hxxps://uploadnow[.]io/en/share?utm_source=lYDD7P8

Analysis

user interaction
yes
max time kernel
58s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uploadnow.io/en/share?utm_source=lYDD7P8
Sample260930-z9m3vsae85

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{869C6AC6-9421-48A5-A59F-3F3AC3727118}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2344	1160	msedge.exe	86
PID 1160 wrote to memory of 4884	1160	msedge.exe	88
PID 1160 wrote to memory of 4088	1160	msedge.exe	89
PID 1160 wrote to memory of 4088	1160	msedge.exe	89
PID 1160 wrote to memory of 4088	1160	msedge.exe	89
PID 1160 wrote to memory of 5048	1160	msedge.exe	90
PID 1160 wrote to memory of 5048	1160	msedge.exe	90
PID 1160 wrote to memory of 1460	1160	msedge.exe	92
PID 1160 wrote to memory of 968	1160	msedge.exe	93
PID 1160 wrote to memory of 1460	1160	msedge.exe	92
PID 1160 wrote to memory of 1460	1160	msedge.exe	92
PID 1160 wrote to memory of 968	1160	msedge.exe	93
PID 1160 wrote to memory of 968	1160	msedge.exe	93
PID 1160 wrote to memory of 3468	1160	msedge.exe	94
PID 1160 wrote to memory of 3468	1160	msedge.exe	94
PID 1160 wrote to memory of 3468	1160	msedge.exe	94
PID 1160 wrote to memory of 692	1160	msedge.exe	95
PID 1160 wrote to memory of 692	1160	msedge.exe	95
PID 1160 wrote to memory of 692	1160	msedge.exe	95
PID 1160 wrote to memory of 4652	1160	msedge.exe	99
PID 1160 wrote to memory of 4652	1160	msedge.exe	99
PID 1160 wrote to memory of 2408	1160	msedge.exe	100
PID 1160 wrote to memory of 2408	1160	msedge.exe	100
PID 1160 wrote to memory of 2440	1160	msedge.exe	102
PID 1160 wrote to memory of 1460	1160	msedge.exe	105
PID 1160 wrote to memory of 1460	1160	msedge.exe	105
PID 1160 wrote to memory of 1256	1160	msedge.exe	106
PID 1160 wrote to memory of 1256	1160	msedge.exe	106
PID 1160 wrote to memory of 1256	1160	msedge.exe	106
PID 1160 wrote to memory of 3304	1160	msedge.exe	107
PID 1160 wrote to memory of 5692	1160	msedge.exe	119
PID 1160 wrote to memory of 5700	1160	msedge.exe	120
PID 1160 wrote to memory of 5708	1160	msedge.exe	121
PID 1160 wrote to memory of 5880	1160	msedge.exe	122
PID 1160 wrote to memory of 5880	1160	msedge.exe	122
PID 1160 wrote to memory of 5928	1160	msedge.exe	123
PID 1160 wrote to memory of 5928	1160	msedge.exe	123
PID 1160 wrote to memory of 5928	1160	msedge.exe	123
PID 1160 wrote to memory of 1452	1160	msedge.exe	124
PID 1160 wrote to memory of 1452	1160	msedge.exe	124
PID 1160 wrote to memory of 1452	1160	msedge.exe	124
PID 1160 wrote to memory of 4568	1160	msedge.exe	125
PID 1160 wrote to memory of 4568	1160	msedge.exe	125
PID 1160 wrote to memory of 4568	1160	msedge.exe	125
PID 1160 wrote to memory of 2836	1160	msedge.exe	127
PID 1160 wrote to memory of 2836	1160	msedge.exe	127
PID 1160 wrote to memory of 2836	1160	msedge.exe	127
PID 1160 wrote to memory of 4564	1160	msedge.exe	128
PID 1160 wrote to memory of 4564	1160	msedge.exe	128
PID 1160 wrote to memory of 4564	1160	msedge.exe	128
PID 1160 wrote to memory of 3336	1160	msedge.exe	129
PID 1160 wrote to memory of 3336	1160	msedge.exe	129
PID 1160 wrote to memory of 3336	1160	msedge.exe	129
PID 1160 wrote to memory of 4820	1160	msedge.exe	133
PID 1160 wrote to memory of 4820	1160	msedge.exe	133
PID 1160 wrote to memory of 4820	1160	msedge.exe	133
PID 1160 wrote to memory of 5960	1160	msedge.exe	137
PID 1160 wrote to memory of 5960	1160	msedge.exe	137
PID 1160 wrote to memory of 5960	1160	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uploadnow.io/en/share?utm_source=lYDD7P8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffab7c2c188,0x7ffab7c2c194,0x7ffab7c2c1a0
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,15461435310116968712,6683635381730596380,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7298010166714091635,13656587437593984895,262144 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,10142967499963026445,15600412633319110722,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,190979629352694049,10105610252158249667,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3244,i,4897348433609932950,3890532315492370731,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9373655516982582108,12103777277048478098,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2926550715142825429,10682594824365739327,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,5201356540155241076,7252726494469334927,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16582778449922784777,7786092604346973375,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1329798620069067083,10651955891046072159,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1329798620069067083,10651955891046072159,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,8745908938518618665,2326314997580600773,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,18317525653349405513,2339718024970615944,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7945754208658158389,9186561859552461654,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,6873167614929505672,11166443943704253480,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,14914752350398257342,6688969263657952643,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,9960230743414991056,4928806504073483289,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16109815708215616361,8193929021943373952,524288 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6456,i,10278881978919836431,8134240077477679236,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2924,i,4929961153509802122,14844839271575966709,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7152,i,2592456330996818999,1944378344655500265,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7072,i,12897915759798542485,16233078198494742529,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6356,i,17074598061007315332,3080937202444431859,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7104,i,8114306183115133239,12499669122532531361,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6732,i,13785386344524846852,16571122220803008177,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3992,i,12003401295966506101,16816901306887687606,2097152 --field-trial-handle=2304,i,16725872231191299078,14733094510469318883,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 fe75922cda05f1549b451bcf16e1c6f077a264ed730f03fb5488309bcb78ce79
MD5 e2b903ba1f7874e4a3b4dc17710eabb2
SHA1 9da985f7d0be2c677fce280e639845fc7bb63090
SHA512 93d2e7bd8f3f82aae07d30941ab9a188dee14fa2796cddfccd7cfcae203c7a05d0aeb9c9087251acf9305a1ac558c623aa0dddd064155b369ea84614559238a4
SSDEEP 96:bPMf4CpI0KhPSxCFIOW3PYCPxZNC5nOz5t0W/fvaSarR:bPMbGPykRMPnPXNC5ON1CSOR
TLSH
T14CD12D72608F4C26DF545A3C39E119433A3879B5C08B1F7A8CA0F9B7BFBA7965090947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4c399b3b87eae91eb23a0b2b7a69e2a05c38a3da3f1d837a60548a174f86e3f1
MD5 43c61229afff631dbb98f1c87d29985e
SHA1 c1b0e725fb106d037216fa8feb29d61011978680
SHA512 c3dc1d6177db390f74ff64d8775e45a49aae8c68e6d02912015816218f68b89cd707413f44c0a7eb6e303ad64e3c23808b9b0ea1b2de9f45bf7a1bc51496d49e
SSDEEP 96:E4YOvfkfCIs6m0G5O3IQqNbcqnoC5Va7Sd:LN3kAtt50xyA6oC5VeSd
TLSH
T14D916F72A0CF8C16DF54417D5AE118473A387DF4C48B2E6B88F0F8A5BFAB3965080A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e4fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e4fc.TMP
Size 3KB
SHA256 ff4a5fd186d732c738d48f74b466bd0b9c5895c11bdf471590060d5cb9119be5
MD5 68bdbf9b0af919f0c12def41209d48a8
SHA1 8abb8b98455f43ec3c3413e0af20fa0468e4197d
SHA512 996ac0d7ff20667e95ec9ff1600ff8bbda726c9c44f8abd3090dbbb636a8878cc07f8047b1c8db57fa4cbb9d2c6560767d975dbfcf1b61de2a29b3d71df9ca53
TLSH
T104615EB1348F8D57EFA855BC99F4108B3A3C7DF041832E4F89B4F8EA47AA3569040847
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 31ef41d3c5c503b12764a300ad6f5f36485c980dc8a13aa17bea2d610dec8d4f
MD5 e6f472a1ec2f383c2f62576ad4b95055
SHA1 f32234211023de3f229a8aea3668b252b0276e2e
SHA512 abd6545d59f70052b8d26b8b0b60d3787e3347cc483f04c3b0551872627c2eca0cb92a89ea570eac07ff35d5e1ba3ca50b644ec1bb8523835b9e059223892b63
SSDEEP 3:MsEllllkEthXllkl2zEkl3+t:/M/xT02zn3+t
TLSH
T1B34404147FC00C05D55010305411C3501370DC504511575334510413FCC5F530C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 6ec50040ccdff3531e2f8b5f64f62f149cb9692d51e87243841530e4efe6e9cf
MD5 326abff88c2a4c7210dc6dd5e1ca9546
SHA1 34e853f6ad8ea862d2b8e6abdd6cd93074a336d3
SHA512 422634ca7d4e0199e5f626843e7fd703dabfe61a28956ff542c007b6435b80aece1b72655b29be4c8160aff15393eb8f7e2245263f420467285e44ad39af0914
SSDEEP 96:DKO1C+JIy/HYz+OsTBB49bqzBmURx3iwBEr11Ox:D5k+JIy/HY6OsVB4hqzBmURx3ik211Ox
TLSH
T166B18EF3C7D4862DDD1152F0BA246E1FCE6D092483183D6AC5E4AF5BA3E2471E241A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e4b061e646ba54c7b1462a7feadfafbeff77e6fcaefdbf9845bd30b2b192cd06
MD5 78b75836db9f12b3b369264e41766342
SHA1 8d068023c61aa3713b091a865bb47d728df91b6e
SHA512 d69cc7fc8673f7f971113133e2234881e3ee0ad1b8782dfdfaf1dbdb2641172c2a694ed4ee9d3203362e6e85b0c0f6d0090bafe7dd0def412c175972b4452e37
TLSH
T13CD0237337087076955C9D8545A5EC4FC7EB40100853E9D510D055DD267D4AD0557145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe592f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe592f92.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b00f95aca391f83a317ad88cd5b516100ad62c45f744e4887c63c1a5ddc92b62
MD5 d76b1237f956991887492aad29a56283
SHA1 77d9afd2a098d6b5cf28717257dfc49518155013
SHA512 2f564eaa6ded3b06a2b188b88014008fe23f94bc1398a10c950f1377c30ef4e6a7612091336b832e1da64179227bf4976816c2e61b0ddc49721ae998f55598d0
SSDEEP 192:sxZMRgny/fHsLeIdpAl8HW6+WNXsL/YRPjiD8IgrJ:sxZMwy/fHsLPZHbg/mmE9
TLSH
T14422D9126E68A57B8CC7D21DBE19BF13E6F95032A1D01E48EAFC861C05E66DD130790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b7050f3a2cfc6c176ec72216ded791faf6dc6e062bc2b032060f8c0bbb0eddc7
MD5 a0e8c45e66cd5a3e3cf63becbdcf4966
SHA1 126e8d00c6cac4f541010e7540118de97686ddf7
SHA512 ef9f3479a2e4a13a6502e80c18efac37e38f4d1afea93c27cd0099d4b3aba19a123fafb0271ba18556c4aa56f104656128ee99edb13cff0b1ba2b4927fef1356
SSDEEP 192:sxZMRgucBWy/fHs34qdpT8q1l8HW6+WN9+sLHPs/YRP6iD8Ig5JdWRD:sxZMhmWy/fHs3F7kHbP0/m1EtWRD
TLSH
T1F842C952692495B78CCBD609BE35BF13D7F5503299C11E8CAAFCC61C05EB6ED220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c5edeae87fd3b9a39ad3503c7f3e547b7bb9f54d8aaeb0d0addc18cecb138a29
MD5 541f6479cc627b867c06fc5393662cfe
SHA1 10429ee7a5b7013488a9ba82a787b8c25bb9f726
SHA512 9a79640911a415a0d90412916e3e614e1e8dc453af31ad073a265771f933f9d8a9c92d72a92b0d06cd0f13c5fa77c615a403b3586c6207d65026aac308cde161
SSDEEP 192:sxZMRuucBWy/fHsPWpVSPqdpT8q1l8HW6+WN9e9sLHPs/YRvLi1OIgbJdWRD:sxZMHmWy/fHsPWvSi7kHbH0/mugvWRD
TLSH
T18E52C852692499B78CCAD61DBE35BF13D7F9103299C15E8CAAFCC51C01EA6ED230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9963e44a5c98e85d72ce774db847c99740628853af9c1d7965bb6558d934c384
MD5 008251f97be6e8a133b349688c771d71
SHA1 6e9fa31ef19db9c84d39030ce6e599035ece52bc
SHA512 7780f3a80ea6425f1dcebfae1403e3516052eaa517cea48c7ed6f1de0621e21df291fa08f7a929677505087417fc4ae57faca80b2a6a0c0a20f60cdd49bf21e7
SSDEEP 192:sxZMRgny/fHszeIdpAl8HW6+WNXsL/YRPNiD8Ig5rJ:sxZMwy/fHszPZHbg/mYEn
TLSH
T19B22D7527E68A57B8CCBD21DBA25BF53E6F91032A1D01E48AAFC861C05E66DD130790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 418a51154c12034abf21c60edf466fe789460a3ffa8ab44d4199f4edcda632f5
MD5 003aafa12b0c98538aff1a3f6923d03c
SHA1 f4a7d2fe3c1dc2583cd78b7b87d42d0bdd73677c
SHA512 6ebea8b9f2ea52e1fb65c76fc8f1ee6acc044006bd9869042778c14151d9b07de9a3e155ea0a742bc942a0dae6b671d9110ea597c3d3eb4da2d10e9a1eec3d3f
SSDEEP 768:uQK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3NroU+Gv:uQK9uzYWvcQWsu1ja0HL7Q3mU+Gv
TLSH
T10EC20A3F640DCB7E4FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1d0670b1860f4089cbe761a3d4e5969cefd7b789df108a346a3710fb0c4d671a
MD5 c830228c77fd52cd9713269528ceb9a6
SHA1 7e2ea5f523987eeb872b6742de1429f3156c25f3
SHA512 8f28b7f5d4e8623908e70008fd037826619426d8b845681e27c66e5a86da63920b30703032fffb1d49ec11d374a0628bd83580d389f3f08000fc146a6f80d0da
SSDEEP 384:HZcIfsNIawcGR8OjTVINOrnj5BtgOIwZOymoxoj:vfPXnWO7j5BXsKxA
TLSH
T1B3827D326CB85DB75CF79144F54A36038FB88067D689AB90E4ED6B1C02DA6EC130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f019f9f69991ae91ce480055654f71788f51497b634282022118ebc3a0694f46
MD5 b322188e9f5808d0f8fa14ca3de7fdf0
SHA1 3e0ddb2aacd97a8295dfb89602883f20d3957313
SHA512 3e986fe7bccc85bd8bfdba26bf069bf3cf2893321416d3ca83e9e8ca9ae6d155cd99d520fb3c7c56232440926ff8371d97acf96f142f6ba4815eb2d1d0a82707
SSDEEP 192:SONu6ygpQmiUyT4tOCTVg3NOqm5zPMuU6:SONu6lH9tOCTVINO97U6
TLSH
T17302C634BC683CB78DA2AE45F58727139FA8116BDA562F84DAE81E1C01D775C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cc10a572ec56ef9497d2f7449b21fa4956247b3dfc57f60a58028ca30cddfc78
MD5 ef8637e2bf5b3b03621d7ed153812057
SHA1 8cf9642f680080da36ace72ad6b046487c545ab7
SHA512 b68f7204861a728d63c54afcfc8d87bb95b43a1b2a19a5e8bee0dc2d9f2a03bddbcee8c9af69ca6457ad1645ace544187d95a6a612a91ececb20cb6e11af342d
SSDEEP 384:5ZcIfsNIuwcGR8OjTVINOrnj5BtgOIwZOymoxoj:RfjXnWO7j5BXsKxA
TLSH
T1E8827D316C785DBB5CF79144F58A36038FB88067D689BB90A4DD6B1C02DA6EC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8ad157983cbecdc65a6d65541fafa1e372b68ab0d7ac9765821aed5bfc610933
MD5 c69045336ceb0df223d82ccee19c5515
SHA1 773b9132db066a2d7ea6fe449936fad3fc3b1c06
SHA512 fd8c3341840ddc7c53f325abad91213ea6cae4264752a2f37e294214b8d3d208e509258835d0b5a9bdf4cef83e3616acdc003b80570336c01515324b367b0225
SSDEEP 384:6ZcIfsNI7wc2BN2OjTVINOrnj7BtgOIwZOymoxoj:4fsNNnWO7j7BXsKxA
TLSH
T1D0827D316CB85DB75CF79144F54A36038FB88067DA89AB90A4ED6B1D02DA6EC130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 dfade2967d1695cfe7b6aeeec5f991e826e9b60bf617b760c0a28c5f20491d88
MD5 43addf87debea241e44cee0daf434d8f
SHA1 1e3ed1bb8f1e24bcd1d4b61153d529d1758c78d3
SHA512 f515c87f8994ac678bf24bab193e5e36eb27890883fed15c440f2b333d32e9e53e205a8e9c46a0b0bf76f370a3a9a86605f2dbea4c4edd5e6d5aeeac8e62261c
SSDEEP 384:rZcIfsN17wc2VN2OjTVINOrnj7UhvUVSE7cN5sn9aatgOIwZOymoxoj:zfdNNnWO7j7WiS8n9aaXsKxA
TLSH
T1B6B25CB1D8A85DF708A6D0C4A586F2036FB80077C989AA5CD0F9BB3C319F6F81717956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 59a1869c3dfada2ca73643684b09cc8059084d4403808c5ff6183e8b8ffe3cc7
MD5 6ec49e6c27681e9a24ef7679fa79b88b
SHA1 2b6baaa934b8acc05f742bebd18089780d13bec9
SHA512 7379eb911587840b02d7d7ccd62f312842c510c43bf0c354c76b7d2a495936fec60eac8bbb1f87cace505818ca466518ab358e0fff49fe8e81a937167baf9e50
SSDEEP 192:SONh6ykQmiUyV4sOCTVg3NOqmjnjOeb73UUq/U6:SONh6jpsOCTVINOrnj6BU6
TLSH
T1F3120935B8786C775DA2A545F48B36039FA44167DE4A7F80E4DC2E1C02EF6AC230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f940e874f4a3367bee31717a26643cdad8332dff304076ee3af243b8838801b8
MD5 78147719b82f431011d81e25841f69d0
SHA1 d568380137957555b7b966e3ea899131f38bce24
SHA512 81df2744c7cf57fdc782c126721407a8a985230031fee8dfb9cabd6c20751851ae2073cdfe68018b45f48976bd4ae22a1a3a7be324ce8f7c962d8eddd185241e
TLSH
T1A841D758AAE91148B3B37E5AABF7A46D887BB8772E06945E10510E4F0A26B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads