hxxps://wickedzoi[.]com/

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
898s
max time network
733s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wickedzoi.com/
Sample260916-mt1b2aaf26

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3032	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340291912850303"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{D28A2095-4F2A-4E54-A027-537A2580955A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3344	4384	msedge.exe	87
PID 4384 wrote to memory of 3764	4384	msedge.exe	88
PID 4384 wrote to memory of 3032	4384	msedge.exe	89
PID 4384 wrote to memory of 3764	4384	msedge.exe	88
PID 4384 wrote to memory of 3764	4384	msedge.exe	88
PID 4384 wrote to memory of 1956	4384	msedge.exe	90
PID 4384 wrote to memory of 1956	4384	msedge.exe	90
PID 4384 wrote to memory of 4776	4384	msedge.exe	91
PID 4384 wrote to memory of 4776	4384	msedge.exe	91
PID 4384 wrote to memory of 4776	4384	msedge.exe	91
PID 4384 wrote to memory of 5176	4384	msedge.exe	92
PID 4384 wrote to memory of 5176	4384	msedge.exe	92
PID 4384 wrote to memory of 5176	4384	msedge.exe	92
PID 4384 wrote to memory of 2036	4384	msedge.exe	93
PID 4384 wrote to memory of 3420	4384	msedge.exe	94
PID 4384 wrote to memory of 2036	4384	msedge.exe	93
PID 4384 wrote to memory of 2036	4384	msedge.exe	93
PID 4384 wrote to memory of 3420	4384	msedge.exe	94
PID 4384 wrote to memory of 3420	4384	msedge.exe	94
PID 4384 wrote to memory of 1784	4384	msedge.exe	97
PID 4384 wrote to memory of 1784	4384	msedge.exe	97
PID 4384 wrote to memory of 1784	4384	msedge.exe	97
PID 4384 wrote to memory of 3428	4384	msedge.exe	98
PID 4384 wrote to memory of 3972	4384	msedge.exe	99
PID 4384 wrote to memory of 3428	4384	msedge.exe	98
PID 4384 wrote to memory of 3972	4384	msedge.exe	99
PID 4384 wrote to memory of 6100	4384	msedge.exe	101
PID 4384 wrote to memory of 2436	4384	msedge.exe	104
PID 4384 wrote to memory of 2436	4384	msedge.exe	104
PID 4384 wrote to memory of 2436	4384	msedge.exe	104
PID 4384 wrote to memory of 5028	4384	msedge.exe	105
PID 4384 wrote to memory of 5896	4384	msedge.exe	106
PID 4384 wrote to memory of 5028	4384	msedge.exe	105
PID 4384 wrote to memory of 5896	4384	msedge.exe	106
PID 4384 wrote to memory of 5896	4384	msedge.exe	106
PID 4384 wrote to memory of 1900	4384	msedge.exe	108
PID 4384 wrote to memory of 1064	4384	msedge.exe	110
PID 4384 wrote to memory of 2740	4384	msedge.exe	111
PID 4384 wrote to memory of 5560	4384	msedge.exe	112
PID 4384 wrote to memory of 1760	4384	msedge.exe	114
PID 4384 wrote to memory of 1760	4384	msedge.exe	114
PID 4384 wrote to memory of 2612	4384	msedge.exe	116
PID 4384 wrote to memory of 2612	4384	msedge.exe	116
PID 4384 wrote to memory of 2732	4384	msedge.exe	117
PID 4384 wrote to memory of 1536	4384	msedge.exe	118
PID 4384 wrote to memory of 1536	4384	msedge.exe	118
PID 4384 wrote to memory of 4776	4384	msedge.exe	119
PID 4384 wrote to memory of 4776	4384	msedge.exe	119
PID 4384 wrote to memory of 2356	4384	msedge.exe	120
PID 4384 wrote to memory of 2356	4384	msedge.exe	120
PID 4384 wrote to memory of 3708	4384	msedge.exe	121
PID 4384 wrote to memory of 3708	4384	msedge.exe	121
PID 4384 wrote to memory of 6092	4384	msedge.exe	122
PID 4384 wrote to memory of 6092	4384	msedge.exe	122
PID 4384 wrote to memory of 4136	4384	msedge.exe	130
PID 4384 wrote to memory of 4136	4384	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wickedzoi.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ffb7c87c188,0x7ffb7c87c194,0x7ffb7c87c1a0
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,16451619849534464648,7549736864626469292,262144 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,17786625434397222937,6680930391886973392,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,9410671802749264141,16189825242410311737,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,10207975476623763150,17516870341547649334,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,15484516727329150212,1943176756441610290,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,16829781597155051674,3527063379178638863,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,7595376785292295955,9944470037207458426,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5384,i,5807380916307635672,11539980811561239583,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16642024444174751901,609128535695277446,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,12915129763094198695,4732129335719490083,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17255788548129654549,6949251612935753119,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17255788548129654549,6949251612935753119,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6676,i,12830693933189772144,5467822639346917756,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,11093046623841243046,8349503484470288054,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6852,i,8987912318268843505,1161410849202397540,2097152 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,3948664719912087779,11481548962275964581,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,13104101902642687494,13973171613715080176,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,3475416726848848581,13464372479032859364,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,15228449385634356823,5570486987987043512,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,9768794661963025196,12501395890864039580,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10542933266777866990,2740760082531274179,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5404,i,9874818997783922330,626651382790046667,262144 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1812971340619628235,117810181497290916,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,13317897832779104666,999884748263591216,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,17057928125159227517,8328038165629605798,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,17872530772032969198,12132587188977245725,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,6625880658533516023,12845952738971115173,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,4054795203595149263,173647971850209456,524288 --field-trial-handle=2204,i,7537137031872315934,15065135322483590517,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4164

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8341943d-1bb8-483e-a5d4-2cb970fd372f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8341943d-1bb8-483e-a5d4-2cb970fd372f.tmp
Size 34KB
SHA256 f3d8e8ce55efa15ad5c7fc6612f6bd1c935ebb23c887c929fbcd3d72efd4b176
MD5 a827bb3a15f8b235eb06160e26f205a1
SHA1 7cbaf18b5b10d3ff8d053f6507d9a933a2a34652
SHA512 0fb7f289cadecebad598996abc177bf1f8f0a9b020e1eedb794516bf6de5a112106c7e1abdf84dccfbaebdd419b1bc216c54d464b69978b73aeb520b0446c77d
SSDEEP 768:CZ3Izhs3sNESO5kKJMIYNa8S5oYklnA+OZyCE3:CZ3Iy3J9TWRdAxdE3
TLSH
T149F2AF36B9E4A973DCA692C1B20B7A53BFA45213D2891FD8C6ED5F1E06C71AE4303811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f1bed99344df5b18e4d973b6ba74b46da098c73036ddcfb31c2bc029786f56d5
MD5 b57948b2258f33aaa4c8a0944e69c059
SHA1 ee33329dce1b4f936781bf78b37ba75584b80676
SHA512 4d7826745c319fa3ef8175024884987884c1d6e3c36d358f25c2b152fe9d67ea8de0d69edba0a4e296c7de84be5ae133aa121de62626badbfcbc3761a491c71f
TLSH
T16BE026840ACED22EA240F58781B88BCCC280374BA2CDBE8A1B488CC87047640F78A690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b1d330c6012d337d0e76e0e7f4493be9d83f590cab536354ec8812385812287d
MD5 64b5af29756b8470122fba79ff1561aa
SHA1 65a2b42aa10c92031e82cfb2303c9fce50427253
SHA512 00ed23e5de5f56961747e5c367d6f6672b446509f9da36ffbbe2f9b12cf24eb0a6536076c0d0ef9e0c1265ec69b9528d414f20afeb70a6666dba6d1964630136
TLSH
T133E026C847CAC62EA240748782A847CCD2C07B5BA2CD7A1A2744CCCAB542244AB83A91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 05248743f12e33661f2feeac0c39da3a5b3956c6e914f2b18cde124d3794113a
MD5 f9d9188a587d23273f8fdb220ea8a07c
SHA1 0e51c1c7ddbdba8135a645585f0b3521186c49af
SHA512 f506c75223a22aa26a0840f158c2a5aa41f7fa780a8dbdd418e722966e47ecbd6e91e77569101bdc3c294646c0ba7931b20fac0ebd4f425417130ee789a846a4
TLSH
T112E020854DCFC21D61807547C3A49FCCC280774FE6CDBA461B8484C9B1425547785650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4f467221719783ea0302a35bb0f89e9236de8cf7b2d463dcf2038295fafa3b56
MD5 1cc32ded0ff3e5abe743df5ecea074bc
SHA1 1e8279507046067950ca1e2f1725e2e29d511ff7
SHA512 8718d67ba9bc7ee5760ec91db65958687095aa739405c0d49d1d4a96b033e345f1dac7395458b12e1950872f0df27e38be4a6a52d50fa3e125b8230651067964
TLSH
T195E026840ECBE62FB246744B82688BCC9280B74AF2DD7E0A274488C8B082240E3C2691
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78a25fab733f59cbffceee0ef86029f6e14eff329f3d6877d9415873e3d88416
MD5 0d1bbba0e18fa9d412448a7a903542f0
SHA1 7f7ebd8cff137d1b1ab0f92a2953c96b4780fbbd
SHA512 dfd26182a19d9194380263d0a34856b172bd72453db2a5bd6746c62fd71a8e2014c90ceed383907aadd3936003f1bb89157b8e2a12459eb6cadb2b2c720827dc
TLSH
T1B9514D8A42AD4C57FB589572CAC8DC86BA38F970E283DE5001F4DDF619727B26072644
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e092.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e092.TMP
Size 2KB
SHA256 961083f21e2decbde779000117eea3fd9199db36fd2d9f798ec3ed19eb5fbe63
MD5 b4a03f58aff091bd190ace2267e4f685
SHA1 609950a96066e63aef352f5965df6793733bb816
SHA512 ed9bc13a23d7be05be6b6c65c9db9b4007d0fa0234f712ff02b3273dc34dd423eca01972023f0cf4c7a6ad967c72ca9efc9c7d88efffc9ae6228d1ae43b95ace
TLSH
T113515D4F42AD4C57FB585532CAC8DC86BA38F9B0E283CD5101F8DDFA09727B26072244
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4c2d00a37ea42d375f0b85dcfc7affc3c094fc5ea694ad25339a98c336bfdbff
MD5 b523afb020aa20f816328958f2c4a7df
SHA1 0faa85dd8147c61da71f6a828d8acda2aa50b427
SHA512 350bfd34e4b42f0c89cb6ed140c32cf8bf623553acf4926182f6c4a92e14ba659b5b5ab88f355e02d8abcd7b93f0e0e0ee74a7399f0bb01baffc5deeabd47528
TLSH
T1C3719EF7C3E8866D8D0196F4AB186E1ADF1D0919422C3C5A89D4BE5B93E3471E20165E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 20a3b44a106b38791f055a83889e4a914fdbbc8806df6bd15cdb4912d9bb6de4
MD5 bcc6edeae86b43d361b711cb808ca973
SHA1 abe8e399a402c7e36eb02e5b5646a1bc34ccb07c
SHA512 e71acf4b0b679a07491bc3c98ff12ca6ed826dc643dab32f8d41e0bf2a994d35fe4823a65b6a36038bb57d5bcc29a6f4b575b5e385120fa2d0c4eca9fba9c81b
TLSH
T1EB71CFF7C3E48AAD9D0196F4AA046E1BCF1D0515832C3C6AC9D4BE5B93E34B1E24165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c1f0c2119119efd30e9b0a9e11bef2c1be40b088a4327caa229056c58e5ba027
MD5 51fabb8ed268ea2a951eff1702630b61
SHA1 a350201679fe7c8fb8942de87fb1bd0631f2ea67
SHA512 46901d1b39d5eea34e66c69c67ba83a02ce4ece0322c887b1761faee88f92e9bf01b8eb0f84c359b24b9e68e9201bef6ca4d7ac0eeafad245dc596f6026bb222
SSDEEP 192:sxRRRrbj/fss0NpqzoA8p2g/g6+WNANTn/YuVihGnIgIJ:sxRR9j/fss0NpnX/5y/rs
TLSH
T1E532B7197D28A93B9CCBD20DBB65BF53E2F91432A1951F48A7FC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 77532ed7aee227d793c83df5b0f4f3ed08780312a3d391e08eb16ce987881931
MD5 0b155e929f5a6f85c00e6cb6162aaac1
SHA1 974135d8caf85ce0dbb659d63e96644d65b1530e
SHA512 4493ccc92ddbd174096789c845bf20aa7d2116bb23fffa4ddd508f8e1433068547da356eef14f429d32f2d3d36b5b9bd6e49aeaf2cf6f38bfb97ecc927f9815c
SSDEEP 192:sxRCRrOj/fssTApqzoA8p2g/g6+WNANTn/YuvihGnIgDfJ:sxRCwj/fssTApnX/5y/p1
TLSH
T1BA329619B928A93B9CCBD21DBB65BF53E2F95432A1911F48A7FC971C04E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2af6e941f5bc1083deba9379dac3b24dc44b0f1fb0dbed576b9e9110c31b6a9e
MD5 aa710b5b9b677a517e5cfa5f17b4a665
SHA1 cb66808c14571b837a90e5bb2d2d22added94d56
SHA512 2da17919bfa680d1f2f85841ef0f933fb8402fda7a122644829ae17eaa4dae51c5b66928655aa8a9b0ec1f9c7b4f6e30c230e73f3ca8071a66f848bb36877567
SSDEEP 192:sxRCRrOj/fssTNpqzoA8p2g/g6+WNANTn/YuVihGnIgD5J:sxRCwj/fssTNpnX/5y/r3
TLSH
T1D132A719BD28A93B5CCBD21DBB65BF53E2F95432A1911E48A7FC971C04E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 49eb8da439a71c144a9aa5590f86b5498277441973ffe90104ac633be01795fe
MD5 c655d683ea1651e566ed1008ebb528ad
SHA1 099d80e284089f8414ce538c4b4729c63325ffb1
SHA512 d34a78881fe2923c77a32855ba62c600ae71e69da712e3d2e8618f075d6005a59610296c248e447c577942d00b4b6f4a456e7bd039d89e9255e2777ac61b2472
SSDEEP 384:sxRCwj/fssTu66s8qMpRiYnazAW8pZS15posJWeT+KpnR/5y/p1:sGwj/fzu4Mnc7WeT+Kr/5I3
TLSH
T101C2F809A914C83B9EC39D19693D7E33EAEC506221C5DEDA56ECCA1C019E1FDAB07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 33bf7d467c79da9ef7d86647615c9f05053382c9fef545243ba621c8c4cc3603
MD5 0b041241a68f12719ce5b98000e26310
SHA1 e5e4c72ada2906177eec4375c248833559ea5844
SHA512 9f90d144c97a59ee83031d6bc02d953318ce21bd26d883a4d75309a7f97091d6b248284bdb9da825ed35db13c0a4a85513fc3fce8b52f837fa757d0a9824d04e
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6YrocbR:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VE
TLSH
T14BB2EA2B644CCB7E9FC00AADEC196F976D9C02C796988D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f9180a05-71e8-4247-9e54-fd9c95e44e91\index-dir\the-real-index
Size 312B
SHA256 0a734826d8e70c51debc17a63f9e674ecb61404c162079c0cab518eb0775b754
MD5 5871b68599280229d77d6321c823eba1
SHA1 8623e9e3e0012b934bc083925f778fdb31bdc0e3
SHA512 87e9b11a0f79245d7e541b3a3fef313e6cc16f4ffd6504132b4a66503e6e5d793791f433e8eba68129f7188a60e4e22b2aa8c09e74de4adeaf45025903310c1f
TLSH
T1FDE0A79E9D12A806E8A969B1307661B266B038ECD344561F10FEA00F5C917A0FD56B28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e03f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f9180a05-71e8-4247-9e54-fd9c95e44e91\index-dir\the-real-index~RFe5e03f5.TMP
Size 312B
SHA256 1ed6bced03111d5436957dbc8ec1069e76b4c6f23081fdda4bd046b86606ecd5
MD5 bb3df136803f9866478924ad6f5859f3
SHA1 ac9ebf053a44797bfc4008248cdd7ef8d8e8414e
SHA512 36f270ca689c40afcd938288a552943520dca27361bde84af2e65ae1471b2241736ec297ac2092931ccb6a0f1a2c7143ad1f3024ae102c14b7a32a1212f0e675
TLSH
T1B9E0970C09228007E45990B124A6717222702808C208231F42FF848A8C816B0EE02704
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 934d7f3881de4473b6b496bbae0329f52a9be35c9d78254d529b8b5a1499c99e
MD5 156a13fbd95dce990cbdbb98707e6f3a
SHA1 789f2fea91cd774216b4c78d40fa3230675558a8
SHA512 8761264ca27be0c17eab667f04e8ce65e8fc37745056654a0d83b61239bb9763e787ed37dbdc38f4f7abde53ad968d5bd027070e18c7c0cf4dae8b89b5ecb389
TLSH
T1F5E0C0F729B71C04FC9FC3C6243148D00456B894C906FC4E401AD7A780A13C7349DC35
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a60ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a60ee.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1a9d6f770ed0ea0e7b363188012a4833acb5a046f86738cdc047d58ec2988ed8
MD5 d832468be36b4f4efacd76d253de0913
SHA1 0607c2a409df27cd4a45ab219fb9953de3096029
SHA512 924e6c7df9e198131d1644368ad946d6480578a892722efaef19eb7bc403453cb61a1d62273403f6cd5c53b549b4b5c0a7c83bdd1df479fcaf9f2478d4b23910
SSDEEP 768:5B3Izhh3xeSO5kKJMIYNa8S5oYklnA+OZyCE3:73IL3E9TWRdAxdE3
TLSH
T1BBF2AF36B9E4A977DCA692C1B20B7B53BFA45213D2891FD8C6ED5F1E06C71AE4303811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a1779d6956b53f704cd0b88746f4d58b5dbb0881e5ef8ae3b98cc1f837a329de
MD5 b87c7a59090d6e7c310ac7edc73ff37a
SHA1 1a5b06fa54e458f2ce7b11595130b55716614fed
SHA512 cc123aaaf067fa080aac24e5215da9fabb1247a2ac3f560f0813b7244f4ca2f9699c257dfbebaf1bec2fd35a1fe27d9160d4a03a5dd85ce479e0fce23649e266
SSDEEP 768:5m3Izhs3HNESO5kKJMIYNa8S5oYklnA+OZyCE3:c3Iy3S9TWRdAxdE3
TLSH
T167F2AF36B9E4A977DCA692C1B20B7A43BFA45213D2891FD8C6ED5F1E06C71AE4303815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 caba83ea045ebc2dbc8fc355a4e361b8bd3c8d7f8f5daea773904130a1a6a284
MD5 cf3d55e164788ace8e474117cc7d3327
SHA1 fcced0832df4188da55ee4896513bb28f041754a
SHA512 c0a276d90d6912693312bea4d6da3671dd722ba5a59d884243090ea72a9d07316a1a9e3e75c519a47d9617b1cf2d01c92d33dafa5e3215f1f91f1aaee64def21
SSDEEP 768:6RF+3IzhH3Ywg1NESO5kKJMIYNa8S5oYklnA+OZyCE3:6O3Ip3bZTWRdAxdE3
TLSH
T1F9135AF6A9D39577D89E5783A33E2E42AEBCC153F1845A94B3D81A1DCD861BFC302810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4c90a5e4392ee478794a0807cfc1db4d2afae27e5c2c225b1c1ad51485293a11
MD5 b82aa7ee6b6f1ad3a16d1907bc5df5a8
SHA1 97dbdaa6aa2e7b79cc496783353566466f52fa39
SHA512 66b892d17c4f664fd0aee912f3e10ca09bbe982538b5eb760708a7cdaae06f67a6a68486ae100907519e373811002b3469aa651984bce2b95ea977339af51352
SSDEEP 768:do/UxvxjgC+23ZfRSO5kMJMIYNa8S5oYklnAa0aSH8L4:nZj3+235FzHTWRdAgS04
TLSH
T1B603C03AAD94A873CCF663C4720AA357AEF55123D1C56AE88AEC1F0E17C72AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download