hxxps://www[.]foundation[.]game/en/exploration

Analysis

user interaction
yes
max time kernel
110s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.foundation.game/en/exploration
Sample260809-pkd4jsxflf

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
256	1920	powershell.exe
257	1920	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
257	1920	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307517930399581"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F390E986-F5A0-4D3D-94DD-6D7706C69290}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 3400	3504	msedge.exe	85
PID 3504 wrote to memory of 2052	3504	msedge.exe	86
PID 3504 wrote to memory of 3300	3504	msedge.exe	87
PID 3504 wrote to memory of 2052	3504	msedge.exe	86
PID 3504 wrote to memory of 2052	3504	msedge.exe	86
PID 3504 wrote to memory of 392	3504	msedge.exe	88
PID 3504 wrote to memory of 392	3504	msedge.exe	88
PID 3504 wrote to memory of 1600	3504	msedge.exe	90
PID 3504 wrote to memory of 4320	3504	msedge.exe	91
PID 3504 wrote to memory of 1600	3504	msedge.exe	90
PID 3504 wrote to memory of 1600	3504	msedge.exe	90
PID 3504 wrote to memory of 4320	3504	msedge.exe	91
PID 3504 wrote to memory of 4320	3504	msedge.exe	91
PID 3504 wrote to memory of 4628	3504	msedge.exe	92
PID 3504 wrote to memory of 4620	3504	msedge.exe	93
PID 3504 wrote to memory of 4628	3504	msedge.exe	92
PID 3504 wrote to memory of 4628	3504	msedge.exe	92
PID 3504 wrote to memory of 4620	3504	msedge.exe	93
PID 3504 wrote to memory of 4620	3504	msedge.exe	93
PID 3504 wrote to memory of 3800	3504	msedge.exe	97
PID 3504 wrote to memory of 3800	3504	msedge.exe	97
PID 3504 wrote to memory of 3800	3504	msedge.exe	97
PID 3504 wrote to memory of 5060	3504	msedge.exe	98
PID 3504 wrote to memory of 1332	3504	msedge.exe	99
PID 3504 wrote to memory of 5060	3504	msedge.exe	98
PID 3504 wrote to memory of 1332	3504	msedge.exe	99
PID 3504 wrote to memory of 3000	3504	msedge.exe	102
PID 3504 wrote to memory of 4368	3504	msedge.exe	103
PID 3504 wrote to memory of 4368	3504	msedge.exe	103
PID 3504 wrote to memory of 3968	3504	msedge.exe	104
PID 3504 wrote to memory of 3968	3504	msedge.exe	104
PID 3504 wrote to memory of 3820	3504	msedge.exe	105
PID 3504 wrote to memory of 3820	3504	msedge.exe	105
PID 3504 wrote to memory of 3820	3504	msedge.exe	105
PID 3504 wrote to memory of 4448	3504	msedge.exe	106
PID 3504 wrote to memory of 4448	3504	msedge.exe	106
PID 3504 wrote to memory of 4448	3504	msedge.exe	106
PID 3504 wrote to memory of 4384	3504	msedge.exe	107
PID 3504 wrote to memory of 4384	3504	msedge.exe	107
PID 3504 wrote to memory of 4384	3504	msedge.exe	107
PID 3504 wrote to memory of 2780	3504	msedge.exe	108
PID 3504 wrote to memory of 2780	3504	msedge.exe	108
PID 3504 wrote to memory of 2780	3504	msedge.exe	108
PID 3504 wrote to memory of 1504	3504	msedge.exe	109
PID 3504 wrote to memory of 1504	3504	msedge.exe	109
PID 3504 wrote to memory of 1504	3504	msedge.exe	109
PID 3504 wrote to memory of 2684	3504	msedge.exe	114
PID 3504 wrote to memory of 684	3504	msedge.exe	115
PID 3504 wrote to memory of 1888	3504	msedge.exe	116
PID 3504 wrote to memory of 5984	3504	msedge.exe	125
PID 3504 wrote to memory of 5984	3504	msedge.exe	125
PID 3504 wrote to memory of 944	3504	msedge.exe	127
PID 3504 wrote to memory of 944	3504	msedge.exe	127
PID 1920 wrote to memory of 1112	1920	powershell.exe	131
PID 1112 wrote to memory of 1776	1112	csc.exe	132
PID 1920 wrote to memory of 2852	1920	powershell.exe	51
PID 3504 wrote to memory of 216	3504	msedge.exe	134
PID 3504 wrote to memory of 216	3504	msedge.exe	134
PID 3504 wrote to memory of 216	3504	msedge.exe	134
PID 3504 wrote to memory of 2796	3504	msedge.exe	135
PID 3504 wrote to memory of 2796	3504	msedge.exe	135
PID 3504 wrote to memory of 2796	3504	msedge.exe	135
PID 3504 wrote to memory of 4848	3504	msedge.exe	136
PID 3504 wrote to memory of 4848	3504	msedge.exe	136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.foundation.game/en/exploration
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3991256403829835112,10401741909737659033,262144 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,10123547347908066492,2862104825745487308,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,7387113695984653587,5803214334240580161,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,14575283753754308201,11002724241371125990,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14476108960948597490,11762262587460961242,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5749182048087288606,5771946592787991987,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,6513924684968644431,12761254710338826842,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5040,i,4080178712459083037,15019709905308994711,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,2058463261783159376,10853306208051504945,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,10334723003951248529,6279753055682212331,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,14677640413704670451,11017405900238175524,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,14677640413704670451,11017405900238175524,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,8728863265558953758,15642817323088041405,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,7980674660926197506,5678932652256287004,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6744,i,12885255791201270008,17116599039943090888,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6892,i,5929200703426014871,10396993747628262203,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3672,i,16857783431872918672,17266861990020696599,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6040,i,12856023707345789013,17613025067642031243,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4368,i,18292325548174367133,2737521648502292213,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9612300934247524089,17724894742665769979,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,9240208109886471963,15744243781244170900,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,9433339453898453980,8786763668831358362,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,14828869356836377437,5218337508605590681,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,5444807845006616605,15486959078012313504,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=2204,i,5657369088649758887,6043409142638124568,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3484,i,2390034059821578252,14126701321658301461,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4332,i,17566551720888872648,15431629921682209164,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7200,i,9211575973500196691,11622228452678103235,2097152 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,10303707239106859268,2508196791645425342,524288 --field-trial-handle=2344,i,5976256447035235303,608498227756789481,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:5920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zkaiwnkh\zkaiwnkh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3186.tmp" "c:\Users\Admin\AppData\Local\Temp\zkaiwnkh\CSC2733465C994746169C53B42838D7A982.TMP"
    3⤵
    PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 dcc96e29866eef84c6c5daf655fa68337144217f964bec2e91d09f8cb18eb5bf
MD5 636183f14d547010a29dc12e1cc908c7
SHA1 99f3e5ba93d94c068de3d1440a8e9dbd7cf31b20
SHA512 539d9757b3016edc8f2af86229be4635981d7444a14b91687df627033ab4282f6c7363e6c16c5776368507e68e2695b1c2fa96c12bd48b6d575b94b3c436e89e
TLSH
T18CF0468F47D0DFAD6A02928BB0A47B0A85D4B64AEFACD88D220C7A84650024192C5DE5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000e9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e9
Size 1024KB
SHA256 1ae7941cc74d09a711d9e18ba0b614a5bcb44855933217ab6fe7e35be84745b0
MD5 8929df82904e97b9f44018c418b41479
SHA1 f17cc396cd63a085f7cff120f454d829a0f324a1
SHA512 71a8038dedb0099645b8ce126f01bc1253c5c07848d77974f807240ee2dbcf373777b1446e53ec5969f068ffe4ea86bc21e5df0c0b9b36d3019a73d40b3f8952
SSDEEP 24576:ufQj8tJVmrg2QFb34DjUsSI3kWuTW3SaXmVZgorYWQUnh:ytvmrVQFbEjUztWoZhrYWHnh
TLSH
T11D253366FD2CDC5C1D053197FE369B29E2C06EA8ECCC27FE0063729675A805179D92CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f2
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 2ea9b302b2051e58d5db37e3503d9c1db71a2f7c02a541cf7b9f9b98772ef3f9
MD5 4d7f3df01d159e8fcf489ef68ee8602d
SHA1 2b04d97f16b59a0428d306c1ed109f5baa62b3ec
SHA512 fd401762e0b38157fcb34897e3473b9da7584ef71eb453d3d2c2e218d7a4f795e32a95e3b93ecf3575d63806f4e86a364e4b1ebd66f838e9cdb0250b24cf0453
SSDEEP 96:NNDEizmlfjpQ+4Tjd+TY8nSpRYWOZYxByBzj/89tKk9X+vfAAyqHNCD8Wu:f3Cl7p4ETYbYG7m/eVOHzy41
TLSH
T173F185D00EC56899FF6238B3C2B339717A6490A70E13AE47C6D19CBC2E97BF5570A844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8450e6cff779f1182669a28b5f7c3e721d6334953fc2b488400472acaebe4910
MD5 f8a7752378948931200cfa2866427af0
SHA1 b50bb24e826859262a548d0e7a4a40bdf72f67c2
SHA512 a57aae9267fb271a59da7425fcd8f156e00065a8ed258954c2851702a4f750a5f9cf41e7da5c596fd6c2ee71d6590531d70b6dd8424df3227dc40105c5cc8963
SSDEEP 96:8mivRpczjKTN3KlFByBz/AC89cTtKC/Ao5DDq8b+:8VppHT8lPpCeTEx4
TLSH
T1E5D160D102CA749AFF627932C2A37956B274C4C74E172F47CA159CBC6E83BF1970A818
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58db67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db67.TMP
Size 3KB
SHA256 21b5b616f124175b657111e6f5ca1a81a786fb65f884a8c687cf46d7a7756640
MD5 0ff758eaec4d403c1670718b79e7b794
SHA1 f6f9abbff0709aa9dcdb97c42e633776d6fd22cd
SHA512 5555ea56a855ce4e58bc607430fc3d29140738937fb00a6d87d25b1ef500eaefb52291067e769596f40366c8bb9ef199ddf34fa6f441f57ab673d343e88cfef2
TLSH
T1E17191D403C6759EF3A23973D2D232917770D1CA0E43BE490154A8FC9AD6BF5AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 8efac4c359f14735a31871546d3de198188ecddd561d34e5ee10189c07ca372b
MD5 41daf108420214da79021f067a1510d0
SHA1 c7bd58e35bba3c1412ce5d9293571942c45dec47
SHA512 e8487408662150937b090ee81eb24617e05dc29d9181602b0efed03af85e50871def561f30a617f2f048febad522d27308f6952391a03d2f22d221e70e034e46
SSDEEP 192:DbXTexpFeOX0c3pJSel5diJtUMGBZ4WJz8RBCYsdMJESuduuZsShzqt9KfXrC6T:DbXTexpFeOX75kel5datUMGBZ4WJz8R+
TLSH
T1E8228FB7D3D8862EC81152F16B147E2BCF1E092853293C1AD9E9AEDBD3D24B2D14154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c84c9b9203fb2e378ee5db44faab1c1db1a7214558f48dc10dd0c5e999dec36e
MD5 9d9d440bbf13c5aa9235c6cd3243e234
SHA1 bf30b36c337a9b29256a6db2558121a67abf1efd
SHA512 db62a8198cb1c6479f70c74fda4e9ca580e1a7c0b6e73b8cf9747377e50ad3d4fc50862a38a1eec062ec89abc801bfd90c7e0d250c259a1432a44366f4885d6a
SSDEEP 192:sxZURsyM/jK1Ml8Mky/fMsmSOeIdpI8HW6+WN1wN6/YLkuG+MIgrJ:sxZUCMy/fMsmSOPVHbR/3p9
TLSH
T1E752E7116A3459778CDBD20DB955BF53D6F9047292900E94AAFCDA1C00E7AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 633733d86a81a2a03cc9011957a6c4ff4982e2396442226f12ef8c1c2e83e2c2
MD5 1a0855760e969191e9d5cf7572d9090f
SHA1 1b5554537ca3da8a7b7d69c753ca1126df0182bd
SHA512 8b5cefa1e215f91ac6f5effc7977ebe82ea8747bff8c145ed2c57ef7230f841b283219d4668c85ddfe2c592db2da282cc7c8ef35b84d47eb0d80ac5030c19a37
SSDEEP 768:gCs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNbro1j:gCs6pD1WvxzWju1jahILIsNo1j
TLSH
T1AAD2FA3B680CCB7E4F841E5CEC2A6F966DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8ed25f7bfe72cc107ebd4b6da6542ccaac106f84f003b6277ebf3504ca7ae85e
MD5 5f3b6c444cfa0c831f37c644fc17a951
SHA1 a828fe2ed0023258af8c06c2880a13034c40d1f4
SHA512 00cbbe644ba41c9088aab2290e110eade7577ee2fe01f7767d2d70d0fb3330aa36e584d01022d94df94d4d48936f0f7e0c6fad960f0d2385520acb12085886ae
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyF9IVK2QwHytnIlKUU4fyxsInKxWsy:KUAAKtePW9OK2QSOn2KUUiisoKxWp
TLSH
T138C1074276B702123C3E390C93A497279B82B7633014E96B7FA860755E66E344DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fda5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fda5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a58d01de60ff0a60533c37a31f3d3d78084bd0c38bcad712c566666ed70d9d6d
MD5 41a0b1ab0e0ae6278994b843f14a77e6
SHA1 29a21f9e2dfc8733855e045e4a5832e9cbb188a2
SHA512 66f966df8ec427b8d20cc031de518dd4f04896bbb0bbfd61444279af84479f41edfb9ef6380133a5c9f16ca60d27d007be92b166a2a0ff5402aa1bf77aaac2f9
SSDEEP 384:tsNcUf4eRbRY4a9gO2MHWAgnTKwBODNZOCXWI:tJhuOBpgnewBKZOCWI
TLSH
T123725C35683C6C725DE2B149F94B36079EB840A7EAC52E94D6DD6F1C00DF29C234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7726eae444d251c21dc0fc87a3e348c2c69ae41ed1135f718aa44d4a314d1103
MD5 c8cd54e790cce103cf5b26caa5638e35
SHA1 c22d97e4176809af859acef4e24b31587883d8c4
SHA512 3184ef4d2b12d8ed498211a30a8c1908e9e1b8eb1ad50568cf6326aa72fb6add8fb6b2c53749ea3ecb5ada0b499315f3fc738fd21f8b481d115e3fa6bcbb8864
SSDEEP 384:SZcIgsNcUP4eRbR/4a9gO2MHWAgnTKwBODNZOCXWH:ggyhuOBpgnewBKZOCWH
TLSH
T149927C716C386C765DE6B149F98B36178EF88063E6C52F94D6EDAF1C00DA65C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7cddd9ee5aa106e85e1552ef9a701c09b385927a8c73ea892c3f1de1637f4747
MD5 633e9d0daab71e518745bdbda69e06e1
SHA1 feab027f6122e9ebb7f042f4a8d251de36d06fd9
SHA512 3ca3e56c404f43a0cfe57eca5f23ab47f51ab0272b06bf31be361f90d476e4f0f4778e1895f886c8ff2d941c4f92ec4910ca91ca28bb5c3d5bc0b6b89f8705e8
SSDEEP 384:FiFPZcI6SsNd8TUNTUlIlP4eRu/4a9gO2MHWognTKwBODNZOCXWH:MFHvswgGhuOBdgnewBKZOCWH
TLSH
T141D22AF258DB9876D9AE9747A77E2D038EBCC063F5812A50B3985A0CCC9617FD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 de89be10c599ccdce586626fc72e4000ca050cf8340c0c9fda7e4b32078a8417
MD5 06e7db2b00f12ee89da7570f56393baa
SHA1 b8679b60e2b298548a9921538eb1f6b7010fb0d2
SHA512 eb4b593c7546725a84fba286ad458cbca7bf8bb76e33b11458b47d7def1b0774b1dafcbccb8ae26a9557dcb14f402c7ebfba0de1008b3bb038fdc22ada4616c2
SSDEEP 384:FiF1ZcI6SsNd8TUNTUlIlP4eRbR/4a9gO2MHWTgnTKwBODNZOCXWH:MFNvswgzhuOB4gnewBKZOCWH
TLSH
T127D22AF258DB9876D9AE9747A77E2D038EBCC063F5852A50B3985A0CCC9617FD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1739ba7fe7d77deedd05f797035209019e9c217d240c08186a47f15ac63e42f
MD5 a85125859aadcd85930848262ed345a9
SHA1 e75e141a1075537ae7ee8a4e0af0b71e99322338
SHA512 64c3b45856aaab404989c26bab7a17c4458360f974dfc138ec793608516f4047c5e5cd3fd32478eaf2df893031dc09ae228c28021256c6dd509a654b371c7a26
SSDEEP 192:qON3EV6O7+3hQmiUyz1Gttb05O29h2qgGdeU6:qONC61eGt9gO2MswU6
TLSH
T15B020A356C386CB74AF3AE4AF9873B235FA5106BE9A52F84D6D81E1C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f401049781560970e3d4d57bf527e1769c509ed11e3178d245cf3dd471812033
MD5 c0877bd779460c5406b465ef32cb2f1e
SHA1 0863b22c3dc9a0358c2d376940f90f77f4c27c68
SHA512 6f7e2949a6bdd6572985f2ab6472237e6becb6f1bdce5fc41be60ad9ac2b17c60f04e151772c849ac770547fc8d00a706dae2e192d9b70e82b5beca006f2bcdd
SSDEEP 192:yONm6O7+3uQmiUy41Ittb05O29h2HoNgcN2q9qU6:yONm6YXIt9gO2MHWhgU6
TLSH
T182122B316868AC772DE3A545F58736178EA84167DE867F80D6DC2E1C01EF66C234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b12fa1e0d7d7245f4512f9f55ce28388ff0b5b04fee9867d769e15f1fbb066db
MD5 26a23280afdf9fac005904b0e0dcdf30
SHA1 c8c68c430d7a3912ce5917fb8cd770eb3c123151
SHA512 ebe05119f29c44e2c8d0460d1937293393e46ff12f77c7b7f7b5091150b9914642a35d93aef83904d9a76320b9a627ef96710844676776dbd07bd5fec1322d84
SSDEEP 384:3ZcIhsNcUT4eRbR/4a9gO2MHWAgnTKwBODNZOCXWH:/hGhuOBpgnewBKZOCWH
TLSH
T13D927C716C386C726DE6B149F98B36178EF88073E6C52A94D6EDBF1C00DA65C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 da30cf3c11623694015f73f10bce762c214290d64691162688d345c89032592f
MD5 bbb5515917ee29d4198069ca81b0dd61
SHA1 75d9d03701b5f28ecd77cd19edde98e1aeb1161b
SHA512 e02cb1d368f0c39127ec1bf0735d0628bfc75dda5fe57d1d063450bd359b8ed72a72b905844dff33fc208d143ff59ae65b149cd4c243fbb63c741af0e44d0cc8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe596b82.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596b82.TMP
Size 392B
SHA256 d1a4305ccdfc087e792350fbeb7f5901441478e8956990a0cd758571e68719fd
MD5 6992b1d06a7a0686a9725ac3ceee6913
SHA1 25f933bcd4234e389728d762dc8edec38fb31208
SHA512 b404c12d2ad513c2a22bd7cfff6b2704e5033ced8bbdae2f0fd135a0a3dd2a69bc12ce3c794e16547ff68c4a37473b32cd45c1e8eb6f1da8b3a092e92a3e0f0b
MD5 SHA1 SHA512

Submit Download

a4bee2f8-a77b-4e55-b2fe-b420ee43bcf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a4bee2f8-a77b-4e55-b2fe-b420ee43bcf7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b1e3f8bb22ffdc6c1562366623439f1f129fcbccc6698649c8a6078818f34d4
MD5 613abc14ec9dd62a7fe68c83caffa887
SHA1 f08fd494e5150c840366455355ac070c85319934
SHA512 3a0eebc6653bb3200c47a67500f55e52442e2ea219b3c8d2e4816e22c8b13116cc6a8a1c32a037b64b8de5283a56fa6f0a64093f3e2d3efdfe9f913de9062430
TLSH
T198416E5CA6F91149B3B37F56ABF6A49D497ABC772E07D15E10010E4F0A26B00C862733
MD5 SHA1 SHA512 TLSH

Submit Download

RES3186.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3186.tmp
Size 1KB
SHA256 c0ce5cad89f20e537781a11087921871844dbf45117d740c8d5072dc9874f0c7
MD5 dd13b118c7f6fade3108fc09ff7cc511
SHA1 68146bced5ccad24ca101d4fa2c4d4c7ef7b04c1
SHA512 11a275ad625bd0cd40301e86f10d67a6ea69bc428f0462d52e0ff9b4e25f58fad1102d0326cb6d153738f479a055958690174e41abcf232af6e157c7ea6ad057
TLSH
T1CB21890553E8070EF0B35B31AAF5072FA268FD95EF62935B854052282C41144DFA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5vdot1zm.ker.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vdot1zm.ker.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zkaiwnkh.dll

Path C:\Users\Admin\AppData\Local\Temp\zkaiwnkh\zkaiwnkh.dll
Size 3KB
SHA256 d078e806fd6a892aabc2c56531443de6d30059796ef55fb28454974f0042b8ca
MD5 399aa7fe991c8aaf8d1953e07c1a7849
SHA1 2e6c372c5dabc31bf37ff1553d77e444dd5ec870
SHA512 6252fc8e7fc0369644a9525ad6cce15943c80f5b7ab66518191e106f68e82328011a0c14c90614cc8187b1a65319927086f3283b468509fcc229adc3fd88fad2
TLSH
T19E71F01BABE4466BE47B0734BFF3072667B4FC949B73976E498442287CA16201D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2733465C994746169C53B42838D7A982.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zkaiwnkh\CSC2733465C994746169C53B42838D7A982.TMP
Size 652B
SHA256 a67620daac1b19f689ad3ea1f14504d564eb5a13b1f6c78470a63f39e2e55e2a
MD5 3c7a9cf38000235e7c2116e42669cf50
SHA1 c96525388065ca672242b1b7429bb9b490e908cf
SHA512 c57a81e2e2290af0b6fbb46afd37af4e975f643e1319e8f85ec9cfebcc05415a5b7dea1ce01b2a2c0a81d72d87cc063e2ee3700fef3c3b5aa834a9344d870045
TLSH
T1F6F05E0963F8020EF0F34B30BEF6836791A9BC64DE3293ED1480431D28645108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zkaiwnkh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zkaiwnkh\zkaiwnkh.0.cs
Size 600B
SHA256 a981a8a5d9f12ca780b7197ceab553048552ec67f25948d726e9eb121be1932c
MD5 0356d03e3c14cdabe1bdcaf99155a2e6
SHA1 a2da51d62bd76e1c65139704940de64c93fc0453
SHA512 3faf7474ca84b7953f2f146d97da04e9288bde480f0f85a48c8ecc0562d3280e111f2cc075c5f29becf628f469ae999e984c4dbd8548a7b0adc3460f261592ba
TLSH
T1A9F028542352D7A2A423943D4986F4EDF113407312FD2C00EAFC1722CE47141E23965E
MD5 SHA1 SHA512 TLSH

Submit Download

zkaiwnkh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zkaiwnkh\zkaiwnkh.cmdline
Size 369B
SHA256 b634e36402435904ed71fe04331d6bafe4f9e41165dc1acb2672d8b6b08196ee
MD5 74f845098b73a22735b3a011bbe3b68c
SHA1 1a078e5ba3a71a3ed7a1b0b419ad393f2be2f1e8
SHA512 ac4196ede54c6054183c2addfe97ce147a0709b453a8bf309596662fa943751c830461cd3f6456db8cf097ce32881e8add97b1ec861f5f129ffefdc92cdb10dc
TLSH
T15CE0C03A5246CA7D36DD2047E369D4BCC37207CB3D413FA49048480DD01700027D17E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1920-813-0x00000220D9FE0000-0x00000220DA024000-memory.dmp

Download

memory/1920-854-0x00000220D9FB0000-0x00000220D9FBD000-memory.dmp

Download

memory/1920-805-0x00000220C0130000-0x00000220C0152000-memory.dmp

Download

memory/1920-814-0x00000220DA0B0000-0x00000220DA126000-memory.dmp

Download

memory/1920-840-0x00000220DB010000-0x00000220DB1D2000-memory.dmp

Download

memory/1920-853-0x00000220C0160000-0x00000220C0168000-memory.dmp

Download

memory/1920-866-0x00000220D9FB0000-0x00000220D9FBD000-memory.dmp

Download

memory/1920-867-0x00000220D9B00000-0x00000220D9B48000-memory.dmp

Download

memory/2852-863-0x0000000000C00000-0x0000000000C19000-memory.dmp

Download

memory/2852-857-0x000002B8B2D50000-0x000002B8B2D9E000-memory.dmp

Download

memory/2852-855-0x000002B8B2D50000-0x000002B8B2D9E000-memory.dmp

Download

memory/2852-859-0x000002B8B2D50000-0x000002B8B2D9E000-memory.dmp

Download

memory/2852-865-0x000002B8B2D50000-0x000002B8B2D9E000-memory.dmp

Download

memory/2852-856-0x000002B8B2D50000-0x000002B8B2D9E000-memory.dmp

Download

memory/2852-862-0x000002B8CB8D0000-0x000002B8CB900000-memory.dmp

Download

memory/2852-858-0x000002B8B2D50000-0x000002B8B2D9E000-memory.dmp

Download