hxxps://zeroupload[.]com/f2d48a763d187a4ecb58889e41a601ed

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://zeroupload.com/f2d48a763d187a4ecb58889e41a601ed
Sample260916-2c2k4afa57

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3388	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340712327931941"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{311A4F02-250C-4439-A0DF-705BB6E8D619}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1152	1276	msedge.exe	84
PID 1276 wrote to memory of 3388	1276	msedge.exe	85
PID 1276 wrote to memory of 1660	1276	msedge.exe	86
PID 1276 wrote to memory of 1660	1276	msedge.exe	86
PID 1276 wrote to memory of 1660	1276	msedge.exe	86
PID 1276 wrote to memory of 3748	1276	msedge.exe	88
PID 1276 wrote to memory of 3748	1276	msedge.exe	88
PID 1276 wrote to memory of 1724	1276	msedge.exe	89
PID 1276 wrote to memory of 4720	1276	msedge.exe	90
PID 1276 wrote to memory of 1724	1276	msedge.exe	89
PID 1276 wrote to memory of 1724	1276	msedge.exe	89
PID 1276 wrote to memory of 4720	1276	msedge.exe	90
PID 1276 wrote to memory of 4720	1276	msedge.exe	90
PID 1276 wrote to memory of 2948	1276	msedge.exe	91
PID 1276 wrote to memory of 4020	1276	msedge.exe	92
PID 1276 wrote to memory of 2948	1276	msedge.exe	91
PID 1276 wrote to memory of 2948	1276	msedge.exe	91
PID 1276 wrote to memory of 4020	1276	msedge.exe	92
PID 1276 wrote to memory of 4020	1276	msedge.exe	92
PID 1276 wrote to memory of 3352	1276	msedge.exe	96
PID 1276 wrote to memory of 3352	1276	msedge.exe	96
PID 1276 wrote to memory of 5032	1276	msedge.exe	97
PID 1276 wrote to memory of 5032	1276	msedge.exe	97
PID 1276 wrote to memory of 3628	1276	msedge.exe	99
PID 1276 wrote to memory of 4932	1276	msedge.exe	108
PID 1276 wrote to memory of 4932	1276	msedge.exe	108
PID 1276 wrote to memory of 940	1276	msedge.exe	111
PID 1276 wrote to memory of 2000	1276	msedge.exe	112
PID 1276 wrote to memory of 4012	1276	msedge.exe	113
PID 1276 wrote to memory of 4856	1276	msedge.exe	114
PID 1276 wrote to memory of 4856	1276	msedge.exe	114
PID 1276 wrote to memory of 4856	1276	msedge.exe	114
PID 1276 wrote to memory of 4512	1276	msedge.exe	115
PID 1276 wrote to memory of 4512	1276	msedge.exe	115
PID 1276 wrote to memory of 4512	1276	msedge.exe	115
PID 1276 wrote to memory of 2176	1276	msedge.exe	116
PID 1276 wrote to memory of 2176	1276	msedge.exe	116
PID 1276 wrote to memory of 2176	1276	msedge.exe	116
PID 1276 wrote to memory of 3580	1276	msedge.exe	117
PID 1276 wrote to memory of 3580	1276	msedge.exe	117
PID 1276 wrote to memory of 3580	1276	msedge.exe	117
PID 1276 wrote to memory of 3260	1276	msedge.exe	118
PID 1276 wrote to memory of 3260	1276	msedge.exe	118
PID 1276 wrote to memory of 3260	1276	msedge.exe	118
PID 1276 wrote to memory of 3908	1276	msedge.exe	120
PID 1276 wrote to memory of 3908	1276	msedge.exe	120
PID 1276 wrote to memory of 2768	1276	msedge.exe	121
PID 1276 wrote to memory of 2768	1276	msedge.exe	121
PID 1276 wrote to memory of 3612	1276	msedge.exe	124
PID 1276 wrote to memory of 4164	1276	msedge.exe	125
PID 1276 wrote to memory of 4164	1276	msedge.exe	125
PID 1276 wrote to memory of 4164	1276	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zeroupload.com/f2d48a763d187a4ecb58889e41a601ed
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb410fc188,0x7ffb410fc194,0x7ffb410fc1a0
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,16263646809892050392,7220617268062085394,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,17599589554917372369,15077973846004055354,262144 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,17511088321107765537,13465889969493205016,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3613322307470893131,15137660640134899697,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2196524811056727373,13164568534569919494,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,13308527539310710848,4307782319119822055,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6988655084255819174,14324367862788462280,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,13636728794060420092,13549117168802073516,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,2737558906729530899,4263861657073460225,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,11732258936247323595,754642153346196878,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,11732258936247323595,754642153346196878,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,13921801336599081170,9460399038598985604,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,6994221203208898442,13249252661580874286,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,11057532304196009980,10915124676812563881,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,11843422319003547559,7849338615822299735,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3952,i,13105942662857524958,10590970941512302258,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6548,i,10883803501442559889,16524356308719641643,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6240,i,18240974153557609346,2689787912358150898,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6668,i,13781402589301415132,10418828778874742257,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2100,i,11583003916255773754,7303343965517176606,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,1220519655812657673,1043546623280700179,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10504751284621191305,1273477438272803988,524288 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,10097474129353404698,11047804429167080391,262144 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4992,i,465852716208742426,1292835791909397480,2097152 --field-trial-handle=2288,i,10105177202929936466,8109969572963937534,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

229f14be-b70c-484a-8c59-e91d2f19e6bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\229f14be-b70c-484a-8c59-e91d2f19e6bb.tmp
Size 18KB
SHA256 f34570132f1d173ef424b42729caf46867dc8e829222501e627d8f37e5842595
MD5 cdc55a26a055a1c3cd77c69120490c6d
SHA1 5072c7b7d9a0b1150db23e59d0a38cbad4c36d10
SHA512 0eb31f3db51039c2c2e05ea3825a43e99b61e6a73db0492d1f485c40845c05b515c3605cdeecde73c4036c798e38ea03e06c7824cda0bbf45b4022f7de214a87
SSDEEP 384:lZcI8sN4qZU1Wng2zIGmhScxaGhih8Psa+VYMl0oK:d85GgA69hih8PhgKN
TLSH
T136826E716D78AC7B9DE39184F8873F139EB4816392C96F5495EC9B0E00DE358130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 3ac9a81cfd61b260232e13c597b12cc65af6a91e072844215220750d3f67e80c
MD5 03f205452318384d2260bcfd97a3e870
SHA1 161f28a77bdeb35621d4f38c1df3d1084c904a9f
SHA512 deb99489537bf1d2298a8fc46e3e11cead1b622869f668fd092c66e7fa2a9c3c6e9abb85bf545a875f7690e2b7d3a838cad8481d2308ecead8cbf29136ab5a00
SSDEEP 96:md05ysn7Zksw+c0U/KLF/NlB7Z/tasNhE2vaXwGGXXrBC0LZE19bC9L9pg0aW55+:md05ysn7Zksw10U/KLF/NX7ZtlNhxSX/
TLSH
T1CAB1A78A81A0658DF794B13075DB84AB7DBDD86F6CB30F9331D2D7B4590EB40A80998D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a515b957b305b11715f4e6e71fdb506ed3d8806579aaef3a49bea3b1071737bf
MD5 088ef8136b7941522f9962c4972a5bd3
SHA1 283221712e689cc9dd9f473b7a92e7de67c9b0af
SHA512 3653095dbea1eea876d9da5844b63407286edb1c356d1dfaba2926e8e59be7a5214f72ecfb009e2ad518f39d958c928d40be5efefc40031b25b80f986b9837b7
SSDEEP 96:Bl7tz6/A/osltapAhvQmTeBEHzgOa2YmkzY48+eWnhZyc4tsc03drBEKF2va4dTe:Bl7tz6/A/osltUAhvQuemzgOa2/k048K
TLSH
T1F1B1EB4AC190558CF794B53075EB94AB7DBD98AF68B30F9371F2D7B4080EB49A80898D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f5ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f5ff.TMP
Size 3KB
SHA256 22d49d0563f89181269ca857791d2fb8cb71648e9ccf2462c79c37289e6c4384
MD5 e9f8ffdeddccb35e24d9e4ab858fe336
SHA1 72774f8fef46857a3c36d5a84b2c3339893dfcfc
SHA512 67039f3abdeb642f80c02013db1fd5eecc38b5981d33c9725c1c036a8aea4e338f27fbebf89c19c0f456c129a4406d210fffd71dcf3a35dd62a36b84d5473934
TLSH
T16E61A58981A0459DF7D8617092E8D0EB3AFE8D62B5B34F9222E6D7B51C06F54B81C48C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b023670dbb27e006c27269cc6b069c5b004952ade7c56d1a9ed954484f55df29
MD5 a18507371345cb41aa5bc6ccc23248cb
SHA1 4b93fb0e6bea7ce074f75b4369ffcdd1ed04f644
SHA512 4a8bb66c33a5b01bde6340f9a1cb1d9366b0ba8f201de602fbccbab277f0aba4ca62a06f41ec6a020db974bd835d01074ab0b738e76f461b3da9b70fc4fb2337
SSDEEP 192:DIBSeOPSP7Jgve/YrC54Gdzw/WP4L+bTEtc/AAgNell2xCQYrPyRONfaRW8qxGgx:DIBSeOPSPtgve/YrC54Gdzw/WP4L+bTr
TLSH
T15E22C0A7C3D88B6EDC1115F1AB646D27CE6D0D1896283D1ED8F5EF8BA3D20B1D20194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 1194782b34fce9b7a674ed53cc9f79b2f57876f2570180f7a6eed4bdd252d210
MD5 2b15e48e182a9fce34ec437cb68503e1
SHA1 aa3447c3da976e6650b2813de5359bb898ec309f
SHA512 bc3834b1952fb43c860604a45e91dbf8dae24a4795539b95fb294073606af35bd11322911a258a5bf4247440914624e4c02e8d6dfa220f0faadea1c25dcb63af
SSDEEP 192:DIBSeOPSP7Jgve/YrC54pwSGLWL5qxYrPmOSasuCRFa+bTEtMC/AAgNelM:DIBSeOPSPtgve/YrC54pwSGLWL5qxYra
TLSH
T19A12B0A7C3D88B6EDC1115F1AB646D27CE6D0D1896283C1ED8F5EF8BA3D20B1D24194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a617fda3642445f6afdcde300f52c44d533cc9a62903c05b26b846df9e634887
MD5 748580f59c8b006b2c298e3e1490d209
SHA1 0655a65368f5306d53ca02d31d5bc0da7f3dd26d
SHA512 c2256c8a1333b8fd465fd8fbbfebedbb745590d4c119533183736990d08d6cfd46602aceb6454de891143eaefce5e88f6285761da4c1af9b849e5103be676801
SSDEEP 192:sxZXRMWD/f6sM4fFIdpD8HW6+WNYli/Yapv1vIgrJ:sxZX1D/f6sM4uQHbn/v9
TLSH
T10922A7266E28A57B8CC7D20DFA25BF53E6F9503291D51E48EAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 33fadbe540c84ed9d58e1914f77a929db59c68e2481b4c77f29ab239e0a05208
MD5 cb9b105ea74dffe807a6520d9146d99a
SHA1 7fb29efc55055cc793bb36260427b2a7de1fc711
SHA512 237fcc8aca5862fd722e4570d2810ff4cd089aadb1056ca8880f8534309550c1d02a61bc4d745c9f375180acc9ccc105a62f33f5e241c69a23d4dac41cdb0d0b
SSDEEP 192:sxZXRMWD/f6sM4UFIdp6KnKBK+OK8PHW6+WNZK9EGKfrKSvoHYapu1vIg5wJ:sxZX1D/f6sM4NxK4+VCHbgC9feDHMS
TLSH
T1AA42A566BA34697B8CD6D21DFA14BF13E7F9643291D01E44BAFC8A1C04E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c4758c16ff1c4ea9e27acf022418b5530bc7775ccd1a6d4d1dfa0f3b886e2be0
MD5 2622596cb974cea0672d3b6f547994f5
SHA1 faaaf8bbd52b7e5c3166ba1f74c87b1738356401
SHA512 d69f0185df65c5cc60445d2d9f39d3f2384747e6296c244e9dcb4e2539b54cdbc6ae72cc9c8c649cbfe8a815e0419207b865ee8bcf77c8672cc09fca10642d25
SSDEEP 192:sxZXRMWD/f6sM4eFIdpkKnKBK+OK8KJHW6+WNZK9EGKfrKSKg+qdYape/1vIg5wJ:sxZX1D/f6sM4THK4+VvJHbgC9feZbqdh
TLSH
T19632A5667A34697B8CD6E219FA14BF13E7F9603291D01E44BAFC8A1C04E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b9bf8976390a7010b9931a8626f5baa3d458354fbc7252e2242dd048ba64a0ca
MD5 53c873237c55be66ab1345fafb11d20d
SHA1 f692a1b696d5d54aea708b72784c6db4308c3e9f
SHA512 da5775068fb9e3fe6845e54969ef5b61a82f9209e511b8fc040d2faae35e8fcecd4202c6f89ee6071119e7dd8c7ab5357e22ee19bc23b9cfe40b341aed0cc5ab
SSDEEP 192:sxZXRMWD/f6sM4tsFIdpkKnKBK+OK8KJHW6+WNZKIKfrKSKg+qdYape/1vIg5wJ:sxZX1D/f6sM4zHK4+VvJHbgLfeZbqdks
TLSH
T1C832A6667A34697B8CD6D21DFA15BF53E6F9603291D01E44BAFC8A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e89c77d022af9dbe4d57a74da9b0a735e05f5fc05732e11d16dc184ce76d4f5a
MD5 fd75f6334cc9bf1c41e5e5a01f058032
SHA1 d77fdc963752e378bb73d879a300dcf2a7b37bcc
SHA512 5d6d16210e21628d2df2393836144facfe68bc1b41e6f8e693b6be46cfd6f2f2d2b08b32f6081177336cb020e1fa0ea96205df373f4e537ecf93355be01a4de0
SSDEEP 192:sxZXRMWD/f6sM4SFIdp6KnKBK+OKaZPHW6+WNZK9EGKfrKH5aW0voHYapu1vIg5U:sxZX1D/f6sM43xK4+VqHbgC9feZvhHMS
TLSH
T177429366B934597BCCDAD21DFA14BF52E3F9647291D01E44BAFC8A1C04E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e76b7161dbe9bc5c824e46d837f45003ed25d9d662d2bb777d5a15790b531cd7
MD5 b53b550c7b8d22a081ded8b8907c789f
SHA1 881a1b483a69064224023eea741d8a4d65de4d1b
SHA512 d39a80a754476839a8fb537f6d0a4e37e88e470645993d27a4afd983e85cfa5e2d9b92308efbeb626f6eddfd1fe232e0181fdf51802214604d0e95818a719aa1
SSDEEP 192:sxZXRMWD/f6sy4fFIdpD8HW6+WNYli/Yapv1vIg5aJ:sxZX1D/f6sy4uQHbn/vo
TLSH
T13A22B7267E28A57B8CC7D20DFA15BF53D6F9503291D51E48AAFC861C04E76DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c55e30f2e0f80bf42eca8a4e4590dbd4c7d769aecc795c0814830862904f0422
MD5 ab95f17e13e740a80c0684947d601f5b
SHA1 7e543b3f0a015953254024aa2e408100149ba77e
SHA512 19f0dd2828ff113a48e7ff63ad2a248fe0092e2f14129aa5a0d9ade6d73d64dee9a834799cdd4a7a9de08750b83c8811725620a42724c4e041bee288d0fde6d5
SSDEEP 768:l3WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7qro4JfeYEmRP:l3WPcLKWvKeEeu1jaClLiF7B4JW7mRP
TLSH
T143C2FB3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE944C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e854ade64f7460390c11dffbd5de7928300eafc3470b7909ae2f9167304e1a58
MD5 7aa3d7cc83d5152fd12ed96c735503cf
SHA1 49fec8c7eb8b6e76bf7d60389fe86348e579418c
SHA512 88446a31002a01745dd2c51d9ba6d90f66dabc53fbaf62e5a6762a8d699d174762706d2ae7bd55a2af6f1c7bcd050066b8d584976115e86d0ad5cd5b52a578b8
SSDEEP 48:K0XaDX5ZpCbBsxISnCK9n1NCxHSYE1XryL4neioS23bu1uIS63K9W1M3xAnY9enb:KcMAK1qG2PuKUkTDaKI4y2Q
TLSH
T139915701B0BF165038BD285882649F5E464232B3351CEA3BBB7D48629D6AF590CFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21dd056d-0b45-481e-9fcb-7897d185d130.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\21dd056d-0b45-481e-9fcb-7897d185d130.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 67a3066e766499d5ee93ab665e2a96e703137b2d8a1659108f417dff29005958
MD5 80540ad3727fc93d4506d8d01b05e5d3
SHA1 fc6b9a4a39838386591e5a2ad545bb848c8224a8
SHA512 72bbc51f07d60fe29b9629b0003ba5c9dba34092fe9fdc1e788c9df088b3e17c057ec9ab8d1f6d1e67221af22a4ef30e812592e613256c2c86e245fd0262d9ff
SSDEEP 384:KsN4hZU1WUfzIGmhScxaGhih8Psa+VYMlS:Kwtr69hih8PhgI
TLSH
T150623B35BC78BC3B9EE39584F8473A139EB441A796C92F9496E85F0D00DF25C130A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8cba93e9a1b0baafb69fb2b267edbcda994093c964ef84ac0d84f2a9655e7031
MD5 c9e930950638e8f6343f713a51dc8b09
SHA1 d44dc4fc55f83ee8315546ac7ac3d973d8793da1
SHA512 26d740718666881237b755b4cabb02fdb59ff14699d915d3ba5139dac437b4911715031ba269070aee39f4466edaa267ce0225263b480b6468572958255e31f5
SSDEEP 96:3qONk4Qsjpfe/tyng7X5ih/cIPURHl8h4otop5+YDsNBnP9ZvEI0IG2jb00eL0yP:aON86IE7QmiUyTsTPuIGmheLNC7s3jU6
TLSH
T14902E935AC787C7B9EF3AD48F4877B23AEA5112BE5952F84D9E81A1D00DB24C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fc75da0110e0d3c7b656423fce6665600d043b1b9f22e948484fdd6ddc93c142
MD5 0bb00c6d7284c974ab35825b14585b9c
SHA1 fec0881b391473b15742831bf193dd7beac1afaf
SHA512 c886983e1e6841be5c3bb289c78e147db7fbb7a6793b2eb3c238188986ac30804367e3fd2b0661eced9186de512ef6c9567d7a7a8f47d2470d6aa58186c8fd43
SSDEEP 384:+iFiZcIEesNo8TUNTUlIlqZU1WSg2zIGmhScxaGv3ih8Psa+VYMl0oK:VFQ91wg7XgA69v3ih8PhgKN
TLSH
T159C22AF258D7983AD9AE4743EB7D2E128E7CC163B1846A50B7D85A0DCCDA17FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4dd969238181b4169e2a3769ed3ad1f41c712267cf149b49b5b3c566be829fcf
MD5 09357667126951cf7ae90d623fdf600a
SHA1 5c8f1661d3672f06c2a4a19d3b46af56f328dc9e
SHA512 c760b0667f6c38f890ae473214f6154991e619ec4dc229c940258f5c44dae7dc6d5e861f70102d10daef5359c175431ce54377d9a5daedd7f7ec4ebd407a4a7c
SSDEEP 192:aONB6IEfQmiUyesT9uIGmheLcxaFkf27Hhg/DPU6:aONB6DhI9uIGmhScxaGcHh8PU6
TLSH
T1BB12FA36EC78B87B5EE3A944F4833E239E654227D7897F90D5D81B1D01DF25C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 10b4720408379b1f6f998a35abbee9efd5e019446287681eb8229011a39a7998
MD5 21abe9cdc7f911c3bc3695e286e47ee3
SHA1 5330dd3261f56084f4befc1499eba29fa3db5ed0
SHA512 b8bfe9eedcab0b112674a2299827a68d8a682c060daf2012844aedd25cd065e22caaa098c4690b6cd40dd774801656729bd6af26a0b1bed12cf343f13446e678
SSDEEP 384:KsN4hZU1YUfzIGmhScxaGhih8Psa+VYMlS:Kwzr69hih8PhgI
TLSH
T105623B35BC78BC3B9EE39584F8473B139EB441A796C92F9496E85F0D00DF25C130A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c0e839fd10efb3f51dc8b2a250b23710fc580a6833cf5b47ca6ec33ac1e3b743
MD5 ebd9eed90d6abd5a7a20be0b7d76a7cc
SHA1 649794339d4ec29d0f458068f66c108e1ca22bb6
SHA512 efa4b974a6ac175166e9a56dc19d7bb4a47e74f18969fdee25ea742f58ec3fae947098c18d037ddaf4531c3cb913116b471428963552ca5bce11da9738199b72
TLSH
T1B8E00443D34000FCD03C03304443173015C7453510D0C1C4DD1001445C137441F31FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59c0e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59c0e5.TMP
Size 392B
SHA256 164c8ff30a708169e6ab22b25d090e5f84de04ad9956b9e68a3904f72c0f44c7
MD5 4d6cbaf3c4a3ed98baee5844e5d070dc
SHA1 2a53334d5e12540a0c90ded3c1735d150b107c17
SHA512 75ef231c87d70a54667c1bdc3eb0092f0c924648592159f60a3b7aeecb49c80e07218dc463267f2a8a51969ab2636d2a9e50017378fe9d7b50ae152ce06ef667
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 786083832ebfa63e210b1222a8b64a4c28e23d3df2bd75d68067a6df21cd4f3f
MD5 d35c3ae402dacc10dd311723367760ae
SHA1 a9ea360679ec58903600926e5038c10d7a098001
SHA512 2c63e13c1e13b46730ca8be55e073d9c35009f19a8226b346367c58d0b4bf431cf72915eb466e9164c235f3c66edf1e77b21c1299b7e6a00a3838945e618a97a
TLSH
T15F415B5DB6EA1148B3B76E16ABF3686D483AB8772E0AD45D00010D4F0A27B40CC71B33
MD5 SHA1 SHA512 TLSH

Submit Download