hxxp://www[.]buzzfond[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.buzzfond.com/
Sample260808-e8l4ysbg52

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	30	https://www.buzzfond.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27bd29738fb6531	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1816	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306374145417127"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{938D4C7E-CCE3-46FC-8F21-A23DED387B0C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5272	msedge.exe
5272	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4136	3620	msedge.exe	83
PID 3620 wrote to memory of 1816	3620	msedge.exe	84
PID 3620 wrote to memory of 3296	3620	msedge.exe	85
PID 3620 wrote to memory of 3296	3620	msedge.exe	85
PID 3620 wrote to memory of 3296	3620	msedge.exe	85
PID 3620 wrote to memory of 2180	3620	msedge.exe	86
PID 3620 wrote to memory of 2180	3620	msedge.exe	86
PID 3620 wrote to memory of 4272	3620	msedge.exe	88
PID 3620 wrote to memory of 2800	3620	msedge.exe	89
PID 3620 wrote to memory of 4272	3620	msedge.exe	88
PID 3620 wrote to memory of 4272	3620	msedge.exe	88
PID 3620 wrote to memory of 2800	3620	msedge.exe	89
PID 3620 wrote to memory of 2800	3620	msedge.exe	89
PID 3620 wrote to memory of 2236	3620	msedge.exe	90
PID 3620 wrote to memory of 3036	3620	msedge.exe	91
PID 3620 wrote to memory of 2236	3620	msedge.exe	90
PID 3620 wrote to memory of 2236	3620	msedge.exe	90
PID 3620 wrote to memory of 3036	3620	msedge.exe	91
PID 3620 wrote to memory of 3036	3620	msedge.exe	91
PID 3620 wrote to memory of 4780	3620	msedge.exe	95
PID 3620 wrote to memory of 4780	3620	msedge.exe	95
PID 3620 wrote to memory of 4780	3620	msedge.exe	95
PID 3620 wrote to memory of 1676	3620	msedge.exe	96
PID 3620 wrote to memory of 1676	3620	msedge.exe	96
PID 3620 wrote to memory of 1676	3620	msedge.exe	96
PID 3620 wrote to memory of 5048	3620	msedge.exe	97
PID 3620 wrote to memory of 5048	3620	msedge.exe	97
PID 3620 wrote to memory of 5048	3620	msedge.exe	97
PID 3620 wrote to memory of 4120	3620	msedge.exe	100
PID 3620 wrote to memory of 4476	3620	msedge.exe	101
PID 3620 wrote to memory of 4120	3620	msedge.exe	100
PID 3620 wrote to memory of 4476	3620	msedge.exe	101
PID 3620 wrote to memory of 1844	3620	msedge.exe	104
PID 3620 wrote to memory of 3396	3620	msedge.exe	112
PID 3620 wrote to memory of 3396	3620	msedge.exe	112
PID 3620 wrote to memory of 3396	3620	msedge.exe	112
PID 3620 wrote to memory of 5316	3620	msedge.exe	117
PID 3620 wrote to memory of 5324	3620	msedge.exe	118
PID 3620 wrote to memory of 5332	3620	msedge.exe	119
PID 3620 wrote to memory of 5460	3620	msedge.exe	120
PID 3620 wrote to memory of 5460	3620	msedge.exe	120
PID 3620 wrote to memory of 5460	3620	msedge.exe	120
PID 3620 wrote to memory of 5556	3620	msedge.exe	122
PID 3620 wrote to memory of 5572	3620	msedge.exe	123
PID 3620 wrote to memory of 5572	3620	msedge.exe	123
PID 3620 wrote to memory of 5572	3620	msedge.exe	123
PID 3620 wrote to memory of 5584	3620	msedge.exe	124
PID 3620 wrote to memory of 5584	3620	msedge.exe	124
PID 3620 wrote to memory of 5584	3620	msedge.exe	124
PID 3620 wrote to memory of 5968	3620	msedge.exe	125
PID 3620 wrote to memory of 5968	3620	msedge.exe	125
PID 3620 wrote to memory of 5968	3620	msedge.exe	125
PID 3620 wrote to memory of 5880	3620	msedge.exe	131
PID 3620 wrote to memory of 5880	3620	msedge.exe	131
PID 3620 wrote to memory of 5272	3620	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.buzzfond.com/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,15358873651713584897,14824139136961321918,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16357931357254412103,12126073423922999730,262144 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1621975169829629057,14088591480098573682,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,17759784728646538690,16016455014252529531,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,4124871177387945535,9936853709874022934,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,4107924847736091296,14452771455766952335,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16113998444395182504,506529039588182020,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,6868115772304112688,9272752783552261603,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5316,i,6878300283449639778,5244917442752065223,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5080,i,1947898426247933393,12252592757251730024,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16364753085005887977,633557862463715728,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2422114067807083194,7059569524956199052,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5272909072449567207,16388877369012724499,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5272909072449567207,16388877369012724499,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6760,i,5966964389610583510,17225023524339573059,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,1599267344658525648,11046168661169899952,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,1220904817361333034,3403612420560730707,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,4181419546608877714,143466673086569909,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4240,i,2390401334828494331,11046802630964607714,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8111543457797035370,4381200910742775734,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8111543457797035370,4381200910742775734,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6888,i,11795756674491998314,14281539765275747188,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4400,i,4263741276514873820,18007008096119317430,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7028,i,2380071459360062130,499910601317675867,2097152 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,885415091664874762,5054784695453691257,524288 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,11194435411725756467,4248651969273765059,262144 --field-trial-handle=2184,i,7894180983556165872,973419926915895392,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

a0d477b7a1fdbce3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a0d477b7a1fdbce3_0
Size 282B
SHA256 b4f37dccf9ca8048485ef7f907392b9a398bb86c4e042ccf1dd5f070ee9ec0d5
MD5 b4deac166ba9dfa0c105536ef7c9f2c4
SHA1 9a376eb9608a49565b4c6494a6b51d33c0aeae00
SHA512 279f2fef77e9630278f013c9d9689299a587fb1cb3bde1978f470dd03c0776b4e531da30f495b6a6c3e9827184821a738ec67a396ca7164959ed5264eacc75a7
TLSH
T160D0957B45989C54D7145BF197FF8383D15141934FBC41CD8844D1F7AB181D312C4E01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bb510412d4a0927c391782599c75af31b930f3b5a6a01c8f8d8ab2d3a9107936
MD5 49018d51d909da08efb039da13505336
SHA1 496f28b3e273885eb61f4f2760ea36d529dd9c56
SHA512 112105dea9c98c5c7bf8311f4c9713177c7727ff907f2b3bf859a7cbbfb8945c67539a756a42fb8a04c7d9336d24c2cb9512d66462cf477d3feb3ae8688cd095
SSDEEP 48:RuNLYROir+/lmPCyA5Sd5BekrdqkB5p9D0jWd0GtpsheQwrf7/:Ru6IT/Y1A5SN3qAp9APtxWb
TLSH
T10691A5BA19EB2A55DB12F6721AD10286F23085DBF11B9E9B0D80DBFA2C173E27D46144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ea6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ea6b.TMP
Size 3KB
SHA256 8f9a726d549573eafa6360f71709685f20452b067dc4da05fb12c34242fcceb1
MD5 54681fee67665a55d0378c940f0ff257
SHA1 7e03aed653235ea68f7ce82b606a9fd2f1c4f546
SHA512 bda16ab82768f466da5953a0b9f51efad0c6be766297460ee3b37095dbd359e992208a58367cdc6ced9ab083f6d44d1ae69c64985a3747b8639f0c952a920b69
TLSH
T193716EFE18E30FA5EB21F2705AC10242B13085EBF513ED234D80C7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 74cef12af4d0143ce28e0ce58c845806da36ed07a06f798863e26c7a6aa4509f
MD5 1f2be9e4fb7b95a25405de5900226b6e
SHA1 8afd8dc4bd1ecd364c330850a62aa0edd4beeafc
SHA512 58a56439ce091b34e6da865ec34e044a9e17395f2eafb5b1d52565d14ff119a88f97706d06c87b34178eca51022a4a89fa2511ebfbb5293a98339c896feeaf15
SSDEEP 384:DxpjlVG2eZ21MgT7BeQJXxPmJNE9OGnpqoR3dtT+Rr3VDR3o442MlapjE+voRRab:LhyUwmr6
TLSH
T1AA428DE7D7F5956D8C26A2F07A762F1FCD1A0D1992183D2A89D89F0BD3E1031D60294F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 978e6e3a034aec3f069fc8c6f35a4314d33899d8ec4dd50d23f5a0ace59dfa4e
MD5 5e10bcb0e1e8193dc4ed2fa3fa215b52
SHA1 71f83196cb29744c102cd9b7a4dff9296f2f057f
SHA512 5a915c1c41c0aaa9110bb58ad3e77855912804d60c5f71515e2d6652aa459317277917c2c37f279c1cc07d0229c10d15721ba00807839d900a533e8510c3e15f
SSDEEP 192:sxZgRbk4/fIsdpSxIdphWqHW6+WNsrX/YILaEFIgrJ:sxZg64/fIsLS67HbI/N9
TLSH
T17622D9126E38A97B4CC7E219BA15BF53E6F5103191D01E5CE6FCD51C19E7ADE220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1f9fdc9d90e7ce069ab49a78a33aa8874c86b56320ee9e892c7531b71cbe7354
MD5 6894dbfa0cf5bb5347577c809c1870de
SHA1 8e0a6e19df4e78958347f61dabc6c66213f38a1c
SHA512 c764ff81259221b6841c63e54ca8e11215a5ef43f552b7bd1ebcf518a0f1b5ef43cb62eadcfc4c5030d32c74d1b33b394c39e6b430b47c12714b61041afc614e
SSDEEP 192:sxZgRbk4/fIshpSxIdphWqHW6+WNsvmOXYI/maEFIg5YJ:sxZg64/fIsvS67HboHX1OO
TLSH
T1A222C8126E38A97B8CC7D219BA14BF53E6F5103191D01E5CEAFC951C19E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 646bf2bc40f8a0c178ea0d1cbb3c666339eca828b144e6ef263854a0a1f93ce8
MD5 c7c8b7e3b04902a72bc11ee8788041cd
SHA1 b17e25a8230bfbd597df5b440efcfe2ff0676812
SHA512 5d172c67d2436d3a974b0b61d5ac0c8c70134dfb1f085a0cb78e63d5d2a2a81e36be5638eafdc07afdaea06e975523b35c1e40dbb428afc24c7e7fcc7d675048
SSDEEP 192:sxZgRbk4/fIshpNWoIdphW3HW6+WNsvmOXYI/vOEFIg56J:sxZg64/fIsvNWZeHboHX1/8
TLSH
T16A32C9126E2869778CC7E20DBA15BF53E6F5103195D11E5CEAFCDA1C19E7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c5970d802943d5e02f97570b0cc45a7c4944cc7cf955d8fab016dfd203931db1
MD5 611371cb31035c5af461932030feb82d
SHA1 606e3be1d849bf0b205301cd5b55f121fa49369a
SHA512 cdedb57b4a2a46561947390eb461410c1ce7f4970e2d847097554aa8e57e8679a51fba5e483d4b90c1d18753fe081a2150876c06770a56eb710325106d3c83dc
SSDEEP 768:q5yqbblWvJDbT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7xroTpho:q5yqbblWvJDbTu1jah4LAs7KTY
TLSH
T103C20A3B654CCA7E4FC00AADDD5A6FDB3E9802C7A6588D4047FA994C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e50dfef6e60ff2237c6410378910e1f94d84f415d53b40e85736f31e1761169d
MD5 a50add0b31cee68c24347fe721ff1565
SHA1 6fa53aeac37a3291df450ed4bf2d5016da22ae5e
SHA512 ce5598f73282fbeb31d021f002ee47d6761458842a76b19edd7797bf7c0864a5ec540c462ca55872fa826d1b56b404677b23d788fbbafdd877b5f23a2b2cc28e
TLSH
T1C1A00215119C0497C245427D94511DD4B2709850811523ED40B40875C8511415722414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58df9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58df9d.TMP
Size 48B
SHA256 234fe7cf57bc0c034259db6538807a60d4928c616db4b2d2d2bae54aeb568d19
MD5 e0c219bb44a52e00782fb259b1c756ee
SHA1 e342030b0c2301430e03584e237962a68a1a51f9
SHA512 7d33b89e3165965c26bd269afee505d16a75c6e1e2830356d61db3b6027e8d8ccbacb62db5847f656e0a2b1d010fd1ada6a6729834d93249fe174d6de037f7b5
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59012f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59012f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 785cb23d5aeb3eaaa29a2dd0f28e526ca7158c7c615b60f83cd982019d45dd9d
MD5 0c0ae990f0267554798a68b09d5237d3
SHA1 5e8e9c298e4a8ecc76d9ab011f98c3e1d3861c6f
SHA512 9f3af726ca1e287bb6f5f0e6783a4dcec1321b0e0f750711d6edad2c9eb4617c0faea972ff7e0402c3c4611867367ab27dc159d0731284e0d156bae742fd58b0
SSDEEP 384:fZcIhsNMXOvbfV0VRN3OKZ9Q29nTKwBODNZOCBW9:3hgKH3Om959newBKZOkW9
TLSH
T151928D75AC381C728EF6B545F94B32074EF89073E6C42B9895EDAF1C01DAA98130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1a9d6e4c68a0b53cfde48314f5867481ed42147d9561421e6ab2e47b231a1424
MD5 393fabbca234c1c5dde13407ec49e72f
SHA1 5a1f7a313e06d38a9f7f37c72c34888de94370f4
SHA512 d6643bf9d2a14feead1734d9222c935e6a32b1e2a5e747ff0cceb28e434b5d8b71f227a649baa2961f3b083b24090cb8f12fda565a02b98d265ba1285508d8c6
SSDEEP 384:xiFiZcI3XzsNE8TUNTUlIlaOvbfK0VRN3OKZ9Qh9nTKwBODNZOCBW9:YFQ3D5wg6KH3Om9c9newBKZOkW9
TLSH
T1C9D24AF258EB4876D9AE5B47A77E2D034EBCC063F5846A54B3985A0CDD961BFC30AC10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9293ab98703b3b791042e0901ce8f610735f89bf6e4438abbdd47cb17b474480
MD5 fada4ad1c5fd7026821f04292f8d5f53
SHA1 78f28867e8f62ab8a38822a8e3d4b75616197760
SHA512 06a0d9a6e30028766fa88aa9d9f01541d31d539f4caa3ff6f1a4ec9387da96cc5ca3c39fd3ba8ee029ca753ebdc33ff1f79780a6186896560d769d4c0dd94c2d
SSDEEP 192:tONK6JkRtQmiUycAW+RN3OmNOmFHh3kROFU6:tONK6UrQW+RN3OKBpRU6
TLSH
T10002E935BD382C778EF2AD09B98B27175FA8206BE9952F84DAD81B1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 932c6852913e8261e74a155cd342ed293b2643498e57a128962d8cd446b8660f
MD5 075d09497ff97eace6405fd57164321f
SHA1 b69049edd097f012e0360eb72040d33ef3e503e2
SHA512 4f816a869ee761e12d84312d650f46d42665096470bbc4b95342f58455cf411b75885ec559b848363237a7d5edf2a3cea5d3c4c4e4c2013fa875d128e7d90a14
SSDEEP 384:NZcIhsNMaOvbfV0VRN3OKZ9Q29nTKwBODNZOCBW9:VhfKH3Om959newBKZOkW9
TLSH
T1DC928D756C381C728EF6B545F94B32178EF89073E6C82B9895EDAF1C01DAA8C131BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb793523ae4625bb527e46cc7a61633cef731dd5db68b8eb24cd34f9b6bd1990
MD5 c963e2bef3b4ede8d90cf11c1f5d7114
SHA1 5f0117974b655ba47f9d6b8db845f7bc379813c3
SHA512 ff6ac25bb4af6d288e84dc2ce1f74bf1f83184464c32e2bc6fecd783c404298c32397215241f907dbd4705fd42716b3f58fcda21a9fa05587135f30e216ed544
SSDEEP 192:NONd6JkR5QmiUyhAU+RN3OmNOmSC9QjMbVcTqcVU6:NONd6UXXU+RN3OKZ9Qp9U6
TLSH
T1F8121A36BD386C774EE2A845F58732174EA85127EA896F94D5DC2F1C02DFA9C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 34b787f4ac3c93d17175bc45950f7c061078e3cc081abd43384740b6eca14fa4
MD5 35ce2d5d0758cc3b5f1ed88849324e75
SHA1 c5801191af334f4fa5d3c502bbd01402ca798752
SHA512 6c5cc63bcfb581ac6387755a6bd7ba558fb956e35257d89fe9a9a06eb7f2254eefb4b7f173673b209dba8a1d39924c583174055dce15496ab33c1e85f6b7eb4a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe598f07.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598f07.TMP
Size 392B
SHA256 20efdda1682def6431037d074f9f7990c1faf55c43aa4554dbc0ba91b0babadb
MD5 b1d157441f2cb12397fb68c7373023fa
SHA1 6a61266163e61f7df7d97a3ed5618f1d81290ac4
SHA512 521215c8a3b81a2284d3b446f89590ef63dfeb5e77c5980da0b6792e648edf636a5ad9797d167d2bcef432b254d6a4ad84d5b0d02b379bf5cbd36785cff61462
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3508d528e9a0a931f6aec3302c2d5d515cc6d0ba12d2d28cca3c451dddba3013
MD5 f18e8f0aa140f24afe8262f60ac8fe8a
SHA1 dffd6a925aaeaa422f16cf287bb0b4ff75d8b6a9
SHA512 543271e6595f810beabfd53752f5cbdcc087f0359a99bc90a85326bbf4f5da46ae8e9aad392f717da46a37406532d6449041e674befe46f19804065e765a9c70
TLSH
T1F941065DA6ED1148B3B36F5AABF7A8AE447FBD372E16955E00110D4F0A22A41C872733
MD5 SHA1 SHA512 TLSH

Submit Download