hxxp://files[.]pythonhosted[.]org/packages/e7/97/40a91354862028e8f8e547ac27c6acd7b7cc67b9003acc28596d9e90cd6b/uv-0[.]12[.]7-py3-none-win_amd64[.]whl

Analysis

user interaction
yes
max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://files.pythonhosted.org/packages/e7/97/40a91354862028e8f8e547ac27c6acd7b7cc67b9003acc28596d9e90cd6b/uv-0.12.7-py3-none-win_amd64.whl
Sample260828-sd63jadd42

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4388	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324029068049447"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{6CC58E1F-683B-41A0-AB47-C1AAB961D3D6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	OpenWith.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1484	1436	msedge.exe	85
PID 1436 wrote to memory of 4388	1436	msedge.exe	86
PID 1436 wrote to memory of 2468	1436	msedge.exe	87
PID 1436 wrote to memory of 2468	1436	msedge.exe	87
PID 1436 wrote to memory of 2468	1436	msedge.exe	87
PID 1436 wrote to memory of 5088	1436	msedge.exe	88
PID 1436 wrote to memory of 5088	1436	msedge.exe	88
PID 1436 wrote to memory of 3148	1436	msedge.exe	89
PID 1436 wrote to memory of 3148	1436	msedge.exe	89
PID 1436 wrote to memory of 3148	1436	msedge.exe	89
PID 1436 wrote to memory of 3104	1436	msedge.exe	90
PID 1436 wrote to memory of 3104	1436	msedge.exe	90
PID 1436 wrote to memory of 3104	1436	msedge.exe	90
PID 1436 wrote to memory of 2364	1436	msedge.exe	92
PID 1436 wrote to memory of 2364	1436	msedge.exe	92
PID 1436 wrote to memory of 2364	1436	msedge.exe	92
PID 1436 wrote to memory of 2284	1436	msedge.exe	93
PID 1436 wrote to memory of 2284	1436	msedge.exe	93
PID 1436 wrote to memory of 2284	1436	msedge.exe	93
PID 1436 wrote to memory of 1232	1436	msedge.exe	96
PID 1436 wrote to memory of 2864	1436	msedge.exe	97
PID 1436 wrote to memory of 1232	1436	msedge.exe	96
PID 1436 wrote to memory of 2864	1436	msedge.exe	97
PID 1436 wrote to memory of 3924	1436	msedge.exe	98
PID 1436 wrote to memory of 2488	1436	msedge.exe	99
PID 1436 wrote to memory of 3924	1436	msedge.exe	98
PID 1436 wrote to memory of 2488	1436	msedge.exe	99
PID 1436 wrote to memory of 2488	1436	msedge.exe	99
PID 1436 wrote to memory of 3996	1436	msedge.exe	101
PID 1436 wrote to memory of 4824	1436	msedge.exe	103
PID 1436 wrote to memory of 1524	1436	msedge.exe	120
PID 1436 wrote to memory of 3492	1436	msedge.exe	121
PID 1436 wrote to memory of 4332	1436	msedge.exe	122
PID 1436 wrote to memory of 5668	1436	msedge.exe	127
PID 1436 wrote to memory of 5668	1436	msedge.exe	127
PID 1436 wrote to memory of 808	1436	msedge.exe	129
PID 1436 wrote to memory of 808	1436	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://files.pythonhosted.org/packages/e7/97/40a91354862028e8f8e547ac27c6acd7b7cc67b9003acc28596d9e90cd6b/uv-0.12.7-py3-none-win_amd64.whl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x264,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a0
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15374984540886277454,12847271319949323717,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,4455204755678823582,3155217195976388296,262144 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,13793695411808103758,9848228376659730689,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,144207110308316466,5225042749788934608,2097152 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7525433753198069920,2550288925778201832,2097152 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,16569249761094520514,6686872178685530546,2097152 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6665731218915040954,18262617005188585195,2097152 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,15510534430751901844,13458328491384357074,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,5013789523247355324,16339303427115624022,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17720977077293627451,2308977790590784996,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5792,i,17819048139824203578,16137489838984882726,2097152 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2190376979155831904,2350930667628781240,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2190376979155831904,2350930667628781240,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,13401063594497247906,11394963452053744438,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,4933917539158981927,6905565720243669906,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,11248966651000414405,11934673565937725831,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,22944120559640848,13730977629851413169,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,13235663051601644152,5282680455215100572,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,15824300865529975170,17598197836552515147,524288 --field-trial-handle=2368,i,11147673029810978249,2747267879121147796,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2ca5bf3e5002c78aa00ab80d0c3411b5710c055b4ab03ef65d018e6cd00cdbc2
MD5 c0e49df4e94ce5fbc699a885f368e684
SHA1 22f1767eda30128d89e04e3f1efc6a8aa8b32588
SHA512 99002c5423c1ddbb666c3d6efce4d9c236c008955fc66ee8cea35a621e756ccb06d16fa26d7fb620b1a0f9df43cf9e9ff86334ead1e97ae9fe707da96eecd8c8
TLSH
T160713C7911D227A6E38A3633E2F2160A30708FA90F137D211174F93ED809B166736DF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d339.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d339.TMP
Size 3KB
SHA256 88809ba8444019311d8ed53a69440de15e000d549d777743cb6a3353fe34d0b4
MD5 d14b64baba56458197598067717f326e
SHA1 b4ff9effae0e15c8a43bcdc9f5e0da6af96c2ce1
SHA512 778a6d80d968752d24bd970ff32eb4b188a7a02bed02b96a6eda3f5232e5e03c29acbcc5e54ebd737bb9a4aa4838163df33b58a9ce81d03f7b9ec0024117373d
TLSH
T153713C7911C267A6E38A3533E2F2160A30708FA90F137D211074FA3ED819B16677ADF8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3cb667113a55acec462daa11e372caf21310c2a12266be7c56ab75ed6c8f0b25
MD5 efa46b6cb4a62780963d1a59be4a4fa8
SHA1 4cc70c4e8762d66f9c15435d42e6a7bcc94cd359
SHA512 db0493aae0ebda365c2be6d5b9b65af9c0b46e8d85215cf77d80195d7b8fdd6b394e437102918a8197cc55aeba25193d6a39aec791a5f899a67022efebd65c96
TLSH
T181116AB783E5896ECA1157F09A24AE1BCE1D0646432C3C1985D4FF2B97E3475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c6dfe9a4e8ea56de8f4f110bf85746a428116d6445a1faddb9dd1f361dc73c4b
MD5 e3722202be8cac9fae5daf37ca5e9b34
SHA1 18621a5bfc976a79f0cb18d6cb726e5436742bc1
SHA512 896cf0e8a6af4646c6bda8a9139dbd4993356bdccdd4786fce9e3f43fc860c057901ad29b0f443a25429af5acdb7017079f71dfb5fd0498d1c7f2e55f6c353a3
SSDEEP 192:sxZ9wRUyM/jK1Ml8M9K/ffsBlo8WHMeIdpJHW6+WNGY4kLkuIgrJ:sxZ+e1K/ffs3oHmJHbGs9
TLSH
T1EF42E811AA346A77CCCBD209FA55BF53D6F54532A2900E48A9FCCA1C05E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a32305c4682120b80fb41ebaae833d8d279742dcdb6815ef7df78d8519ca8f9f
MD5 e6bdaea8d64626aa1a8e2d351b7be5a4
SHA1 9c84d85b6d357f9d0a530968852d6258a546e344
SHA512 13873029397ef51df8929be68122329f2abd29087edcee970374bf3835b171cf7670fc2b714943e4a1e952d5826660b0cf5d0b8c65fa0046048e0c1ab69053b1
SSDEEP 768:F98iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdurolkNUnn:F98iJPNWvx76ru1jahALocdl0Un
TLSH
T1D8D2FA3B680CCB7E4F844E9CEC266F966ED801CB5B948D5447FA884C03C77EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2c4764603b3f954b399e6a0d53ce6f2aca1a0a81f18445ae845ad05de3b89e7a
MD5 3808939e44c42e9ee03f0603ac0956d2
SHA1 8943a12999a99a1f1091888b8ab0360ef3394741
SHA512 53a258d420cba1b68201832e68f0e0a638b8792a80743e29c35d4fdbc09c8382eaca9c080f14c37966ee9ca22183533a88a940e947bbf7a6ef911a26c069479e
SSDEEP 48:KV9IhKe0sbyV1INKGQAiYIDK5icfylPIZKYYsW:KV9aKe0yG12KGQlY4K5iG2PGKYYt
TLSH
T16CB14822B6FB13013C3E251C9950866B178635673058A86F3BE800725EABF252EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597054.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597054.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c3fc36ab6810cccdfaea189c126180b701702e979aa1d1d1265b2fb64e5f028e
MD5 1eae21eeed81f4323c98dffc15bc20bb
SHA1 1a2d3f9c645a6f811286f0ecd63af8ff21b545ec
SHA512 2994aba84e3385f403108ca7b39053d07c6f1e87a580ad9ec5ac865297bbc11ac1a0b350a63e2f626a04e908ba90866cb8885fd34526ac6a0a7fc9da3ac826a1
SSDEEP 384:TZcIhsNvlTEknkg8kyv7XLopL0X1puLRxoM:LhCAbspLsyLRxj
TLSH
T120828D32A8785C7F59F3E245F58B361B4EF48527E7C86F84D5EC672C01DA599030A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2ad0985bf2dea56b88e0981de6302b5d8f40b7ff6d3808e57ae89bdc4e2454e4
MD5 9ec8f5a6cfcf183704c24f1b2b416d1e
SHA1 54c7122d8fca6dd5b47b2987f604b359f2a0898e
SHA512 ec4c91359c4c141312a4de0c47f1f46b0f287082103404dcd5ab064e20a7c5467361e98f8b7ced7f2d0c86187f5a93b0906f6cbfc24656ba18bcf39bacd8743e
SSDEEP 384:ViFNZcIVsNR8TUNTUlIl8TAknkg8kyv7XLoUL0X1puLRxoM:cFVVYwgcAbsULsyLRxj
TLSH
T127A26C739CB89D7F69F3DA85F54A321B8EF44127D6C4AF94E6DC9A1C019B198030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 298f12bd5971fbe0e110c5ba99537c1365f643eb57748b52fcae29b532ed52c0
MD5 cfaedc9219b87df22b1ec7a7e0000ada
SHA1 7b7e3b47ce9903615c50ca14745ed9784d43a025
SHA512 2652021c9cdad02f926c245be6aa7de20df2bb84a98f8fb293728fb9af2a0771c0380b5a1643564c3276a43ede86889ce7aa42bae2ce710bb5976ddf1308481a
SSDEEP 384:KZcIosNvBTAknkg8kyv7XLopL0X1puLRxoM:oowAbspLsyLRxj
TLSH
T18D828D32AC785C7F19F3E245F58A361B8EF48517E7C82F84D5EC672C01DA699030A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 032e7012b96f61077b5833ff6435242a11aa79e65e40c938afd2506ac105d4b3
MD5 1503c64cdf4cc15ed5869b65d4e91815
SHA1 a3eb3f295ead77591dbc29313d783d4cae0900e1
SHA512 f2ea519f5bd948a4f1d842d550017785efd2e6e82d5ed73d879186d9e1d4251ce56ef5be4c19279b61893f27a07d978632008d685f88e8d76db72236e336ec2b
SSDEEP 384:FZcIosNv8TAknkg8kyv7XLopL0X1puLRxoM:9oVAbspLsyLRxj
TLSH
T17B828D32AC785C7F19F3E145F18A361B8EF48517E7C82F84D5EC672C01DA698070A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e10e20922cc99fbbc7329cd88ed864e77a220c9593878eda38039015734e7717
MD5 24bf712f2e6b2427a66b60797c6f8cbb
SHA1 643bbb881415d08c3e9a505a3fe863a0ff7eb6bc
SHA512 cd2a822e3bfd4dd0fce8b48f09177fb4fbe8bf133582e879c3a19b917ccbcc5a63893904f6ce0523e2c902cfafc71541459c7a2d7999a1b1a4a0d625cfaf86a5
SSDEEP 192:gONv6kDfQmiUyzWZ9035jzorkbravWQiBaU6:gONv6ghfZ9g8kyv0UU6
TLSH
T16B02D93568782C7B8EF3AE49F44B27275FE5112BEA952F84DAE81B1C40C765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e12094b9a65a729677afb38085cabaf8055f47ce7d654b57a425c7fb5d76510
MD5 c47f0731579eb6fb8e621d00cd64ece3
SHA1 867090ce1964f250c6c85dcceb0754cce573c0c2
SHA512 3dad69a7db550d3aaaf91a62920f92ea6d7aaf3b107bdc7c910c919d1dc5d73006171337248ba15152119fa31055e2537c5311445bd805cdaa167d4a760e9959
SSDEEP 192:7ON3S6kXQmiUyJWV9035jzorkbrav7XHNNotcReqvU6:7ONC68PV9g8kyv7XLoCLU6
TLSH
T102121A32A8786C6F5DD3A945F48B32279EE54227EBC96F94E5EC171C01DF29C130A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc401dfb-3a2c-4356-b7ec-f6e1bb5a0876.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc401dfb-3a2c-4356-b7ec-f6e1bb5a0876.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

uv-0.12.7-py3-none-win_amd64.whl.crdownload

Path C:\Users\Admin\Downloads\uv-0.12.7-py3-none-win_amd64.whl.crdownload
Size 17.2MB
SHA256 277d326d7e63b912f3425c6e6d7d5d49f21b43d080d21859ff3c6819353f1847
MD5 54e8c1419996e4f20023100cd18b3dde
SHA1 2efb7bc7348fb191afe4d74bba8efbe3b3b189bd
SHA512 97d6d31b34bca1b84452cabd6be5cb7ba75e1340a30d0c601b0cd6ff6bef1d6f83ba5f6aea92b02c2a9a371ac7dfd14d1ff854c3fd645e365e31f679bbbeec91
SSDEEP 393216:1IYoxmBENjFN5bQmI3XrPQq1PDtYTP7M7MaxaxqkUB9La:1IDmMBb5qZOMB/9La
TLSH
T1B407338CE7560C56EDB92E9A088AEAB837617C9723549D2D31FB43011BC5023E6FBD4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads