hxxps://www[.]ojrq[.]net/p/?return=https%3A%2F%2Fcapcutaffiliateprogram[.]pxf[.]io%2Fc%2F1943907%2F1876054%2F22474%3FsubId1%3Dgx-global-impact-capcut-ssd%26svlink%3D13733602%26level%3D1&cid=22474&tpsync=yes&auth=5ad8a83a6349531d

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.ojrq.net/p/?return=https%3A%2F%2Fcapcutaffiliateprogram.pxf.io%2Fc%2F1943907%2F1876054%2F22474%3FsubId1%3Dgx-global-impact-capcut-ssd%26svlink%3D13733602%26level%3D1&cid=22474&tpsync=yes&auth=5ad8a83a6349531d
Sample260807-rb2vcsfj7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305849265666794"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{0438939B-C685-4740-B5DF-1A205F7DCD50}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2080	5036	msedge.exe	87
PID 5036 wrote to memory of 4684	5036	msedge.exe	88
PID 5036 wrote to memory of 980	5036	msedge.exe	89
PID 5036 wrote to memory of 980	5036	msedge.exe	89
PID 5036 wrote to memory of 980	5036	msedge.exe	89
PID 5036 wrote to memory of 1964	5036	msedge.exe	90
PID 5036 wrote to memory of 1964	5036	msedge.exe	90
PID 5036 wrote to memory of 1632	5036	msedge.exe	92
PID 5036 wrote to memory of 1632	5036	msedge.exe	92
PID 5036 wrote to memory of 1632	5036	msedge.exe	92
PID 5036 wrote to memory of 2972	5036	msedge.exe	93
PID 5036 wrote to memory of 2972	5036	msedge.exe	93
PID 5036 wrote to memory of 2972	5036	msedge.exe	93
PID 5036 wrote to memory of 2680	5036	msedge.exe	94
PID 5036 wrote to memory of 2680	5036	msedge.exe	94
PID 5036 wrote to memory of 2680	5036	msedge.exe	94
PID 5036 wrote to memory of 2836	5036	msedge.exe	95
PID 5036 wrote to memory of 2836	5036	msedge.exe	95
PID 5036 wrote to memory of 2836	5036	msedge.exe	95
PID 5036 wrote to memory of 2036	5036	msedge.exe	98
PID 5036 wrote to memory of 2036	5036	msedge.exe	98
PID 5036 wrote to memory of 2036	5036	msedge.exe	98
PID 5036 wrote to memory of 1132	5036	msedge.exe	99
PID 5036 wrote to memory of 1132	5036	msedge.exe	99
PID 5036 wrote to memory of 1640	5036	msedge.exe	100
PID 5036 wrote to memory of 1640	5036	msedge.exe	100
PID 5036 wrote to memory of 2448	5036	msedge.exe	102
PID 5036 wrote to memory of 3784	5036	msedge.exe	103
PID 5036 wrote to memory of 3784	5036	msedge.exe	103
PID 5036 wrote to memory of 3812	5036	msedge.exe	110
PID 5036 wrote to memory of 1740	5036	msedge.exe	111
PID 5036 wrote to memory of 4888	5036	msedge.exe	112
PID 5036 wrote to memory of 2720	5036	msedge.exe	113
PID 5036 wrote to memory of 2720	5036	msedge.exe	113
PID 5036 wrote to memory of 2720	5036	msedge.exe	113
PID 5036 wrote to memory of 4116	5036	msedge.exe	114
PID 5036 wrote to memory of 4116	5036	msedge.exe	114
PID 5036 wrote to memory of 4116	5036	msedge.exe	114
PID 5036 wrote to memory of 4440	5036	msedge.exe	115
PID 5036 wrote to memory of 4440	5036	msedge.exe	115
PID 5036 wrote to memory of 4440	5036	msedge.exe	115
PID 5036 wrote to memory of 4056	5036	msedge.exe	116
PID 5036 wrote to memory of 4056	5036	msedge.exe	116
PID 5036 wrote to memory of 4056	5036	msedge.exe	116
PID 5036 wrote to memory of 4428	5036	msedge.exe	117
PID 5036 wrote to memory of 4428	5036	msedge.exe	117
PID 5036 wrote to memory of 4428	5036	msedge.exe	117
PID 5036 wrote to memory of 4304	5036	msedge.exe	118
PID 5036 wrote to memory of 4304	5036	msedge.exe	118
PID 5036 wrote to memory of 4304	5036	msedge.exe	118
PID 5036 wrote to memory of 988	5036	msedge.exe	127
PID 5036 wrote to memory of 988	5036	msedge.exe	127
PID 5036 wrote to memory of 3484	5036	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ojrq.net/p/?return=https%3A%2F%2Fcapcutaffiliateprogram.pxf.io%2Fc%2F1943907%2F1876054%2F22474%3FsubId1%3Dgx-global-impact-capcut-ssd%26svlink%3D13733602%26level%3D1&cid=22474&tpsync=yes&auth=5ad8a83a6349531d
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffaa54fc188,0x7ffaa54fc194,0x7ffaa54fc1a0
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,11662496183624438017,9361897970325025740,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,7503066905658658852,16917703184130931466,262144 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,10147610479006569565,9758868428351415535,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6085599844002487054,3439939640125757157,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5736370139233114672,17019756957574666121,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,16388108789350612126,2128242226451365156,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7543881493835291800,14211415381321526339,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,15172267483024243450,15596300403613323679,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9597054160833166235,9933395859658838430,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,17983995841895516589,1518107283316297994,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,552070033753419973,4629058395324987020,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,552070033753419973,4629058395324987020,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,5168129932000164943,3496907013795973843,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,17120582581591759828,957246130887137622,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,10157950337208910037,2351125717023310549,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,3981280124697436202,4322134842950665014,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6864,i,1317343146563847451,17416879907514021319,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6964,i,17652808984468968999,8446533718956545506,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3484,i,1865564017292581492,4624883371337815780,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6280,i,2049599478680715124,16169402979072604085,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6892,i,10484763974574999047,17967070265408259084,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6280,i,2899027600393154134,9943144079747805684,2097152 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,17038437133205191480,9779796443745715052,524288 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7016,i,6544630977137467718,4332280875382306360,262144 --field-trial-handle=2344,i,15074446427920487830,4225407951810744865,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 30KB
SHA256 94b8910408a94d99b2e6fa2dda256a958a2f40380dddff7c57d4da2aaf1bbbec
MD5 2f13c8bea40960ece85ba8562cf82444
SHA1 336b98fee514d0528776615e99fd361c4300297c
SHA512 8bb1eaadb0aeed83f39e96c6bb5b75e88162a2c03bb8e070c4f6b31ba4562b59b826d4b9d8c82f75599c117e8293ecfd05cf6b5ba8f8cfdab4d1c0872d0c3628
SSDEEP 768:jmN/6QMk1RgLEfVMMigNMims95C/x+DG9ReAN+:UJ1RgLEdMMiafD5C/xmGWAN+
TLSH
T11CD2E77EA805CDEDC29CC9B5CADF806DDDB931DAE2B5071BF191A00D2C4472DBA0B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 33KB
SHA256 d10b6b8740dc1c9b00e9de379f018412703813fb2f004007147df96856079bc1
MD5 5160c0f4e1d729208043839d77dd2d6b
SHA1 24b5a81564a783c7eb0e9553e2c247c2c7cf345a
SHA512 937320078faf6fde0cf40e773776eec997ff04bccb9d99c53441337c62387dceaa8c19a30241f564717ef1e4349611610d46d92ede7c999b0751349e2da081b7
SSDEEP 768:F4K3ykhQnH6azMHdIyghHDgL0c9maXr1brdbgaBy7C:iKongdIyanO/btrdbg5W
TLSH
T1CFF2F188D12BD4D97D04C13FCC392F9638C5FADBE02D66D5A99A0435F138EE44963A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 1024KB
SHA256 ac83a4b8319ec95f4dda6216f7f50711b6085b556f121eadf925b8430190f6dd
MD5 ea5b1ef48c5df36ab0487ac94b84f585
SHA1 32d6147bfd476b24f07f917b873c831fc1577b3d
SHA512 be5b319921905926b6c75d9d34c1beeebb6acb725821f3f7f2a43445e3d03219e021a011b1920cf7f1b4e64ab36dfdd4b9beba476763e86fec9ab3ad72afffaf
SSDEEP 24576:3bSe3NOzdGFg1JWV4xyvryyf3OV5YuYRPVp9/TOM9L239lr4T2DM:3BdOhGFWMV4xmr/vBDRPF/TX96tg2Y
TLSH
T1DC25332DE3686AED81092D7567129093F64E9F69B9EF6151F50DC1CF40E0C0F0B2E7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 1024KB
SHA256 33d2c4123cea055190f6675fbdf7112401a219f9dafb4613e181b033a27d9146
MD5 8b81f17cc9431687f87054bf549cc6e5
SHA1 51d01a4f2c39518712caa5f8b93a86bf11d37c1a
SHA512 345f43f2fb6271037c577b9689ac0a7f7aa4b640a58077a061b7baa953ee3d198302e881047453f0eb40eb982e9a6e746a4e392d3d5714897ea3e67e8af251ac
SSDEEP 24576:IhqFfal1mHbSfKkO2VhMUknRtHyDalsUTkx2p/1+D:IhFSH2CkOqhMR9yDa6UTo2ps
TLSH
T11A2523D0A9EE82AEE9D1C27E535237DBD9BF05FD23B25DB508C1138E8898C393152761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 1024KB
SHA256 0d9851d7964396c952bda01fcf308acac3fd81afbc2d9364ad62bd4d28d04be2
MD5 d94e0d23e07ff714ca1ea21b5f640061
SHA1 9040d076d06784433c94e2310225a59fa141a9df
SHA512 5a48ffc6cc458ee6dff4694fa9a8be77f9a34a1cf3434b606dee5bb295e4288e3d1b44edd7e8ad0eaacce871ee19ec03ba1a4489fca7cad9f9a533916d1e8761
SSDEEP 24576:+vh+XsrF6kfiRwH3jAaYZeqG+rkdSPYWpvryK6fVRe72HlKe:AcQ6kfvPv5Wp+KBe
TLSH
T13F2533EF3CAE45A7FFBF8175FC844A681D7184B4AE2032F3547E07155AD1826A8C13A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 293KB
SHA256 6c2d01259e52301485b7770b7ea821f863821412733343cf6c6bf992f956b360
MD5 9c56ff48e26a3a428426d90545d5d512
SHA1 1e9062614c7f6e6e7a683afdf47f8cd36062accd
SHA512 52c9d7a9086517b1e65dae2140d8177462abede270d459c113dfc17cbbff1af64d4c815bdb189b09e72d5badb00f9ff6cd68410e0333f2ba7e576427e428f642
SSDEEP 768:JBbya29BH5HQyysHCYOaiYxnkrllr4l/EYO:JEjHlQyys9bhkxF4Oz
TLSH
T13D5414967770CC82C646BCFDCCA3C7851F0AE1A4AE3C9686B757B3DC3E855482823916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
Size 1024KB
SHA256 f210d61d24985a2835cdc1364c7cd086647c3d3b69aa766312e3958e3aa8d3e3
MD5 f6ef7aba45b87bac1d4fde3109b3ceab
SHA1 4b7c7e40d18a4639995197cbd5ac0a8b2fa2a904
SHA512 02fc131ac113595afcfe387bce03bbbcb62101fe2114723b2431fe360e54449ccda0f75503d68339852f2f696be2286a96ff9d4ce12d06dae4c02179e9dff7c0
SSDEEP 24576:r9hxn1TcPYY99+IraSeCDdyc81hcQjvmzojV:r9hncPY8Xboh/7mzoR
TLSH
T17A25333B2B987A16053757432A632C3ECF6A77C12B4B87734D9C994A09F50EB6372781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e4
Size 1024KB
SHA256 c2a24c5d560e498f985852b1084bb5036b99694984388379cab3fa11f98a7a3e
MD5 be1e076f1e0935215bed2f21e23db228
SHA1 c00a6edefa3e062c1a446b001c19f190ac77ca4d
SHA512 72f3a09e88d35af3ae0fe1a144549f3bebe05d8f42ed4e569d6da1f7c5a0624a42f6b768697650939c55657a874fe3e6b047a905ab9d0a72322d7a6c8c973da6
SSDEEP 24576:8CyGOUaJaYcj1NWi6A4Sb35QDoi416ufeWXdZULgM6soA:7JfaEYc1NrNb35Qh4jXdZUXF
TLSH
T1852533D1CFED3ACE10D54A088DA7574570D7699C88FF2B8C5AB0D6BD283F90219066AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 1024KB
SHA256 7f14c461b2f88b696473bfef1579ed25206869875cdd3510bd0fce55b61271f3
MD5 b88ea29a1e3b1ec4ef0f3e3065a616b6
SHA1 95ecabe273cfc25af6a5cbc3e134c947a2f5524c
SHA512 2a53adefd197eb3eca68b6c4df52cf20cd0852450f4ec183534591229ea4f2e11f24f3bf31ec5014f9b0e0125224dd70bdb181de0e6fb699186fc06dc57b527d
SSDEEP 24576:npvhHY28kjVkECCkhUvw06qY4jJh7TjNkTM5/:nhhHFrjVVpo0hDNVhkTMJ
TLSH
T1E82533A3ECFE06AA52A014B8CD2DD6157BD574C824A6FFA145742E5F70B2CB834047EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 4255b6dfb6c80bf4f33fbfc508b233283cd95df169c3fd89322bfd775fca9dac
MD5 ef8bf1565b759bd171ce9bed9e7cc82c
SHA1 57209cf667672fedd295670491e792982cddb0c6
SHA512 c9b022805cbb7f5d4ca2f28615a8b50d9ca7b8191a93789b1ddd78589d532e3a8fbf5d169303a0b552b911e68b55bbffa54363882e191438d4c6fe8d0f21ae11
SSDEEP 48:cZ7obaUMihWGlATYElovbppPfsqil1D4url1Bcb7CvaWplbT0JtVsNr4HziOTFsB:AcbIidKdALEqil1D4u9g7CvZR2IsFO
TLSH
T114B173F4F781D4D8DBB8533060813B5CE070E5FAF9268F9A39731CE3A502A96A38C516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592a91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592a91.TMP
Size 3KB
SHA256 1d591f351b7493571e75d86b0409429179096ed889a9eab2de49213dd107715e
MD5 6301869a21634e5f592d8958929b7bb6
SHA1 617804c11cb494fa1235944a901d638274d2d164
SHA512 b2fd7dcf2c4bc504b4b2326657cfe98a64568be06872a3b495eaefe4786b551c2a6e92d99c4b13e2019c26a29755261deb5149331701d9c9ba93f8da52ba7913
TLSH
T1E1713B35E602D4A9D3B013317081236DF071A9C8FA6ADECD3E7358B78500F29721DA26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9f043dd115425eff16e6823a0414f704c37255dc683908a11d84a2b9e366d763
MD5 887cc0dba8936448cd16c6abc52b765e
SHA1 458c61944ef01960731ae66fd5fd07013b5328a0
SHA512 a3ad5fd897693be4ae9857b163d491698f1fd3e494813b76c98842781b5ea50d3fe16a1d50489e15e53e2b427ada9fb5a70a289a867ded8e58a77c8eeca1aa74
SSDEEP 96:D/OASI0V4KzavSGUx9xuTUBBMwfJAWPEszzreMG/a:DWASI0VFWaGUx9x8UBBMGJAWPEszzreA
TLSH
T12EB147F383E5856D8F016AF09A14AE1EDF680520436C393AC9E9AE56E3F3471E10275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e5004c0ace45a0f4cc497e2d4ba6fbcacdcba9fb709bd965badf8f4360644817
MD5 e2826dcf79eb8fa59545e8f3e14ff147
SHA1 cd1fb0076fbdfb0be7f053a8981489a543097b96
SHA512 d1e0211416ade8d220b18579aa05a5a0534e2e63dcb5045c978feab8d8f970971101bb99aa70373217c3cf6825e3e6ed318b4195e86970b9a45be14961d2b868
SSDEEP 192:sxZ3REJyM/jK1Ml8MkL/f7sorJ5VLIdpc7HW6+WN06l4/Yvbk9JeIgrJ:sxZ3EML/f7sorJo2HbL4/lk9
TLSH
T19F42E7527A34A977CCDBD209FA41BF53D6F54562A2900E84ADFCDA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a94d5c86da3bd8023d410c0be8cff03460d1e3848b689bd069e850fb95192412
MD5 b1a3f066534c924438dbb7ee394f80f0
SHA1 6aaa05924430bcc3fa1697d6d0660337fea05cbf
SHA512 6b60b70b04d7ed416c0deb5d0f28f3cb20cd019ea914f1bbc8cd211e74d927418bdd6303fb13ed02b69e9d2f40a98a943e219e32bff16e18ae72c97ad4b694ff
SSDEEP 192:sxZ0REJyM/jK1Ml8UQ2KkL/f7sMzJ1VLIdpDaWHW6+WN0fkhYveDDJeIg5fJ:sxZ0EqYL/f7sMzJE1HbPhTkn
TLSH
T13452D7527A346977CCEBD209FA41BB53D6F5446292900E94AEFCDA1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e7f8f83bf8455fcf84a23d5714f1821974951da6670cd16c5cad14ed83ef1cf8
MD5 015d3195e197f0b1569036dd8c2aed23
SHA1 a7e640033cba1d8170d67cf266938ddd3c2eb331
SHA512 4387feae76360d585817c56411eb5418822e37eabe45643c42e7ce6746d0f442634f52cb9aada0f5dde3fff6cad011d87c4960aac6ce1a71bc03c24e898b2180
SSDEEP 192:sxZ0REJyM/jK1Ml8MkL/f7sMrJ1VLIdpZaWHW6+WN01SXYvok9JeIg51J:sxZ0EML/f7sMrJEPHbPX4kB
TLSH
T14552D7527A346977CCDBD209FA41BB63D6F54462A2900E94ADFCD91C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 712e7472784c8f6838bff8a58214fc7285af6dc6d70d8859cc491bfd1c6fd4f7
MD5 8a734a3256bb398a5dc358bed8bbc50c
SHA1 05ea23a44133531847a75329f5d194bd3603a00d
SHA512 596c9b21e68038ef5373ebf9cc29295fdae16ef8f2d8762531de76f76400a7abf3ea73093e5fb764dab70caebf5b9671550d7ae2c3d3385337436513d488cc53
SSDEEP 768:OEseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppxroGw:OEseJ3xWvhfynu1jaVcL88pKt
TLSH
T12FD20B2B280CCB7E4F844E6CEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18f104cd4551913bd22fdf81c21dd095db05c573503af696878f217ab37dd69f
MD5 68262f9393c1264a14a3fff3efe2919b
SHA1 6d3eab823765c1921695831144bb19f187aa14a8
SHA512 59d515533e4d1840b67918c4c01fd215230e1518826cad71b4f2d1ab82488b39f2aa242191a957b087cb5ae2eb1e1f7b5dafaa40f4e49e8864f1652df2233f1f
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ey:KYHIhKggkXyZqIvK7i4Pyd9I5Kec0M
TLSH
T15F916B12363F020238BD2558B2A995778F4135A37858A86FBFF804754D6BE112EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf0399fa-bf0a-4b02-af80-a38ed10861c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cf0399fa-bf0a-4b02-af80-a38ed10861c7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 3614ca6e95d706ce98e3f6dc43ff3df872f132bb2dc699b504ae51462595d4fd
MD5 006877961e9fb1a61e816f985ff31b09
SHA1 1b58fc30f139a46c72bab1dd1fc50384161c4155
SHA512 792337af9a22f9776476bfee7c0638c6559a668c6006a3dfda95aa206c233678259c250869d578c3b86f1399474e665af2e0b6650346a11ea62be61420ea4dae
SSDEEP 192:u8m+xasuheOwQxMGsNVcHQky2cTM7tnZyQmiU1Wsl4MTRV+FdLJ65rSfyw8z1aqN:yZcIhsNVAbIA7tZup6xd9tqJN8lO
TLSH
T1DF625C725C746C37A9F3F285F08A36134EF4D027A7C46B94A6ED7F1C00DA6A8131AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e42757dc6eac4d950df5db21efc7ba9b7736d89935d20f68dcc0efb2167e126b
MD5 817d9d3048c07e7261919febfe3ea3c9
SHA1 4dfdc64cd01fda0ad79cf37f8c5e2472b54b3982
SHA512 943c049a33ee591e9ba62792853a90baf303fad00cc1c9697a1d88acf74777dcb3097ee1e9eecb6002168b97857f0a34f589e54781638c550499a0c82d3bda87
SSDEEP 384:fiFiZcIbzsNv8TUNTUlIl5bIA7tZu96xd9tqpN8lO:qFQPCwgjIAeU/t6N8lO
TLSH
T198B208F248D7983BE9AE9747A77D2E124DBCC067B5806A50B7D96A0CCC861BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72e27ab1476798bd82ed9322009654e5d35622173a99b417d249cc6bd4542ad6
MD5 90ef427389355ca1e850874466e9427a
SHA1 e5a0f24b4bd1a8806c5acc2068b209c808be0fe7
SHA512 b970c4e4f465e713f706185ed2a8440b50cfe40d95c5d631caf41814df8621379305484d724ac4124aced13813769ac046c87f089f4a5759de666c82f7e93b11
SSDEEP 192:lON46vMtPQmiUymxThTRV+FdLJ67847OOU/u:lON46UtR7Tad9IpU/u
TLSH
T173020C35AC786C77AAB3AE45F48A27175FE4517F95D01B50EAE92F1C00D764C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1502906615d35a4087a673e4fb2e257b78f0ee255c3c7e1e7af3b06a0ac83b4b
MD5 dc83a46881eaf77e48a6b147b538a689
SHA1 295b7d8a8ef2fbf317ddb4f798bdd254a5255ff5
SHA512 e93e9cc7bc8146a527b7d3e0db4a049bf1bb8e8b48322aab7656336f54de370a8fcfdd35448f8a86bd95318569b94578b77c80414957ed4dd6460dc836dc421e
SSDEEP 192:unm+xasuheOwQxMGsNVpHQky2cTM7tnZyQmiU1Wsl4MTRV+FdLJ65rSfyw8z1aqN:JZcIhsNV5bIA7tZup6xd9tqJN8lO
TLSH
T14E625BB25C746C3769F3F185F08A36135EF4D027A7C46B94A6ED7F1C00DA6A8131AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 330ff510cd5f7e313fe86cf04d0ddd19cd8eff4358669df38296bd9f578c88a7
MD5 3b86c241fe2040b77bb2af3d0ad8a1f5
SHA1 c7f6cbe2a4686dd8a95cee77cfbde56afc6948e5
SHA512 c5ec4c24721b4f0260e0c69f570407a0c1ed7b62e752d9bf02b93ecda781b5f1420f59cfaec4010ae598498bc88e6e55e02357291c9a26c2eca68207e85ec634
SSDEEP 192:FON46vM/PQmiUyXxmhTRV+FdLJ65rSfyD80Iaq18U/u:FON46U/REmad9tq0N8U/u
TLSH
T17A122B72AC646C27ADA3F585F08A36135EA0D16BAAC47FA0FADD3F1C01DE65C1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37efec97660b8db8ccf1d85e7f75eeb77c0c91855df5bb12cf7af34b2693737e
MD5 3e926750849c71b6452c160602df7dd0
SHA1 22b8f73fb0810f8a13875cc8b163fbde258d14b6
SHA512 186318b262b4d0f8ce7faf57e531aa548e509db87ac5cab734b7b60a7eef8ba846e029e669dce6583dcae6cb2d60b11ba14642c0088b6be5ca26031bdcc28ea1
TLSH
T140412B58B6FD105873776F5AABF6A4AE487BB9372E06D49D10110E4E0A63A00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download