hxxps://www[.]zoominfo[.]com/p/Tahlia-Free/-1391838859

Analysis

user interaction
yes
max time kernel
209s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.zoominfo.com/p/Tahlia-Free/-1391838859
Sample260928-e3espavcke

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{BAC588E8-26F1-4DD7-8D7E-958FA99071EA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{FE1B34B2-A990-4DE6-83CC-D44579F73DFF}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5488	msedge.exe
5488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4808	2176	msedge.exe	86
PID 2176 wrote to memory of 464	2176	msedge.exe	87
PID 2176 wrote to memory of 1420	2176	msedge.exe	88
PID 2176 wrote to memory of 1420	2176	msedge.exe	88
PID 2176 wrote to memory of 1420	2176	msedge.exe	88
PID 2176 wrote to memory of 4012	2176	msedge.exe	90
PID 2176 wrote to memory of 4012	2176	msedge.exe	90
PID 2176 wrote to memory of 3940	2176	msedge.exe	91
PID 2176 wrote to memory of 3588	2176	msedge.exe	92
PID 2176 wrote to memory of 3940	2176	msedge.exe	91
PID 2176 wrote to memory of 3940	2176	msedge.exe	91
PID 2176 wrote to memory of 3588	2176	msedge.exe	92
PID 2176 wrote to memory of 3588	2176	msedge.exe	92
PID 2176 wrote to memory of 4596	2176	msedge.exe	93
PID 2176 wrote to memory of 4596	2176	msedge.exe	93
PID 2176 wrote to memory of 4596	2176	msedge.exe	93
PID 2176 wrote to memory of 4896	2176	msedge.exe	94
PID 2176 wrote to memory of 4896	2176	msedge.exe	94
PID 2176 wrote to memory of 4896	2176	msedge.exe	94
PID 2176 wrote to memory of 5104	2176	msedge.exe	98
PID 2176 wrote to memory of 5104	2176	msedge.exe	98
PID 2176 wrote to memory of 5104	2176	msedge.exe	98
PID 2176 wrote to memory of 4180	2176	msedge.exe	99
PID 2176 wrote to memory of 4180	2176	msedge.exe	99
PID 2176 wrote to memory of 4180	2176	msedge.exe	99
PID 2176 wrote to memory of 3340	2176	msedge.exe	100
PID 2176 wrote to memory of 3340	2176	msedge.exe	100
PID 2176 wrote to memory of 3340	2176	msedge.exe	100
PID 2176 wrote to memory of 1996	2176	msedge.exe	101
PID 2176 wrote to memory of 3064	2176	msedge.exe	102
PID 2176 wrote to memory of 1996	2176	msedge.exe	101
PID 2176 wrote to memory of 3064	2176	msedge.exe	102
PID 2176 wrote to memory of 4516	2176	msedge.exe	107
PID 2176 wrote to memory of 5700	2176	msedge.exe	116
PID 2176 wrote to memory of 5708	2176	msedge.exe	117
PID 2176 wrote to memory of 5716	2176	msedge.exe	118
PID 2176 wrote to memory of 5512	2176	msedge.exe	127
PID 2176 wrote to memory of 5512	2176	msedge.exe	127
PID 2176 wrote to memory of 5512	2176	msedge.exe	127
PID 2176 wrote to memory of 5672	2176	msedge.exe	128
PID 2176 wrote to memory of 5664	2176	msedge.exe	129
PID 2176 wrote to memory of 5672	2176	msedge.exe	128
PID 2176 wrote to memory of 5992	2176	msedge.exe	130
PID 2176 wrote to memory of 5992	2176	msedge.exe	130
PID 2176 wrote to memory of 5476	2176	msedge.exe	133
PID 2176 wrote to memory of 5476	2176	msedge.exe	133
PID 2176 wrote to memory of 5488	2176	msedge.exe	135
PID 2176 wrote to memory of 5840	2176	msedge.exe	136
PID 2176 wrote to memory of 5840	2176	msedge.exe	136
PID 2176 wrote to memory of 5800	2176	msedge.exe	137
PID 2176 wrote to memory of 5800	2176	msedge.exe	137
PID 2176 wrote to memory of 1868	2176	msedge.exe	138
PID 2176 wrote to memory of 1868	2176	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.zoominfo.com/p/Tahlia-Free/-1391838859
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd2e2ac188,0x7ffd2e2ac194,0x7ffd2e2ac1a0
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,13187677789537256308,2245381192730904745,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10946502514217047195,17551409889216922578,262144 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,3448679369938425781,6126903342914740298,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15911069626103245379,16677757029779014444,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,7241821103184959271,11582121333635980995,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,8747450861553761256,3713399972532229482,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,4192074689627093948,14318268454803815261,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5388,i,6340237983800487998,2884961672749618812,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5364,i,15298045078901294388,16811642563809274774,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5916,i,17855766047581789468,4957410373330857524,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15404891770735481321,3436013846722474674,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,7512237630104382682,6302844455900351395,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8607188313795261851,7887612996692432879,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8607188313795261851,7887612996692432879,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,12144664961020250229,11342116998527662277,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,14153374565710509974,14249171558581384895,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,12202260090953403798,11103975979404370834,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5388,i,8715387509554481714,4490756963759522517,2097152 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,18111742909495345274,6316372205618530380,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,4034558198868911139,9334106394638318357,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5119406582680570865,6384446669508080239,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,16414941457999905597,3274105068275767841,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6856,i,8080309483567609140,3284329405733363832,262144 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1048,i,8289591371165613157,7591162585452163585,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,2300680448646362373,9348061580511352871,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,4079109751640475149,18267241960140211335,524288 --field-trial-handle=2120,i,7881978713431084937,164499972635627918,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4c19d7be6779f05a510fd8f0509b519b7fa277f7daecf5ceaf7b9565dedbf80e
MD5 b440f906a946e1bf62e8ea0678a9c7fe
SHA1 432c0f33ecc44abf0476758cdff00e7851d50bdf
SHA512 1d10f2c70f029be79aaac0be0f63cd0724bd0bc869923636c3f42af76149c357d99e4eb0f469864327dc13954b118aeaa66490791a44a5309964c0efb14da2cb
TLSH
T1ADE026CC2AC8C27FA214B4C78979471CC280372AD2CCAA9A1B00C9CD7202A51ABCA691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f9158aed8684bf5f9cdbdd07741a0911eccd866b68036663f853a5d45d59a551
MD5 b0dd8c6b0059e2df922d8379e0553570
SHA1 c7d7f81b9e7e621b5b132e37c58f3f0d00586177
SHA512 9103909a58c6590b6195af315c3ea009ab7b73116ceba8301e3ef546bd9f9dd5d69f7df39497ea749aaad50fdd67baa4069d11f4a725940d58a427f061c47df8
TLSH
T1DCE02698A9CAC22FB240644743BC878CC3A0370F92CC7AAA1708C5987201854A7E2A91
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3b3be21f3836c83f8db79b48b3b81e9bdafd8da5fde4ce9f0aa0640ff1fecc5a
MD5 dc8675ce60f6a965b89ecd93574114b5
SHA1 89d5b6758dfc2ed26b23ffd5b487e58965c1999e
SHA512 c1e213064cdd53832d5ef53619e676b3c77a6bbe23178e111379b31aaf78c86bd47f4d64d5a8d83e5f1030478835c5495fed954f82bccf5ae61206295d6d31e9
TLSH
T17171B5F25B60EFECFBD878328EE316873AF809411C931F5E2960D4BB6E1A7544009003
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 24b4257905c3d9109ed08005cab4bc2c45f8edfad03b76ead1165531f10d93b2
MD5 ae87880ed0bccf8dcd7f1bee3473e425
SHA1 e154ac7713f6028dae74f3af8b54cf3c045d33cf
SHA512 4c1c8e8fb77e4ef5b1711d3814d05f300ad5483758435d5872cf8963678443f26b5b8cf27fdaada314a00f9203842d8f01c7f7c9f9a628867ba154006c5d62b1
TLSH
T1906195F26BA0EFECFBD879728EE31A8336F849815D835F5A6854D8BB6C0A754511C043
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_frapi.zoominfo.com_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_frapi.zoominfo.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 66ee867b56c37a54397700d6428988a156ec759f2fe8c96cd02b1b476462ff5e
MD5 75df770f25df1947963af337e4d64fd5
SHA1 81375c2d2bf5d681adcacd3ee067fbee12deccb5
SHA512 075f38c61d7fd6420d6bf0bfdbde0f816b921d64113cbb35fb98e6a1be27bb1eedeb53e11f5c76e505b8ddace51e0acdba55410fba843fa985b2b5e75bad73e8
SSDEEP 192:D2ShOeS8zTb9do+PKUUhGQjsxHkVMV5NHkXtWJJ8p9PR9Sp4wN3u:D2ShpS8zTb9do+PKUWGQjsxHkVMV5NHe
TLSH
T1A3126DB787F4DE3D8D3251F0AA266D2FCE5A091853583C5A84D9BF2763D2460E241B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9615d36976fcb70f5ff2f0c244134bc38d7bc3c24a9dc54de3ade3746532f630
MD5 cfd13e88a162c39c2d7e1877f11f6f84
SHA1 2d5c747a2394c9432e67859d263bc881f0552aa8
SHA512 f81d151f06100b312c57fa24b5f56187464824bfc77f8aa78b7436caeb4b01496a30638021d904864951581f1fb7444a150e4983813eae2963293820e7411d25
SSDEEP 192:sxZ2RxWi/fUskYuIdpLsHW6+WN3H1/Yr/o9dIgrJ:sxZ2Si/fUskY/QHbl/E49
TLSH
T1B522C9626E38A97B8CC7D21DBB19BF13E6F9403251D51E48AAFC851C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 27040518d4cf3127cc278bee13baa06b269093acdd18447f4733e528103d671b
MD5 8ed038ad0fe32a3bfddd25281fc75c5b
SHA1 1e253ac0e363da05ff7ed1b92495a6bab6733c55
SHA512 f2df49bd732f0a3467aa2e591695dc8916943ecec6395c8feacbff9b5a01897596e1a8075c7adfb1fdf50fd3dc486afc5a6eedd623a5b9d18f40056d0645ed9c
SSDEEP 192:sxZ2RxWi/fUs/KJIdpxmHW6+WN3vbXYrU9dIg52J:sxZ2Si/fUs/KCIHbDXVc
TLSH
T1D832B8A26E38A97B8CC7D21DBB15BF13E6F9503251D51E48A6FC861C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 136d63be0c460e0ec1f9f932ddae25f04fc8186cd4c449338d886f3a42d94687
MD5 8f72d7934ceaa19f61490bd5243255b4
SHA1 b0948e58f445f085270d5f6257ca745427ff2f15
SHA512 65471d9f5a6fbfd3bb50ca7126427abae2d379bc56cb86c9e3942f1dfe06795f796b7be10943e596a5260fb27162f0e08b66150deb4f0328154113d7227fc7c1
SSDEEP 192:sxZ2RxWi/fUs/YuIdpLsHW6+WN3H1/Yr/o9dIg5UJ:sxZ2Si/fUs/Y/QHbl/E4u
TLSH
T12722C8A26E38A97B8CC7D21DBB15BF13D6F9503251D51E48AAFC861C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 77339c104168ea28cf81eeb9e0b727d2ec378bcb7ce3d44634a76bd691547e65
MD5 460aec1b6e2cfc46d2fefcd3b04ecbcf
SHA1 74a8ec349d4ce71dc0de94abae778d83cbd38f9d
SHA512 79d0d289e9ac42463f6bda4a0750cfa39dfc6a6e249722324ddbff9db17b0b3cb285ada52d3ccbc89a21c49f4bb99c8fbbc37da5f9cac5ca815761eb6758a61a
SSDEEP 192:sxZ2RxWi/fUs/KJIdpLeHW6+WN3H1/YrQ9dIg52J:sxZ2Si/fUs/KCKHbl/Fc
TLSH
T18322B8A26E38A97B8CC7D21DBB15BF13E6F9503251D51E48A6FC861C09E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 992f362f48714920a25c83677289c4b71f0eb7f62bdf340bd3b7a99ae3d652ce
MD5 13238b4bc0153a9cd8f97dd62111f971
SHA1 65646c9c91c8730feb7cf5ca2152c0083ae3e430
SHA512 bf5a4c601e92b872775c964446881acf2612ea9d67db45796b7ce58367747e5e4649f47af2ab5c508b0ebc46d861e45b9680ed4cca65024281c65e83f903c494
SSDEEP 768:4Jy4J/DWvbtJh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbrroRYV:4Jy4J/DWvbtJhu1jajiLm0bYKV
TLSH
T104C20B3B684CCA7E4FC00B9DDD5E6F9B3E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a903add365c1ec787973245c4b997a01521dc1beeab1df10b398ff8f8b31a067
MD5 4814112a477f812bdf0e139720eeb661
SHA1 c95947bc9bacd37df0d155e9a4a00d50933d2a9e
SHA512 edbb04dc6a018b855fbe69df7918b940d97842f6db5ae29194f5a15152aa582374ef95ca6c5495e3f79a935eb64ad7c66741e1b33f7547280bc6ad6698050086
SSDEEP 48:KIDI1Ks04jyLCNQ8CgARbcrMISURK9Y1iRxaBYDUAyyLitwciAgxb8LsIS0xK94+:KIDCKs0+mZCKSQq2Z6KiIx9mK2Qyg
TLSH
T1D5B1115130BB220538BD244891B18B5B524236B37568EA7B7F7D40A58E6FF086FFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58f12184-00ba-4265-b5e4-bcef57a6896d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\58f12184-00ba-4265-b5e4-bcef57a6896d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1a0ed9ff03da0d3c3f2fd8040076b25921b86ce1d34c316ed799eda0893d1448
MD5 96713657c76cab959d7ea03832e433cf
SHA1 f9aee774aa6e7175af46435432220ddf26704fa0
SHA512 7d6387b9382860c50fdff9d46c6650d8ec72e730f4b7c345841b034dbafe9d7013ac551923aaf046bb3aea5146857c632fa5f8080dd0626bf26ce4aaedeef686
SSDEEP 384:bZcIhsNsam8usuMZylaHX58EN8j2X9Ls6tgOIwZOyyLBov:DhZ8uy4cap2Zs6XsZ90
TLSH
T1FF828D32A878AC7B5CF7A195F64A36039FB49027D3CA6B90C5FD5B1C01EA2A81317D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 57f22993f50483e0a77ab4f2a2ca33ba4acf3d627144f959ea31660d07e78552
MD5 e1013cbfcfaa3dfe559c3f02d9dd80d4
SHA1 f43ca9fc82035a0f5ba607d462621637380946a1
SHA512 37763b1a328689f6a398b3a9f93a5890a8c4dd3e3bddf596becab8d7d19091661a6b8480fc018202b7da3f5d714a813bad94931af38cb1a242d3c0e52abac328
SSDEEP 192:1ONN6wlDnQmiUyzgG4X58gZxjzorQo2X/FIEBvecq0U6:1ONN6kJ1G4X58EN8j2X9LQ6U6
TLSH
T1ED120932A878AC3B5DE2A595B58735139FA55117DB893F80C6FC1A2C01EB6AC231AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8de07b4a9e4b257e2b0e397721f45abfd9bbca0c65ca48d4cd38756add6c2459
MD5 a3e6306d55cc55d11d1481339ecfe499
SHA1 931d762933cf2cfb6a8d7cda576a0763cfac2240
SHA512 0f5eb839b1b957167bb524cfcdbfd1e19c245159df54bb4ff09642e63e6e20841e51b2b42df95d2f38e65869da75eed0a0484aed5c032f43c6549012f521f8dc
SSDEEP 384:DZcIhsNsJm8usuMZylaHX58EN8j2X9Ls6tgOIwZOyyLBov:bhQ8uy4cap2Zs6XsZ90
TLSH
T1CC827D72A878AC7B5CF7A195F64636039FB49027D2CA6F50C5FC5B1C01EA2A81317D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 831584006e7f8684cef5284eebfefb7fd4215bf3e705b4e83cfad479b6215273
MD5 5ea2856f8530ab31c5a5d13cc0f5d1d9
SHA1 5245d317eec005d1e7c80a97513c5792ce65a162
SHA512 7db62bb0bf75b9ac07052e168c194bb6beed17655a7d58764210bf1692c31c4b045540ee641dffd884ad4456087a5e47bab01fd8c830fe10b3b8c1cf9d9bc7a8
SSDEEP 384:bFiFiZcIcJzsNk8TUNTUlIlJm8usuMZyWb2HX58EN8j2X9LB6tgOIwZOyyLBov:AFQaFwg68uyXbQap2ZB6XsZ90
TLSH
T101A28D739868DD7BADF79A95F64A36038FF44067C6CAAB90D6EC5B1C00971E81307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b58f4a715cdf3416b1eaf6cf8035538c8cd05be7cd5f34b90f8eb5b0e1d5213
MD5 61caeb15bcd8e86ede82266ab45789ae
SHA1 5f22240add54154cf3d025a722659489f1e3e2c1
SHA512 d431edfc1a07b0b54105d13164ad5f116ca0ea7f65d495aeaa4e760eb431aa52c1c0ee65ff2516009e32d7a11c8d69c49cf3e03aa3399d3d63ed5d88e22ef233
SSDEEP 192:1ONs6wlDgQmiUyIgW4X58gZxjzorQoWDl4/QU6:1ONs6kgEW4X58EN8je1U6
TLSH
T18A02F835B9787C7B8EF2AE49F58726139FA5102BD6952F44C6FC0A2C00D765C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4ac1e75102eb4f8cc81f4285b0d6ffd4909a9ee2fc28be6fa9f860981871df50
MD5 2467078c3e924a943b29d945d46feda5
SHA1 f8452f1101e9c37e3cbcebcff9167dd662c20371
SHA512 15297121aba2cc5835bc0a529967664e6596978c304e2515ed9b8b552c40280aba4714fadf608ec4f9e22288dcdb9dd63ef246afce1265e5d1a06c040cb74a98
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59ad8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59ad8c.TMP
Size 392B
SHA256 cbc379daab453bdf7985f64a1b6ce4db362dff8de6d6ebb0a1b61aa288a98462
MD5 82c868202673924c4bb35aad07a5f8a1
SHA1 7ee5d90d9f408b3ccef97bd82649d4e6258385a5
SHA512 d935ddc4c2679ec388676b58aa760d3b8bee20f981adc67c32e1264845d07d58fd0d4a505179d8d8f66f1068655472712d4eb1152fee02f66347220c18ac008b
MD5 SHA1 SHA512

Submit Download

4d603103-b0f1-4e75-8b20-40e4d47cda0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4d603103-b0f1-4e75-8b20-40e4d47cda0c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f00050b01c3c0c89d29786e318ac603ec300a1caa96cfd3d7440271251a8dd41
MD5 061b51219ba6508a2ede2e17d66aa312
SHA1 107ec5136e0e2d5e5102a81a4d4b3d5e3dd03a5d
SHA512 5fe2dea0baf851172511425e007ee43ecf4258811c14a152d1c7d581a3ca197742ccbfc789d03650c8ffffb29942535d8609999bf2f4624c1e3699379a5b31ba
TLSH
T145410AA8A6E91108B3B7BF1BABF6A86D447B7D772E06D45D10010D4F0A76B40D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download