dceb44dde91494d28c719cb38685ac343ce4e864391b2
SSDEEP 192:5ONa6hZAQmiUy4AVc/+jVRjzorIMXTr+2Z5cOqoqPU6:5ONa6kuVu+j8IMX/+2M9dU6
TLSH
T1E112FC356468AC675ED2B985F08731539EE55227EEC6BF80D6EC1F1C00DB6AC230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9c76c443de99e16e0960e0ab716fb6fd406f4ff8a813a5a64322bba9327d2597
MD5 ed05d370d7f1406c45a57f94eb5934a4
SHA1 f07fa8b1960bc761cb7216d75597ca70d1688ef1
SHA512 3ef4321e98a87e10f1ce80f9d424c0caf813b3aa3b10e6e88c8128a431487f240d09c2c7623bfa26c4db3c30f98a8c83602ca9a475b6dbc637fb5cf71636604e
SSDEEP 384:FiFPZcIEtRsNK8TUNTUlIlTgXCCif+j8IMX/+23FdnTKwBODNZOC/WE:MFHsZwg5jj/lVdnewBKZOyWE
TLSH
T15CD229F248DB9836DADD9B47A77E2D028DBCC163B9816650B39C5A0CCC851BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 42e1fc1f56401dd04cd309a96e2ec5da39d2b5f86db04242d3a932554a2242ee
MD5 4c6d945fc10cb588e7a9bb2f18586ebd
SHA1 fb2ce4fd1e5dc6f754287436b1e6ae6b49720c10
SHA512 7bab71a595ba9c770ee1fc27bb30d247ea3ca68a3f5ea61edd77d14f8b7cc6f477596f61ca2a5121d869ea2874d23fbd1ad8aef70ee656d413a17e7423dac0ad
TLSH
T12BE00203E70000EFC038037400931F212B73D4354393430A4F30017C3C313403E20980
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58cc34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58cc34.TMP
Size 392B
SHA256 4382dc43511720d00d14eb09b0f86bf51c68871341a1aa484c3372ec2944d0b3
MD5 5b53b13176061480ab11a028ac8fb29e
SHA1 9e98343a812278f5a8e3c54069c749d1a9432535
SHA512 08f6d4a0c0b7c77397df4a559b0a31b41d2449fb023fbea05f7f696a1d12e2830afe7946a9c5c698b759aa79f799eb3042f1fdacc8250000ce59488087bad7d5
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8084a29fe2d0351f52ae0a7d9e053ef977bf89acda4975e36cafc001d9604818
MD5 ec02210cb3f67e0bdf6890eaa6a8f935
SHA1 abc88b0dd2ba044532db04a8e932e01ef09534c5
SHA512 617fefa74b2c1d6a81b6b6299c2ea01ef1cf67eaf3a8a014e3b76872f150da6979eddfd10736bc92cd8d354c57a09b7cd026271cc92967f5b82f8cdb80376b79
TLSH
T18E412858B7E91159B377AF5AAFF2A96D487BB8772E16C05E00020D4E0A36E40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads