hxxps://medved[.]fans/EULEN-FREE-VIDEO

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://medved.fans/EULEN-FREE-VIDEO
Sample260822-zyebkstyhx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4516	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319064465874585"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5FB0B437-605F-4F9B-85D1-DF789A91E7D5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1736	1104	msedge.exe	88
PID 1104 wrote to memory of 4516	1104	msedge.exe	89
PID 1104 wrote to memory of 2872	1104	msedge.exe	90
PID 1104 wrote to memory of 2872	1104	msedge.exe	90
PID 1104 wrote to memory of 2872	1104	msedge.exe	90
PID 1104 wrote to memory of 4520	1104	msedge.exe	91
PID 1104 wrote to memory of 4520	1104	msedge.exe	91
PID 1104 wrote to memory of 4664	1104	msedge.exe	93
PID 1104 wrote to memory of 2732	1104	msedge.exe	94
PID 1104 wrote to memory of 4664	1104	msedge.exe	93
PID 1104 wrote to memory of 4664	1104	msedge.exe	93
PID 1104 wrote to memory of 2732	1104	msedge.exe	94
PID 1104 wrote to memory of 2732	1104	msedge.exe	94
PID 1104 wrote to memory of 2960	1104	msedge.exe	95
PID 1104 wrote to memory of 2960	1104	msedge.exe	95
PID 1104 wrote to memory of 1740	1104	msedge.exe	96
PID 1104 wrote to memory of 2960	1104	msedge.exe	95
PID 1104 wrote to memory of 1740	1104	msedge.exe	96
PID 1104 wrote to memory of 1740	1104	msedge.exe	96
PID 1104 wrote to memory of 1608	1104	msedge.exe	98
PID 1104 wrote to memory of 1608	1104	msedge.exe	98
PID 1104 wrote to memory of 1608	1104	msedge.exe	98
PID 1104 wrote to memory of 1220	1104	msedge.exe	101
PID 1104 wrote to memory of 1220	1104	msedge.exe	101
PID 1104 wrote to memory of 1220	1104	msedge.exe	101
PID 1104 wrote to memory of 2668	1104	msedge.exe	102
PID 1104 wrote to memory of 1776	1104	msedge.exe	103
PID 1104 wrote to memory of 2668	1104	msedge.exe	102
PID 1104 wrote to memory of 1776	1104	msedge.exe	103
PID 1104 wrote to memory of 4424	1104	msedge.exe	104
PID 1104 wrote to memory of 4424	1104	msedge.exe	104
PID 1104 wrote to memory of 4424	1104	msedge.exe	104
PID 1104 wrote to memory of 3744	1104	msedge.exe	106
PID 1104 wrote to memory of 5064	1104	msedge.exe	107
PID 1104 wrote to memory of 5064	1104	msedge.exe	107
PID 1104 wrote to memory of 5064	1104	msedge.exe	107
PID 1104 wrote to memory of 4504	1104	msedge.exe	108
PID 1104 wrote to memory of 4504	1104	msedge.exe	108
PID 1104 wrote to memory of 4504	1104	msedge.exe	108
PID 1104 wrote to memory of 3004	1104	msedge.exe	109
PID 1104 wrote to memory of 3004	1104	msedge.exe	109
PID 1104 wrote to memory of 3004	1104	msedge.exe	109
PID 1104 wrote to memory of 4020	1104	msedge.exe	110
PID 1104 wrote to memory of 4020	1104	msedge.exe	110
PID 1104 wrote to memory of 4020	1104	msedge.exe	110
PID 1104 wrote to memory of 4936	1104	msedge.exe	111
PID 1104 wrote to memory of 4936	1104	msedge.exe	111
PID 1104 wrote to memory of 4936	1104	msedge.exe	111
PID 1104 wrote to memory of 3152	1104	msedge.exe	114
PID 1104 wrote to memory of 440	1104	msedge.exe	115
PID 1104 wrote to memory of 1860	1104	msedge.exe	116
PID 1104 wrote to memory of 2448	1104	msedge.exe	119
PID 1104 wrote to memory of 2448	1104	msedge.exe	119
PID 1104 wrote to memory of 2448	1104	msedge.exe	119
PID 1104 wrote to memory of 1740	1104	msedge.exe	120
PID 1104 wrote to memory of 1740	1104	msedge.exe	120
PID 1104 wrote to memory of 2516	1104	msedge.exe	124
PID 1104 wrote to memory of 2516	1104	msedge.exe	124
PID 1104 wrote to memory of 3152	1104	msedge.exe	125
PID 1104 wrote to memory of 3152	1104	msedge.exe	125
PID 1104 wrote to memory of 3152	1104	msedge.exe	125
PID 1104 wrote to memory of 1204	1104	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://medved.fans/EULEN-FREE-VIDEO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f8,0x7ffbf556c188,0x7ffbf556c194,0x7ffbf556c1a0
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,11143843993041476505,18158746905177067709,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16502206458505354522,12108950311391676941,262144 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,15797360834584147568,4769749475371892750,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17732666395627642549,15539392578414627134,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,13999458432280344650,9605899564082654286,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1970303792830158371,8133339168300238619,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,973096619449442533,3929943472747004624,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,9365381805129310186,9571399000382748203,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5044,i,14692937083574629791,12147226266579368152,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15697227099152277359,8312200547104859971,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14831341616627554159,16023128628340987005,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5836,i,16515652720292261374,7304347157793677607,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,17318054452453085639,10344603566486535893,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,17318054452453085639,10344603566486535893,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6080,i,15532447279817831238,14412737758547840506,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6208,i,8217413823364719950,14044471734906575037,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6116,i,12179742945850862420,10348806550620021101,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6156,i,15071653809896988065,8364850262026058285,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6136,i,4444516244013868330,13484151821382464694,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,8277685007046222860,12622519210209159934,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,1454422247890410664,4257904119250115333,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,17962891697920079998,7451398395832984882,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4268,i,6509001973227383047,9298402275082089592,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,446587062785149832,2779275389436346024,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3168,i,15534292716230346918,14092201105950702635,524288 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5620,i,18028199336221451622,405150193598303634,2097152 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2152,i,7216196275278586091,169612946412473141,262144 --field-trial-handle=2232,i,3277709983887650659,14750802850248249108,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f66e4cc61163e6fc085ddf8332f96174e7dd7f2c14268005fd498a0064354e58
MD5 e32eabcece06774a8c23674254eb2c4f
SHA1 c3a93019e12d8defac4843bca08e28a3ad6e1305
SHA512 6c626eb936be6043aa1166409f8f1e73e050a41541f1f44baa880a0d284f770c67ec8022ec7fe0c03103f29e9ebaac3df3adf26bc02b7fa49d9d75ad8d9a5a2b
TLSH
T11E61F7408E4A4505FF21123BD4D21314F87042B93A936EEA426E8BBF440EB61FD3FA4B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5a3c155b5f3360891599ec565bd698fe06e9d71cd6fec0787dda9fd1493344a9
MD5 277e2191a54b6eb6d8794e3027b98300
SHA1 fc328c0d470a9e1694c2b4598167ad61cfa668ad
SHA512 8151ccd30751b78e9b9f7ffed151b10a238a367f6eb933352345b6b11c465ae9482fa1282e61370857b2a7a9fb1200def4c57dbb56f3722f0ec3b386a9c5ec6d
TLSH
T150115BB3C3D5856E890156F06A24AE2BCE2D0506421C7C1589D4FF6BD3E3475E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 008e47b836574644115877c8635423933866e848f14191001ed1284db3db9cba
MD5 7aab59983c0cbb0b37ffb38af9e3d402
SHA1 c3a90dabe53eb001babadcb35fdc6aa661c96a91
SHA512 2166c3d8125cbe77738080a0c5c97c04839dcfe9b27fb52012f523309e15ddd2c81df3b0736bfd10b7509e5e045411758db69e0fc7753ad9aff3dac23b1fc7ad
SSDEEP 192:sxZ7R4kx/fgsPGZajlIdpJ6XHW6+WNGYLzDIaIgrJ:sxZ7Zx/fgs+ZajWJgHbGa9
TLSH
T15622DB126E38A4774CC7E20DBA15BF53E6F95036A1951E58EAFC961C04E76DD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a462c487c80709459e41c96fd14075723441bcdd4522e680c71d84a98497ea27
MD5 6649803a4775b602701b78f064bc592e
SHA1 7e7b9f851e9423a542c919d65c2046bd4268d394
SHA512 12495c943529518255ba67bce824f9832549eb66bc0d9c403a666667f8a2749d65275e4253a61014822dcddc6f638285e47ddddd5eb61c4984f219de6ff43642
SSDEEP 192:sxZ7R4kx/fgsNGZajlIdpJ6XHW6+WNGYLzDIaIg5TJ:sxZ7Zx/fgsUZajWJgHbGaf
TLSH
T1FB22DA126E38A4774CC7E20DBB19BF53E6F95036A1951E58EAFC961C04E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b6bc38c73a533532ddc804379fd9325e6e9fff6b5eea8d82bb312086d485285f
MD5 7b96b5b9ce11036389f999ca94221f92
SHA1 c408a90e9aba2af04b71228fb350705611634a54
SHA512 0b81a1e4eed365e6220e0be6c8f9826168c150af1764e87d0d2ffa61f1b627d83c33d2c1a10c7384509cb347525098603c1e2bfd56b27201116bf6a8e4cd9db2
SSDEEP 192:sxZ7R4kx/fgsNGZSjlIdpJ6XHW6+WNGYLINIaIg5hJ:sxZ7Zx/fgsUZSjWJgHbGnh
TLSH
T12122DB126E3868774CC7E20DBB15BF53E6F95036A1911E58EAFC961C05E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2c8a332a6ad324e2dfe3df11fb20e7eaad2cd3ca2aa8919dd069782eb7610f47
MD5 1ff6843b13bfc50077fbe37e6df843c0
SHA1 0433a7834207eb99d780c93825a2db314f805633
SHA512 c2c5c9c2d57c565b9a22398411e4c9f24ee3d3e54c3bf3258d79411f0908266bc342e90ffa95951ddd77260d67ff2054889cfc1a66152dd6a4074eece8045386
SSDEEP 192:sxZ7R4kx/fgsNGZSjcIdpL6XHW6+WNGYLsuIaIg5hJ:sxZ7Zx/fgsUZSjFLgHbG2h
TLSH
T1B632DB126E3868774CC7E20DBA15BF53E7F99036A1911E58AAFC961C05E76DD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6d582ffc022bc8957b87f930a112f8b0249f2a083107e7f96bdbe57157c83c6b
MD5 35a7f54cc699d6971c363e818cbff418
SHA1 5defa4f033e4c086fea3dd562a0aef5176151968
SHA512 1c48409d325d5cde3d20c022158068b7ad07a9699cd845557465a6a469aec932598cc4010d36a7d22cc7d3c8a73ccc6c2ca6085a3fb98d157a1e365683b9efcc
SSDEEP 768:S5O6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvZro5e:S5O6fP1Wvxz3ju1jaZILIsvS5e
TLSH
T1C6C2E93B240DCB7E4F801A9DAC5A6F977E9802C7AB588D8447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8b5813f734120c5532f1050e91bd9dc5ad84b88cfe150eda63051219dc09544e
MD5 36a9ab6d5c4c082839ac610c55093568
SHA1 97aae13dea9e8e699d9d37ebf1f3ae2bf9e91e93
SHA512 16df1deb9662d4ad3f4a152971295c5497670ce09737f95d2b1cd3ae79187a9c45d94a44764dac54feb9fd9ab2884092ba123ac6467554b9f772efb4ec3082ed
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyZSI/KL6AXypGIPKTy0PyBsIXKZ28G:KUAAKtePKSsKL6C6GQKTyWSs4KZ2F
TLSH
T115C1151336BA03026D3E2908965597279E467963302DA42B7FEE40721EA7E204EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97a9b9b0-5f0d-4866-87dd-4f1128e84a4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\97a9b9b0-5f0d-4866-87dd-4f1128e84a4f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2a33ec7bb1659d89b11ba66379a21119988da945151ebcc6a548fc4fb9a2e1fa
MD5 8189735a9e4fecafd73e350b70528fac
SHA1 b1b32281046275ca828ae496c56ff9f7fa4548f9
SHA512 c0f6e16c356b5de9cbb3ea6119f833de0c1f51fece5ad87f66ed9c19884748c4b0bc6a0266377811a6d495a1138f4cf38d106e27a5794ecc77d4d03b3c69d179
SSDEEP 384:OZcIhsNF0D2HZmPR66a95O0MWv/L3ive+a8oT:shpo7/OOv/L3iGl8g
TLSH
T1E0827D725C7C9C7719E2E241FA8725179FB8806BD6C92A90D4DDAF2C01EF6A8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 126da3cdd90c0dc3b78b0d4b544c943274c92181abc51e83378dcb2de1855291
MD5 a35da2b23ae0b8a70d22a5a18aecc2fa
SHA1 b1162f19a3d3c294260fc3c742cbd82aa817d537
SHA512 480a78023dd1f05d81f47ecbe2c457f634dc9e68a41540388d3b9d9b0dc9c99667ef3e7b04a82774933c85f66578b62f42525f353e7ef7bf2cb255d47103e76b
SSDEEP 384:vZcIhsNFPD2HZmPR66a95O0MWv/L3ive+a8oT:nhEo7/OOv/L3iGl8g
TLSH
T165828D716C7C9C7719E2E241FA8625179FB8806BD6C92E90D4DDAF1C01EFAA8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 80457a174174326c771a341a4cef2ca7b104ad38e101a155f7db68abc23f966a
MD5 4e4f172f1be90c9250be698c78daa862
SHA1 f895e21eafc24b404bacdb1c7544d56338cc2c59
SHA512 4790609b9452afc0a8d7f65bbdd4278ea43a562a94fd9849de2c1981dce1000a6aeb764a2abc1f1434b50c29eba9645209a5afad5f823bac48b469a562d8e199
SSDEEP 384:eiFiZcIRsNf8TUNTUlIlPD2HZmPR66a95O0MWv/u3ive+a8oT:1FQR2wgjo7/OOv/u3iGl8g
TLSH
T15CA27C735C688C7B6DF6D641FA4A21139FB4807BC9C96A90E6DCAF1C00AB5EC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83379ab50eeff39d48f0ad308f4c5dd043e7e8ae761de8dd7b52e7a441cb4d79
MD5 8c8c08b90dba7766a3bd7dd52f4151b1
SHA1 1b739868bdb7dc521567ccf0f057fe1cd9304ce1
SHA512 a819170c0246e1431777c69c1c4929ae5f23d695665c8107784b015a9d6e1c1f694c81ef7153506ad7aaf918f95fbadbf675158c9a75da6757063563b497e1d0
SSDEEP 192:qONY6O7+3hQmiUyZpGttb0UO2rh26gGtuSU6:qONY61UGt95O0M8JU6
TLSH
T1FF02E7356C386CB78AF3AE45B9872B279FA5112BE9952F40D6E81E0C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e7da54bd10eff42c1df9ce42ebfef1fa763fa439ebf7908081d6abef3719ab74
MD5 115f9b87caff2d98af9c55ecc707608e
SHA1 c5db24a50b87d719373d5d3bbee586df15e62801
SHA512 57b45a52ad75eaabf831f6c87bddba1baddefce07baeca9bee87465f72ba2733b2a8995a6929d4de3dc564e088456a7f9e50172386d1acc7682459ac5c5dda04
SSDEEP 192:KONI6O7+3KQmiUy3Ipmttb0UO2rh2Wv8EsycNAqTAAU6:KONI6AXmt95O0MWv/u3U6
TLSH
T14712F9327868AC771DE3A545B58736175FB5412BDA862F80D5DC2E1C01EFAAC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

917f9dd3-7597-42d1-b549-be83da06168d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\917f9dd3-7597-42d1-b549-be83da06168d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a02eef38f5cbffbe2bca07507988122e7645116d059432dbfd91dbca85effed4
MD5 2b1d74133cc6dabfa623c52b9d1fb462
SHA1 d5eee8d4c90561e92a206450f43f2cc374d8a7e7
SHA512 84819753880a42a0fa295ea5fe187d4918b3ab940e29c4578c1a0517a1c2ff62e32b989b4e9a61fd5bc92d9bfe9269d8e856ee4a919d26c5715fea935fd7f1cd
TLSH
T183412C5DA6E91148B3777F1A9BF6A8AD487B79372E06D46D10110D4F0733A40D8B2737
MD5 SHA1 SHA512 TLSH

Submit Download