f7fbe45b707fcc317630ff1692f96a89412796f32ce643455722a2670d8b9826

Analysis

max time kernel
54s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WavePad Audio Editor Software Express Edition Installer.exe
Size 1.1MB
Sample260421-jch5msa16m
SHA256 f7fbe45b707fcc317630ff1692f96a89412796f32ce643455722a2670d8b9826
MD5 d915afab7d8c063aedb87570fc986c25
SHA1 62182b8957f1636951f1d027d2391206d6b842b1
SHA512 4e2799ef2046b1e5b8f6a8397588d8b006dd93c432e7232020f375640a522da3be68426f3f8c95d9b763e0b0c61d8e8ba7887a2c33100aac68a959f98e178c5c
SSDEEP 24576:TtyhsrF+2DR7BWYpLDo44ZUdm2BWmp+jRF:Tks7V/m8T9AP
TLSH
T14C454A9127FC0539F7B70B79BD7A68610A36BC395502E69F098D252D18F2B1688F2337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212303035032729"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{2B45063F-3960-4212-9319-5785BE37A24D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	WavePad Audio Editor Software Express Edition Installer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4476	3376	WavePad Audio Editor Software Express Edition Installer.exe	79
PID 4476 wrote to memory of 2812	4476	msedge.exe	80
PID 4476 wrote to memory of 1900	4476	msedge.exe	81
PID 4476 wrote to memory of 4288	4476	msedge.exe	82
PID 4476 wrote to memory of 4288	4476	msedge.exe	82
PID 4476 wrote to memory of 4288	4476	msedge.exe	82
PID 4476 wrote to memory of 4620	4476	msedge.exe	83
PID 4476 wrote to memory of 4620	4476	msedge.exe	83
PID 4476 wrote to memory of 2536	4476	msedge.exe	85
PID 4476 wrote to memory of 2536	4476	msedge.exe	85
PID 4476 wrote to memory of 2536	4476	msedge.exe	85
PID 4476 wrote to memory of 4008	4476	msedge.exe	86
PID 4476 wrote to memory of 4008	4476	msedge.exe	86
PID 4476 wrote to memory of 4008	4476	msedge.exe	86
PID 4476 wrote to memory of 3696	4476	msedge.exe	87
PID 4476 wrote to memory of 3696	4476	msedge.exe	87
PID 4476 wrote to memory of 3696	4476	msedge.exe	87
PID 4476 wrote to memory of 4520	4476	msedge.exe	88
PID 4476 wrote to memory of 4520	4476	msedge.exe	88
PID 4476 wrote to memory of 4520	4476	msedge.exe	88
PID 4476 wrote to memory of 2276	4476	msedge.exe	89
PID 4476 wrote to memory of 2828	4476	msedge.exe	90
PID 4476 wrote to memory of 2276	4476	msedge.exe	89
PID 4476 wrote to memory of 2276	4476	msedge.exe	89
PID 4476 wrote to memory of 2828	4476	msedge.exe	90
PID 4476 wrote to memory of 2828	4476	msedge.exe	90
PID 4476 wrote to memory of 2800	4476	msedge.exe	92
PID 4476 wrote to memory of 2800	4476	msedge.exe	92
PID 4476 wrote to memory of 2452	4476	msedge.exe	94
PID 4476 wrote to memory of 2452	4476	msedge.exe	94
PID 4476 wrote to memory of 1752	4476	msedge.exe	95
PID 4476 wrote to memory of 1752	4476	msedge.exe	95
PID 4476 wrote to memory of 1752	4476	msedge.exe	95
PID 4476 wrote to memory of 1652	4476	msedge.exe	96
PID 4476 wrote to memory of 1652	4476	msedge.exe	96
PID 4476 wrote to memory of 896	4476	msedge.exe	97
PID 4476 wrote to memory of 896	4476	msedge.exe	97
PID 4476 wrote to memory of 3084	4476	msedge.exe	99
PID 4476 wrote to memory of 5076	4476	msedge.exe	100
PID 5076 wrote to memory of 3800	5076	msedge.exe	101
PID 4476 wrote to memory of 4400	4476	msedge.exe	102
PID 4476 wrote to memory of 4400	4476	msedge.exe	102
PID 4476 wrote to memory of 220	4476	msedge.exe	103
PID 4476 wrote to memory of 220	4476	msedge.exe	103
PID 4476 wrote to memory of 1732	4476	msedge.exe	104
PID 4476 wrote to memory of 4672	4476	msedge.exe	105
PID 4476 wrote to memory of 1732	4476	msedge.exe	104
PID 4476 wrote to memory of 4672	4476	msedge.exe	105
PID 4476 wrote to memory of 572	4476	msedge.exe	106
PID 4476 wrote to memory of 572	4476	msedge.exe	106
PID 4476 wrote to memory of 2880	4476	msedge.exe	107
PID 4476 wrote to memory of 844	4476	msedge.exe	108
PID 4476 wrote to memory of 4168	4476	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\WavePad Audio Editor Software Express Edition Installer.exe
"C:\Users\Admin\AppData\Local\Temp\WavePad Audio Editor Software Express Edition Installer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9P0KQX1Z0WM2?ocid=&referrer=psi
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x324,0x7ffb6f39c188,0x7ffb6f39c194,0x7ffb6f39c1a0
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,3702576110725728134,15985805170332883562,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5358456717669053182,14673402419108884163,262144 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14425303989240820645,18186737086997336943,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10026343326397434736,18124240242717067855,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,3582990545138950315,11344113372261300494,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,7883098821130591658,10182775854443198300,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,7557301713514196695,1650226089058005582,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,10094651700733249381,3997193166967478959,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4288,i,9231976767097684958,11426425039285030905,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,6869942426815439123,17764507444653064650,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,16164406675095652175,7649821906264023658,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4216,i,1745359632901766476,10291373079149671727,2097152 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,7105899964163550390,4143950143022544132,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,9991188418177489604,7698247447202768939,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12814990962913090722,10963936660851522101,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12814990962913090722,10963936660851522101,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10119817574652237095,13175711003398466356,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16476367582318141978,4199753479886537227,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12126725088097849732,8464811138491214083,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,3400068828433758314,9334933706918341092,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,11899177096717131394,4502652474418779982,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,14323128882417141766,8849445168498249265,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,1240457904991662706,16131384289513543045,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,14622131727073489956,4365849275033968428,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11421937049212179745,16531938851641020705,524288 --field-trial-handle=2208,i,3423394351896544909,18184378565465598698,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5b8a75b89efc2ee045b2689bb5163d2db261caea6ea27b1abcfcc74d343b3762
MD5 2fcf6aab5078bf0b7e47af8151bfd5e5
SHA1 31996d02f831dba62d50057fc45bab1459726191
SHA512 6cc15eb55a0c9c3f2260506e59c54ee8a6b0bff91544f5ab72b308ef6c6e674317ed41a144d52ace51b119629681a975d477c5faf582ba14fbfc18311f82ad0e
SSDEEP 48:wCAKCshnzVJF9DYZ7dGU/TNN9YtnnzarupYJVVgDtrApoEqQvLPaHFVDFOY+:pjnz8Z7gU9YtnzayYHqDtr8rBLyHFVD+
TLSH
T142A1280851F2C028F7F49D77BAD520CABA304A6603870E3BDAD69CBD865EF2811F4784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586731.TMP
Size 3KB
SHA256 315514ec19ff09d27a223ad557874c4153cddb3215fa93a75d85f3706cebebc2
MD5 17dbaf1ce77e9a79cdc7410fb162b598
SHA1 cb6fe75ea6a23b26e7adecff737ba89402e1437b
SHA512 069e65c09fa7452d096bd461b0a4066cd6d62eee8ef7d5825d841c26c65911f3412cc70072de8c41386c47331a2a54974915c167f9db44542ea7599c0b17f4be
TLSH
T1C771194855F14029E7E5C9773AD910DDFE30499707870E3AD6DADCFD4A2EB1801B8B44
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c7dacaa38e34097a89168c5e0889f030d18a868212f4b7022a4a846a14e02160
MD5 5b9c9bcc0697a890a53b289c62602333
SHA1 b65c0c50312dc237a2ce2e9bb368b9a9346d91c1
SHA512 fa679f58a254c8063b54b9c2e56787f3a5764a47180eaaacf464365842b0124e097a22a1124fb8162d93a1256114f1364f1fdbdadb4311cdfe41311dc4961958
SSDEEP 192:sxZKRGyM//K1Ml8Mcv/fhs7XXWLoIdpfN/W6+WNth2/YQ860F9KrfIg4J:sxZKk0v/fhsbXeZ1/b6/kyc
TLSH
T1EE62D816EA345977CCDBD219B955BB53D6F91572A2900E44AEFCCB0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f24bcf2d6b292dc7d9d90864f65eab50ffb924891463285f004e0dcd27c0ac10
MD5 62509a51c1b7c3e91280ae350635bc66
SHA1 447d46b232153bfe1d83fa60c53b1612acb2bbbb
SHA512 2cd1c7c8f09e053ef85f28645f87c45d1ef4f145fe6e95c7395cbef266a2eee35926202ea9f21c39e64a297f3ecd4cc13f26da709c58c7ddc6f67569aa183ff1
SSDEEP 768:TiP7x8t12VF7pLuLno0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3tUizLlT:TiP7x8t12VTEno0WRmoMQ3Au1jaKtUip
TLSH
T131030C3B780CCB7A4F804E9CDC26BE9A6DE8028F96A8895447FA484C03C67DF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\4b623edd-a021-4247-b9aa-4093eab18318\index-dir\the-real-index
Size 3KB
SHA256 5057cb21e3780b5ae30657e558345446c2c4a5d48925385972eaed937bb06541
MD5 acb4c68f93140ff7cf8d6d2b0433dcf9
SHA1 6febb519de55de2c71007da14ef3ce65f060b70e
SHA512 1f2bb4916def55dc6fe7d3f7776b18c425c496971d2dfcce07c358c4978166fecf2f29eec5fe1443984d927096fe729927bce020c0cd17119e80f8941dcf81d2
TLSH
T18761F848BD04C95ADD7C50FEAAF896DF2BAD47EC268152BEE10DC926F1C401C4835EA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586359.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\4b623edd-a021-4247-b9aa-4093eab18318\index-dir\the-real-index~RFe586359.TMP
Size 48B
SHA256 c88c9fc01f099133c771e314e4701b23c6c4e8072d13ccef6b78dd7336849065
MD5 03775b7ff302ee1b955c51a0ffa449a0
SHA1 29764f27cc8f1aa775b9faa4992eef8412dc4158
SHA512 c9baa1892af37c99ef144cf83cceb8741b618de9cb1f097f13042b029cb3a02f5adf1aef375ecddb483d3073d128e49462ad538ae95a36de3162cb0e30030f7b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\cd366c00-5993-44e7-90ec-56a069e89495\index-dir\the-real-index
Size 72B
SHA256 64f6e6bd82844e2707e31438169dad0e7bbc1042083e768c2a2dc7a365652364
MD5 2a33799c4605368481fd8db36af5cb14
SHA1 243ee7329b945d345df9edfc3c96140e96a775a3
SHA512 78d8594e4f1a0d61af5aca82416f7e42626f324fe988a6e43507d89a732c17a4ad687317c78683f3b51435107b875a0adbd7d4eaeca47dbf2809a6b7d9aa6597
TLSH
T1E9A002509D566A05D569C67A9579158C27319E9E8211035240A891849A5094457E1016
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585407.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\cd366c00-5993-44e7-90ec-56a069e89495\index-dir\the-real-index~RFe585407.TMP
Size 48B
SHA256 acff021186a56b1455673f72bc678ee34bb47acf30dfd1465350e2c2183e1931
MD5 d242093bc493c6ef45659b1e199323da
SHA1 80cf9feef1dda216a9c2d675a4d7b6a4fd9214ab
SHA512 6ccb4e34c9382e63c3ce590ffab8af27501f74272ff46268fac637ac167e7108cf8735c4608faa5d6cea9a9d3277711a8b02b66c751ca649d150b7e041d14c29
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 ab1869bb35d47afa69ab4b58d7df24bb4fe0d1dd2c05c78dccd99c42b274e249
MD5 87551d4c55dc58176821f2019deb1c9f
SHA1 7bc463892a9e9eb76604bc47033d35b09b657d8c
SHA512 abe5a3816a23e8b66cdc75eff071efb6e29f4f67afd1e5400964962f4bb8d3b79312b536ad1f94005ae0900d3a4c95fc9662064c8b0043e4f439789ac32cc410
TLSH
T164E0680AAB725111EB225DEF1B98F758C82F25879E41DE5880C0514208EBA578853F66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 195B
SHA256 6daabb06ade4042111f73d5325e37cee7213fdd311ec07543ff44fd42b44e0fb
MD5 f9a33d6f427bda5124bbf149a74b6248
SHA1 83a21aaabd7b90d05f740bba43c80f56127fe2bf
SHA512 185316a0ea71192bbc7133f0f523ece67023c7a19472d64a222fbba76505eb729ddf36b7d7b18756736d1db56e88a5c9ff5f26b39006696d008f1cff773b2e98
TLSH
T150D0224ACA311001DB904A970F29E2C4C42B2D836DC2CC688084B0400CF524A8582BB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 d8957fae249ce3133637609a7c02a07e798344dde37dce3c96976409fa3cb47c
MD5 b6f9d2efd2178423fe067c5a3f1ab257
SHA1 304ed7099fe84284dcbe5add6e9656d750d0b6d0
SHA512 18b6cacc2a6eac79a3a59e9158d3e1b15f51f3e2283515d4f28d3927a3b42e4d39e9477590f2f76245bbeb776055d8c6165b8ebef935a91813fb46f0310579a9
TLSH
T19CE06806AA725111E7610CDF0798F298D83F2D879E41CE5840C0714208FB65B8992F26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 c0418299da28ca7778208c8012762c71f38b2313ee32a7bbae9dbd26f5be2b3d
MD5 03c6d8ba55b65cc0b64c613521a5384d
SHA1 6f6855694ff94b3d3f5034d3f50f1b3839997d84
SHA512 9ce3d5dbe0096414d9ce783b8cc4d53677e31b0209b0e9d2c554616b054f4ccc65c1279fadb44c49359338fc1216d4753bcdf0ffd48e79ad6f70c51b1ecc7163
TLSH
T10BB02222800E0083C88883B2F883302033B03C280303203203B0E0FCCC0B3C020E2203
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5853d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5853d8.TMP
Size 72B
SHA256 7b3705fd7764a3291eb2d3d7b858256ad5d996affd0f1b04f7592b736440ab28
MD5 1b6561cbb88e57728a743b00f5161136
SHA1 c7afa6e8ab547681844c6bce8dcf351670feb925
SHA512 d37ad1a0416dc38858b93c6b0a7dff72e94d70f06491dc27a30974aeffaf3533ecdf089fefd378c0dfd2ef90e899fea9b0283aeebfb45d2221d407ff4d222623
TLSH
T189A00210829B6818D40805B9211526401374885E4104264384D090DCECAB1C16DD2913
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2229902303d4847d54b167e0f2239a01c3c3d27e759dddd75143d2d0148f6c10
MD5 f2becdb9286b5632b0d3efbc1fc734a1
SHA1 509233cd3b2e4fb540093bd688be5c38c6eaf80a
SHA512 5a4401a04ac695f591c3d6933656cfdb8e01500b724636ba1f6f660eb91770ada297bf730071953d4bf4a128196fba6ef7a4be9c08297216864687ada97dc328
SSDEEP 96:K84YKhq+GxSKyI1qMgKtCSqAKP6uCwgKd6x:y7l+f+D3G
TLSH
T1D0E1F694B13AC3812A7E655A86D4B57F42C230B33015A53B3BB851765F67E10DCFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a2d8e73177b6dde9cbc2a67c0a2c2c870ed0bb658dde89cad621debb5040b8f1
MD5 122b8f33a6db6d0f8af1aa9d5e832c63
SHA1 073c87fc45210d4631a1c08d0bf471ceb57e510c
SHA512 9c27432d2fbed7d8943f73e58d42b413a2584497891ddfe75151ceb89fb91057bb73263f5ac9455d98841ae813f62f945d4c92ffd8a4d6ffc358e0871435fed2
SSDEEP 384:nxjccCs+Bt0S318NBgHXntiSQaMDuY/Fifob+2Da5XU/AatId6FlZrif3p:BccQVLU5f/FifAlDa5XabW6dWp
TLSH
T188826B35A8B94C3799E7E118F447375B1FB410BB9AC06F68EAD94F0D04C76AC170B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e953cdcc5e130ed81facb45c45a705c39bebc45c8e06fb7f3db049ae6c8a97ba
MD5 5eb8fdfb0bb6929c16e246047264655f
SHA1 874cad4139c7236e917c5e576359d06e7c46af17
SHA512 3252247285d627a8070fdc8804bb92bdb41d6359e8b8e87b5a563c423a37193d08970a89c271632a22ceb31d40f32ce6342c9a813f7077d0e13ecc0a68ea8b8d
SSDEEP 384:nNjccCs+Bt0S318NBDHXntiSQaMDuY/Fifob+2Da5XU/AatId6FlZrif3p:NccQVOU5f/FifAlDa5XabW6dWp
TLSH
T14D826B35A8B94C3799E7E518F047375B1EB410BB96C06F68EAD98F0D04C76AC170B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 000d6e37eaf1935a09fa4218f8951a4206d4c352dfd9e9b1c9162edf0284a0b3
MD5 1297ded8a0678e32182a8924402ade8a
SHA1 f2236d0055a6ad44c33ff5d4ab18ecbeb5475a57
SHA512 7de7a5af07463e1e08a2d60bcb7ba0b25ace558a4f0b81b8890e3a909b6d5a4b3414d1f249e3b1a8100b377086c7c7643d2cee26cdc1e87fb56284f4a2ad1adf
SSDEEP 192:wGNU6Pt5QmiUy2nKWB/Fl8zKbRIob+2Zn4Fqxh5U6:wGNU6FXHKWB/Fifob+2ma5U6
TLSH
T140121835A468AC375AE3E955B48777635EA42077DEC5AF99E6E40F0C00C739C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c0190e9a6483adaf6ba925b4d218f1feff885ba24c44bc544b5f563cebf5d66
MD5 a1a5ef15bd56f1c1a5b271c8f0e40305
SHA1 3f7afb20f782c80edd7b7c34eebba055aee17bef
SHA512 178d2540adce84c7e9e46853cb62accbd74c687b1a927275eeafe028b9746fdc1fb230372ced40f41d4926e4151e2afbc5de708d999fda54ea99e5f0e7f2e53a
SSDEEP 192:ZGNS6Pt3QmiUydcKqB/Fl8zKbRI27r9cZU6:ZGNS6FZC5qB/FifcSZU6
TLSH
T1CE02FA39A8686C7B9EE39E45B487B7135FA4106BDAD56F94DAE81F1D00C768C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2cd03721-cf6b-4dc1-8d1f-e69412f2033b.tmp

Path C:\Users\Admin\AppData\Local\Temp\2cd03721-cf6b-4dc1-8d1f-e69412f2033b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpD9A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD9A7.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

c2e8d0d4-8eec-4a97-85db-9b36387c11c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\c2e8d0d4-8eec-4a97-85db-9b36387c11c5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d1298310-e1ab-4509-99d2-3aebd3362918.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4476_437172529\d1298310-e1ab-4509-99d2-3aebd3362918.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4476_856943259\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3084-955-0x0000014603B70000-0x0000014603BA1000-memory.dmp

Download

memory/3376-21-0x000001B6F1270000-0x000001B6F127E000-memory.dmp

Download

memory/3376-18-0x000001B6F0BF0000-0x000001B6F0C16000-memory.dmp

Download

memory/3376-20-0x000001B6F3420000-0x000001B6F3458000-memory.dmp

Download

memory/3376-63-0x000001B6EF960000-0x000001B6EF96C000-memory.dmp

Download

memory/3376-22-0x000001B6F1370000-0x000001B6F1378000-memory.dmp

Download

memory/3376-0-0x000001B6EDB30000-0x000001B6EDC4E000-memory.dmp

Download

memory/3376-24-0x000001B6F3460000-0x000001B6F3468000-memory.dmp

Download

memory/3376-19-0x000001B6EF9E0000-0x000001B6EF9F0000-memory.dmp

Download

memory/3376-64-0x000001B6F0500000-0x000001B6F0512000-memory.dmp

Download

memory/3376-23-0x000001B6F3D40000-0x000001B6F3EC8000-memory.dmp

Download

memory/3376-17-0x000001B6EF9E0000-0x000001B6EF9F0000-memory.dmp

Download

memory/3376-16-0x000001B6F0CE0000-0x000001B6F0D1C000-memory.dmp

Download

memory/3376-15-0x000001B6F0BA0000-0x000001B6F0BB2000-memory.dmp

Download

memory/3376-62-0x000001B6EE000000-0x000001B6EE031000-memory.dmp

Download

memory/3376-4-0x000001B6F0C20000-0x000001B6F0CDA000-memory.dmp

Download

memory/3376-3-0x000001B6EF9E0000-0x000001B6EF9F0000-memory.dmp

Download

memory/3376-2-0x000001B6EFB90000-0x000001B6EFB9A000-memory.dmp

Download

memory/3376-1-0x000001B6EF9E0000-0x000001B6EF9F0000-memory.dmp

Download

memory/3800-260-0x000001912DA60000-0x000001912DA91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads