hxxps://free[.]17[.]dl[.]wsfiles[.]cz/8258/s7ORtfcLam/300000/eJwdT01LxDAQ_SthDotCbZM2TdrCIggeROnKingpSNqkGIzNkqQWVvzvzsowlzfvY94PKOigYnlFcyZqXAEZWOhoBgk6JpuaN7KlMoPvf3CFblmdyyDiNYMTdLNy0WSwoM_x5iWt2nrS5JTcrdZpwgSvJSO9SZsPn%20Re22T9Qq4elpiUc2RHnn1IanTmOj_bE4ZrNJpYqamQuh1HRjkdlVCV1I2gZTnrUpcN5y2dWXWh45swW2fetd8W55VGMCC2mTF%20qGDy6TwUF8JQRHk4pnl6Ul9DcWtC8GH_2j_2h7d%205_coS6hLYcU28Yz1So4jWvn7BztNVHk/eae36f7bc0b4f1b0c3b9dce75d73e8c393fa7e44/R-Studio-8[.]0-Build-164571-Network-Edition-Install--Portable[.]zip

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://free.17.dl.wsfiles.cz/8258/s7ORtfcLam/300000/eJwdT01LxDAQ_SthDotCbZM2TdrCIggeROnKingpSNqkGIzNkqQWVvzvzsowlzfvY94PKOigYnlFcyZqXAEZWOhoBgk6JpuaN7KlMoPvf3CFblmdyyDiNYMTdLNy0WSwoM_x5iWt2nrS5JTcrdZpwgSvJSO9SZsPn%20Re22T9Qq4elpiUc2RHnn1IanTmOj_bE4ZrNJpYqamQuh1HRjkdlVCV1I2gZTnrUpcN5y2dWXWh45swW2fetd8W55VGMCC2mTF%20qGDy6TwUF8JQRHk4pnl6Ul9DcWtC8GH_2j_2h7d%205_coS6hLYcU28Yz1So4jWvn7BztNVHk/eae36f7bc0b4f1b0c3b9dce75d73e8c393fa7e44/R-Studio-8.0-Build-164571-Network-Edition-Install--Portable.zip
Sample260809-ped7csem51

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3048	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307512670583908"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{0F4497B7-E4BE-4834-9C13-26F3D4EFF3D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 4276	5768	msedge.exe	87
PID 5768 wrote to memory of 3048	5768	msedge.exe	89
PID 5768 wrote to memory of 2616	5768	msedge.exe	90
PID 5768 wrote to memory of 2616	5768	msedge.exe	90
PID 5768 wrote to memory of 2616	5768	msedge.exe	90
PID 5768 wrote to memory of 2456	5768	msedge.exe	91
PID 5768 wrote to memory of 2456	5768	msedge.exe	91
PID 5768 wrote to memory of 4924	5768	msedge.exe	93
PID 5768 wrote to memory of 4924	5768	msedge.exe	93
PID 5768 wrote to memory of 4924	5768	msedge.exe	93
PID 5768 wrote to memory of 2168	5768	msedge.exe	94
PID 5768 wrote to memory of 2168	5768	msedge.exe	94
PID 5768 wrote to memory of 2168	5768	msedge.exe	94
PID 5768 wrote to memory of 4496	5768	msedge.exe	95
PID 5768 wrote to memory of 4496	5768	msedge.exe	95
PID 5768 wrote to memory of 4496	5768	msedge.exe	95
PID 5768 wrote to memory of 2820	5768	msedge.exe	96
PID 5768 wrote to memory of 2820	5768	msedge.exe	96
PID 5768 wrote to memory of 2820	5768	msedge.exe	96
PID 5768 wrote to memory of 4136	5768	msedge.exe	97
PID 5768 wrote to memory of 4136	5768	msedge.exe	97
PID 5768 wrote to memory of 4136	5768	msedge.exe	97
PID 5768 wrote to memory of 4244	5768	msedge.exe	99
PID 5768 wrote to memory of 5880	5768	msedge.exe	100
PID 5768 wrote to memory of 4244	5768	msedge.exe	99
PID 5768 wrote to memory of 5880	5768	msedge.exe	100
PID 5768 wrote to memory of 5560	5768	msedge.exe	102
PID 5768 wrote to memory of 3556	5768	msedge.exe	106
PID 5768 wrote to memory of 3556	5768	msedge.exe	106
PID 5768 wrote to memory of 3556	5768	msedge.exe	106
PID 5768 wrote to memory of 3476	5768	msedge.exe	107
PID 5768 wrote to memory of 3476	5768	msedge.exe	107
PID 5768 wrote to memory of 3476	5768	msedge.exe	107
PID 5768 wrote to memory of 1148	5768	msedge.exe	109
PID 5768 wrote to memory of 5804	5768	msedge.exe	111
PID 5768 wrote to memory of 5632	5768	msedge.exe	112
PID 5768 wrote to memory of 5084	5768	msedge.exe	113
PID 5768 wrote to memory of 4592	5768	msedge.exe	114
PID 5768 wrote to memory of 4592	5768	msedge.exe	114
PID 5768 wrote to memory of 4592	5768	msedge.exe	114
PID 5768 wrote to memory of 5844	5768	msedge.exe	116
PID 5768 wrote to memory of 2836	5768	msedge.exe	117
PID 5768 wrote to memory of 2836	5768	msedge.exe	117
PID 5768 wrote to memory of 2836	5768	msedge.exe	117
PID 5768 wrote to memory of 2040	5768	msedge.exe	118
PID 5768 wrote to memory of 2040	5768	msedge.exe	118
PID 5768 wrote to memory of 4136	5768	msedge.exe	119
PID 5768 wrote to memory of 4136	5768	msedge.exe	119
PID 5768 wrote to memory of 4136	5768	msedge.exe	119
PID 5768 wrote to memory of 4920	5768	msedge.exe	120
PID 5768 wrote to memory of 4920	5768	msedge.exe	120
PID 5768 wrote to memory of 3424	5768	msedge.exe	121
PID 5768 wrote to memory of 3424	5768	msedge.exe	121
PID 5768 wrote to memory of 4072	5768	msedge.exe	122
PID 5768 wrote to memory of 4072	5768	msedge.exe	122
PID 5768 wrote to memory of 2164	5768	msedge.exe	123
PID 5768 wrote to memory of 2164	5768	msedge.exe	123
PID 5768 wrote to memory of 3312	5768	msedge.exe	124
PID 5768 wrote to memory of 3312	5768	msedge.exe	124
PID 5768 wrote to memory of 4920	5768	msedge.exe	126
PID 5768 wrote to memory of 4920	5768	msedge.exe	126
PID 5768 wrote to memory of 1036	5768	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://free.17.dl.wsfiles.cz/8258/s7ORtfcLam/300000/eJwdT01LxDAQ_SthDotCbZM2TdrCIggeROnKingpSNqkGIzNkqQWVvzvzsowlzfvY94PKOigYnlFcyZqXAEZWOhoBgk6JpuaN7KlMoPvf3CFblmdyyDiNYMTdLNy0WSwoM_x5iWt2nrS5JTcrdZpwgSvJSO9SZsPn%20Re22T9Qq4elpiUc2RHnn1IanTmOj_bE4ZrNJpYqamQuh1HRjkdlVCV1I2gZTnrUpcN5y2dWXWh45swW2fetd8W55VGMCC2mTF%20qGDy6TwUF8JQRHk4pnl6Ul9DcWtC8GH_2j_2h7d%205_coS6hLYcU28Yz1So4jWvn7BztNVHk/eae36f7bc0b4f1b0c3b9dce75d73e8c393fa7e44/R-Studio-8.0-Build-164571-Network-Edition-Install--Portable.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc76f1c188,0x7ffc76f1c194,0x7ffc76f1c1a0
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,18192517763385275330,9229591725452369590,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,13260378094361271206,6001724045838057184,262144 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,5868583707598923092,14884015281143912185,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,9992603241486954219,8086342970709176590,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2218277783169534080,7431873826786424685,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,14780635802114284940,2994255604995918537,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,5760216858942963937,6066680977174340573,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5396,i,7665374986296194939,3391141355098120756,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,11588405959021760094,7286778633326417720,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,7471700179666085465,855766248067588090,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=1572 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,471822912965312254,16148925962103195886,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,471822912965312254,16148925962103195886,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5060,i,7217599742951632847,9018880000967233527,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4060,i,14505191808980396398,1432157763604611363,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14192647386645746296,7911728811705522492,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14192647386645746296,7911728811705522492,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,12853335644270894387,3075023886426170833,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,315938501123769346,14133252127372843252,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,10467889815640398433,3810960675628453178,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5680,i,10817710311250505856,534791675440569627,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,9651923615435215212,3910066748357969892,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,9651923615435215212,3910066748357969892,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3584,i,2318748116625656112,7538491139963543161,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,14318628592643193303,14739480272300004795,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6932,i,6257807400679498429,11153199587825924171,2097152 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,17990842640173531978,11537673797938478296,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,15421196565088884379,10806879508818614497,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,11480746776873238275,780014227361018553,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,18035985595411498878,4419823525050647647,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,10773042251213225130,15762581157698090901,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=836,i,17513258467829107011,13993613151093792490,524288 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,2475717020201058166,9863876784091509791,262144 --field-trial-handle=2528,i,5150532748296164762,16552554822127885115,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

6937663c-776d-4727-8124-9b4c64f884d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6937663c-776d-4727-8124-9b4c64f884d2.tmp
Size 18KB
SHA256 c8ff34f463cb04ed8c00dee073f99504f08d470b8ba3448c30dd74098a55677b
MD5 d6796bde93670729278fc93a32ff1114
SHA1 236f8ddef1d1aaffa06694d28597b897070cce26
SHA512 b0184e39cfce2683cccb1a35a9ffc370c531571dcfdbf64ad032aec7c090d200a188d659368ae38281349cb303dd067f11e377059d4d26e4c469976a5b33c153
SSDEEP 384:sxRoi/lH/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGH0sA7SU6C/54Z5SVtr:sMi/lH/f3jfW9RC8wAeHI7SUb/5g5SV5
TLSH
T13682DA069414ED378CC6A21EEA757E73E6F5522682C02E2CA9FCC70C40E7AFD615781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b5de224063d03ae98095c94d59816f4841b1af0318d43480bdcfbe5416239725
MD5 0bc3a91eeb75d2446c521a3692c11575
SHA1 044531b5b576e1512717df783d80c3d2ddc979a6
SHA512 6818421f3a392990ea5650c4d4e34c864cd6785fcefc0031afe410efa07124e82dd95d835bd63c45f066411484a6c6ebede4ac6a0aaec64fa094e2ceb621f178
TLSH
T1BD71B4512B2519F1DB6445BA92E1588AB6F0C5D54F0BFE15B506AC30C93AF293FD3023
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 812d65aa307b9994880b8bb3c4340bbebd69f476a0daf812bbb212927cc0b086
MD5 4fba12ac980573a3dd742e2b218d0e58
SHA1 bac8ed64cbbf0bd90ab588bad73ca0ae397df9b4
SHA512 d83d96274943ce6d2c2c8ba3c47535fb9b2021a86779ec51ea89d799faae1f72202bd86fe1bf7ef415a2994944f439c87e468f7ad131029dc562cf53c10bd0ed
TLSH
T1D171C5512B2519F1DB6845BA92E15889B6F0C4D54F0BFE11B416AC30CA3AF243FD3023
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0c36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0c36.TMP
Size 3KB
SHA256 4741037172188a14b1cccba15dd32666e34f992061ceee12cdd05393de3d3d89
MD5 d5ffc9f9fe03d6c5fa59b2584991ed6d
SHA1 3c62aed56289fe0c51eae9b9af67e9dc7a30fb87
SHA512 24bc918763364afaf6272cdf7bcf60dda6ce493f2118f0093e392ff77cee6ca9478d3c628fff480b63772738f4612c660dab0237d1ca19902b847714340682aa
TLSH
T1F761A2A12B6518F0EB6444BA96E05889BAF0C1E40F0BFE1174066C30C93AF243FD3123
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9b3d6c4ed6c57bead9f37388e33ce7c93d972d6d5a223bcc8dbd693be6b300fe
MD5 99f46e683d60e8ef159e33f002b4ca86
SHA1 cf1b97751978cff6d0fe94b6ca0d036e17381c7d
SHA512 8be29136b89cb1ca656a7286995a34ed7a21a25a389ecfc4b387dd8421cc9905df50117d2fdb926abaa957a2a5b2aff9cd920b48994b802fff4c717b5af2e859
TLSH
T1A481B2F3C7F4856EC90152F4A614AE1FCE1D0A15431C3C6AC9E4AF1BA3E2871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eeb1d8e5b55979e9d6235aa8f8b46ab7acc0ecd2e7308786c1dad9b5a9c05b93
MD5 c520c03e84b56dec534e3703d02094d2
SHA1 92d6bb54829a8b168877d5527c62bc0526815cd2
SHA512 77be13ffb3068a2c307f1080e0efb6b07f6227e94bf3e6786de0a2dd087c5121a817af4a5fd18b87128f51c03c06b932e60ddfe873a705a67715e5c68d1fd8a8
SSDEEP 192:sxRWiRkbl6/fn5msAjKCA94/FUbzoA8p6D/g6+WNqDpCXYD9Fl6SVgGfFIgD1J:sxRWiMl6/fn0sAjZ8yU6Q/5VXNSVtr
TLSH
T1A642B8566968A93B8CCBE21DBB15BF53E2F9503261D01E18A7FC961C04EB7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 26504b74ec1ea637e8285885aa11106dcf5ad30e38f81727e0e68053365f3492
MD5 5ac774d96a1237951b38217b2e9412d2
SHA1 9870eb5beef8fe03513eb7d4ac98e3d6946ab9d4
SHA512 ef3abd25c4292436463d01bf81ded7b3936311a69327dc802493660a14af7d614d502d08411dbe9c1153a874f3e86049a0ad0cce75705e573e30699df02eec86
SSDEEP 192:sxRWiRkbl6/fn5msAgKCA94/FUbzoA8p6D/g6+WNqDpCXYD9/l6SVgGfFIgDzJ:sxRWiMl6/fn0sAgZ8yU6Q/5VX7SVtB
TLSH
T17542C8166928A93B8CCBE21DBB15BF53D2F95032A1D01E18A7FC961C04EB7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7bc437f6aa97db8a4233b81d2454642a3ab7d37e040d48d8aac77c974b3e5ad5
MD5 49637dd4740fa8ea3c9eecb3c0e70721
SHA1 619212b3f808c39113217919bcbd31f2dd06700b
SHA512 037b6cb551caff86427eb67d39cc2bf9c9ee0799545e076226da7208c8aa50227f12d5df44be6106d9d20a0dbe416332e8be5062f0e8dd228e034829877350cb
SSDEEP 192:sxRhiRkbl6/fn5msUgKCA94/FUbzoA8p6D/g6+WNqs6/YD9SV6SVgGfFIgIJ:sxRhiMl6/fn0sUgZ8yU6Q/5s/CSVts
TLSH
T1D832B8166928A93B8CCBE21DBB56BF53D6F9503361D01E18A7FC961C04EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 173a13c70ac80a8f2375cbc8492e9f1e2bc5c972641b07bd01e723491f8aa528
MD5 7f940aec5a30c5653d10a4fafabe9e4e
SHA1 8b10c4a737147247dc2d3a064228b83be878fabe
SHA512 dad24749d2facf101e0f5309f08a48f2ae106c4f4953f71d697904a403abdf9a4666dfc0d9721b15b15881b1184a1cfd9435a03cdb7f7b3375ac04779b221e02
SSDEEP 384:sxRoiMlH/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGH0sA7SU6Q/5VXNSVtr:sMiMlH/f3jfW9RC8wAeHI7SUx/5BNSV5
TLSH
T18782D9065414ED378CC6A61EEA757E73E6F5522682C02E2CA9FCC70C40E7AFD615781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 9bc802b50c5f3a04eb9bba61fcd828479d2e8c38204f098238b016b738c5d9ea
MD5 50a10b4e78e7e8554d9a5ada651b630b
SHA1 413074c192c8f04dc90488a5c3a45d61de0d6717
SHA512 dd4f97714a8c0c0f917faea32d72f524a616f624d7523db73a8ded15fc7debed9a16cba753518ace86f8bcb98ef52896bef3d1f92063bbb5b78327c2e1d00656
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRclNropo:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VX
TLSH
T1BCB2EA2F200CCB7E5F800A9DAD196FD77D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 94271d042183a1baaa55bfdd4a5fb9aacd7e4ec552ef26da8ec646208f43851a
MD5 6df49a9fde0add7a092e053cca649a06
SHA1 c15532a2f73e04943c9f40ac157abc3f2845365b
SHA512 4ca0cae44b8aebc32af870fb6176888844dcd5d3252b256e8e03ce43449f97c3eee462361f801f68482dae0d609564a00290f7be668d4ff6bc72834491f44734
SSDEEP 768:aH9nfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaac16lNrop4cuPxE:aH9nfWR0Wg/XfHfu1jaTay6lmp4cd
TLSH
T184C20B3F204DCB7E5F800A9DAC26AFD77DA802C797588D5047F9994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 89df55f94027009dea9e05d89815cecfdca932efbd4e6be51492dce700d97f33
MD5 71b449e9406e66a6d65c5b0078a2f2a8
SHA1 48ff922a3bc21e5e2ae1da6f35ecc746aeec148e
SHA512 c41a9af6e25eaf44a05a5bd2d52d3f46abfec96c22b2df3eebd8038cd876684ac43d429a98e99db258fa0db601672a6937edaafacc4a403190cccf107cb70134
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHS3eyEkUyW8pBgiyK43gYyciKxQlkYKx6j:C2r6WwYYZo9m22Lgkte2VUGfHS3eyEkN
TLSH
T16291C842717F83807C7EA91C8178CC1EC68274B23019B66B7BA901A21F66E135EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9d9b3984accc41dfeadb560a51e9f88950eba25b81b206d94f75edf082944720
MD5 6816ca9b712dce07924099a0fd7b53bd
SHA1 7364bd543c07ceef88a2e8b86f5b268e53e68709
SHA512 0ac67cd4ed512fc194fd8bf5b077381f62c0fd7299514e2ecdcd3db6f6dc2d2971675da21424a875b44961093f21df6422f8cd2b3a9b60602c9df0672acc8e9d
SSDEEP 768:96X3S1/4XsOi03PprEnjN3Gac1FN2ewBKZOKW6:96X3S1/4csfpQnjMaq2evZpj
TLSH
T1C3F2AE756C789DB38CEAE386B5437603AEF04663D5D80AA49ADDBB0C11D75AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f99dc57148317474a1c406452d22c83539907d8d61f1aa886929b745296190d4
MD5 27a25ff9e7e25e3fc212796e0928a049
SHA1 2c76d008a9d39cbf77ec42d4c2e20b6454a53a4f
SHA512 da88ac1e7078506774f1ecd11264c4ad264246984de991556969599df44151cf87e50afe056c30bb17f5a14a6373478c8e145a8b5538290e673e5f4a02b19b7b
SSDEEP 768:9623SE/hXsiHi03PtrEnjN3Gac1FN2ewBKZOKW6:9623SE/hckftQnjMaq2evZpj
TLSH
T1B7F2AE756C689DB38CEAE386B5437603AEF0466395D80AA49ADDBB0C11D75AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 809804c02b5f7902621b9d3d879470dbf2a13c28b2b2bbb00ec34e870bcfcf9a
MD5 3ead1849724d5bcfbde108f6fba78bed
SHA1 ce41c0fb80cc762eabaabee4e5918b0af9ee1b41
SHA512 5d69a27dfa4dfe23ccf4aa7e430eef38425a64a5a13d0b5811b56cdb620712053cc5fca029de0fc9d882b2836137d4d5333670b41b2e9bbfe6834b2d2c8f7807
SSDEEP 768:6ZP3SE/tXsiHi03P4rEnjN3Gac1FN2ewBKZOKW6:6ZP3SE/tckf4QnjMaq2evZpj
TLSH
T193136BF428E79873C8DEA347673E6E025DBCC253B5840A6477C9660CCD965BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8f0c5ffdf654c2d56a5f45ca831fe7dbf6cb7d1b3086b3a8f814414b96803bc6
MD5 1d442ec57d640fc534d78b1e478b9830
SHA1 4b68fd0d201f42bc939416a61c6043fa5f9fcbe9
SHA512 d997486219413d7f10017002e52e522408df0d6ee27dc80b6993b30300c4673f2b3aa58a610c64305d6b3ca990f3501753fe0234369ba427cdc573b7e20ad2f2
SSDEEP 768:i6v3SE/EXsiHi03PtrEnjN3Gac1FN2ewBKZOKW6:i6v3SE/EckftQnjMaq2evZpj
TLSH
T165F2BE746C789DB38CEAE385B5437603AEF04663D5D80AA49ADDBB0C11D75AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5abe440ac481d51466910f85b7f1f2b9081257b86bf3b4084070e622c85cd291
MD5 41f507ac25f416720d71fcf8ffde85ea
SHA1 128354ad8b9917667759a88587d00116472d8e49
SHA512 d083c9a7f8cc8330ec869f5f9c2f1a087fd58ff83154bf39f253e8512b3677e7a96e4350c5afa08a31ef1adaf65e8a4acd755cd9362f1081a0161b73017a9b15
SSDEEP 768:NMrv+4UNbdS3JXqsEi03PJrEnjN3Gac1oNeVH1SCz:NMbsbg3JXPqfJQnjMaNEH1V
TLSH
T1CC03BE3169B89AB39CE79385B087BA037FB4565386940BA0C9CD7B0D06DB4EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4b6dc6a195ac2764909dcccf2dda7c3d0cb85f6dcc801fb698e05a1bcaad3547
MD5 20da76fcc829f95c037071a3f3da7758
SHA1 18ace6e80e99025a483a4d13bc4c3fabc9c7a193
SHA512 0db70828fbd1099776c0d8e93f5ecde09ddd6057a6d8773b6abb5163122b961a63b3235db246fe62d077d2334fc85a80348845a7d7c25a3cdb0f7d5579236d20
SSDEEP 768:rrv+4UNbdS3wmi03FrEnjN3Gac1ZoeVH1SCz:rbsbg3n1QnjMaTEH1V
TLSH
T1D803CF3169A89EB39CEBE38571837A037EB4525385940BE4CADD6B0D02DB5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 416df007f763a60e8d773a3e8fe66cd53145aa56845e17ff9707268eac1409fd
MD5 cbfe7bcd8f22a59aa7ae67f94fd6c38a
SHA1 4b6b20e60fc770420fbb56758e181587e6cc6411
SHA512 911cbe2d129ee393b37db1beb613ef8b29b0cef53414fdd4d5b62573acfe1245682fc2c542c31d28c9c6a3dac5c48d8dee951add77c7334e0f03c9c505a170a6
SSDEEP 768:i643SE/YXsiHi03PtrEnjN3Gac1FN2ewBKZOKW6:i643SE/YckftQnjMaq2evZpj
TLSH
T1A4F2BE746C789DB38CEAE385B5437603AEF04653D5D80AA49ADDBB0C11D75AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29933e00-e97a-4339-b1aa-95ea72cdcf78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\29933e00-e97a-4339-b1aa-95ea72cdcf78.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

eccb78b8-3764-4bff-a0f0-9990ee96542e.tmp

Path C:\Users\Admin\AppData\Local\Temp\eccb78b8-3764-4bff-a0f0-9990ee96542e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download