hxxp://katznassau[.]com/

Resubmissions

22/04/2026, 22:52

260422-2tsphsdv8x3

22/04/2026, 22:51

22/04/2026, 22:49

22/04/2026, 22:28

22/04/2026, 22:24

Analysis

user interaction
yes
max time kernel
68s
max time network
70s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://katznassau.com/
Sample260422-2sr2ladv71

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213718771136247"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{6B89D45C-67E6-4937-BE0C-D86C82AD76B5}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4872	848	msedge.exe	80
PID 848 wrote to memory of 3364	848	msedge.exe	81
PID 848 wrote to memory of 5092	848	msedge.exe	83
PID 848 wrote to memory of 5092	848	msedge.exe	83
PID 848 wrote to memory of 4624	848	msedge.exe	85
PID 848 wrote to memory of 4624	848	msedge.exe	85
PID 848 wrote to memory of 4624	848	msedge.exe	85
PID 848 wrote to memory of 3324	848	msedge.exe	82
PID 848 wrote to memory of 3324	848	msedge.exe	82
PID 848 wrote to memory of 3324	848	msedge.exe	82
PID 848 wrote to memory of 2208	848	msedge.exe	86
PID 848 wrote to memory of 2208	848	msedge.exe	86
PID 848 wrote to memory of 2208	848	msedge.exe	86
PID 848 wrote to memory of 2816	848	msedge.exe	87
PID 848 wrote to memory of 2528	848	msedge.exe	88
PID 848 wrote to memory of 4000	848	msedge.exe	89
PID 848 wrote to memory of 2816	848	msedge.exe	87
PID 848 wrote to memory of 2816	848	msedge.exe	87
PID 848 wrote to memory of 2528	848	msedge.exe	88
PID 848 wrote to memory of 2528	848	msedge.exe	88
PID 848 wrote to memory of 4000	848	msedge.exe	89
PID 848 wrote to memory of 4000	848	msedge.exe	89
PID 848 wrote to memory of 3108	848	msedge.exe	90
PID 848 wrote to memory of 3108	848	msedge.exe	90
PID 848 wrote to memory of 3108	848	msedge.exe	90
PID 848 wrote to memory of 1256	848	msedge.exe	92
PID 848 wrote to memory of 1256	848	msedge.exe	92
PID 848 wrote to memory of 3884	848	msedge.exe	93
PID 848 wrote to memory of 3884	848	msedge.exe	93
PID 848 wrote to memory of 936	848	msedge.exe	94
PID 848 wrote to memory of 936	848	msedge.exe	94
PID 848 wrote to memory of 936	848	msedge.exe	94
PID 848 wrote to memory of 3564	848	msedge.exe	96
PID 848 wrote to memory of 3564	848	msedge.exe	96
PID 848 wrote to memory of 3840	848	msedge.exe	97
PID 848 wrote to memory of 3840	848	msedge.exe	97
PID 848 wrote to memory of 2372	848	msedge.exe	99
PID 848 wrote to memory of 1772	848	msedge.exe	100
PID 1772 wrote to memory of 1312	1772	msedge.exe	101
PID 848 wrote to memory of 236	848	msedge.exe	102
PID 848 wrote to memory of 236	848	msedge.exe	102
PID 848 wrote to memory of 2420	848	msedge.exe	103
PID 848 wrote to memory of 2420	848	msedge.exe	103
PID 848 wrote to memory of 3952	848	msedge.exe	104
PID 848 wrote to memory of 3952	848	msedge.exe	104
PID 848 wrote to memory of 2256	848	msedge.exe	105
PID 848 wrote to memory of 2256	848	msedge.exe	105
PID 848 wrote to memory of 2292	848	msedge.exe	106
PID 848 wrote to memory of 2292	848	msedge.exe	106
PID 848 wrote to memory of 3088	848	msedge.exe	107
PID 848 wrote to memory of 3088	848	msedge.exe	107
PID 848 wrote to memory of 3088	848	msedge.exe	107
PID 848 wrote to memory of 3604	848	msedge.exe	108
PID 848 wrote to memory of 3308	848	msedge.exe	109
PID 848 wrote to memory of 132	848	msedge.exe	110
PID 848 wrote to memory of 2368	848	msedge.exe	111
PID 848 wrote to memory of 2368	848	msedge.exe	111
PID 848 wrote to memory of 4936	848	msedge.exe	114
PID 848 wrote to memory of 4936	848	msedge.exe	114
PID 848 wrote to memory of 4936	848	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://katznassau.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffbca26c188,0x7ffbca26c194,0x7ffbca26c1a0
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,2922896330494698745,9167422057664301308,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16241375585921012186,1542865777744026729,262144 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,1337027151694946741,6375613282185630408,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2539918678904613403,12526230942455785024,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3495675615071197227,14644959018754738050,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,11795675781598528143,7353766275746021282,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,6594481912181837190,18345146121969408714,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,18294924925547699561,7317930744327708674,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4260,i,9586621998156320853,4825185759987421652,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,9405970427909230678,1030526095675244867,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,17152689860425598226,12465253376482209580,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5516,i,12202156557450416887,7668194759964164319,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,3559694188606927749,16812533084762768276,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,16210823305121637583,4774342830999953102,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4335690332768855919,1202819268876368524,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4335690332768855919,1202819268876368524,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,649491156529638752,5318035532371283140,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,6514316374401164195,17315267746262111055,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2089599764234594317,16931117888774275354,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17674373702288040041,1724781998788089703,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,10424923545226871482,10265514992794280457,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,3815167107467878135,13366707481072013979,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6152,i,823603591898840992,15565792665121137429,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,14919625678700592991,18236612949879723639,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6240285845362441656,15221993410315505,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,9513345225868731718,12416173038715333446,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,2631258306003017342,12777571051597565090,524288 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3976,i,2403164436311541363,5963797298640165584,2097152 --field-trial-handle=2140,i,6526466278124614226,575440980031091758,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50e95333-2aa8-4e63-885d-b6f0c3a7e1a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50e95333-2aa8-4e63-885d-b6f0c3a7e1a2.tmp
Size 18KB
SHA256 b2b8f180c4b8fa8cfbd32744fbd8b9afbd43b31743e2c2af8a632c9372e742cd
MD5 00203924ff122157bc3556a846920d12
SHA1 9a985f1b2bb9218b0efd04a56a327fb78fdd668a
SHA512 1e678a01b39610be7b8d25e4b4705f1374fe976c3a2dc234bef5814c583473187a194d7043e6e65de1bf64ba64927d1bed7f012e103e00cf98770b69eb8014da
SSDEEP 384:nljccCs+Bt0S3v8NrjMl/63W2JX5Q/5+f8IXGh2a+LpQsf3V:VccQP/EWQw4Li2a+LpQ4V
TLSH
T147827D76A8742D7BA9F39A59B0563203DFB4107BA7841FD4EEE84F1C044B29C131AD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acc64b5fafe18b6dd8318d3036a3f5c8aba723aef062fb3fcb70757f1fe28095
MD5 8a1ba1ae8c21c699eac9164e0ecbb96e
SHA1 29d13ff7974005e3007ce0900cd6d6066ba670cc
SHA512 ec43dcd4de57fbb5716711bd972e38e38cd27cd080973b78259deddbb7c20cb9c2fc60d37a1021e4a803282ebe4bb115a53b480bfd6455dbe2102b51d62b4477
TLSH
T144D0228CA38A2C22E2A8BC3000A32F00A2A0E0228308C220A0B3080A2C800832202080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 393d76a3d1e0981fb8c79e8fbf067ec2567826241ea874a8dcc210e4131d3f45
MD5 aca2955089f2aaedea61f37e7b7c4b7b
SHA1 d09472d68a0d08fbbfcba290375a58426cdc27ac
SHA512 bec7ab4da440e792a88378b896eacca057b1cf1a8d1b039dc3a2257366a60622e3054bd196ab57914f22bf004afe41aa515b3eabfc5351f624901ca04cd17734
TLSH
T1DCD0228C238A2C22EAA8BC3000A32F00A2A0E0228308C320A0B3080A2C820832202080
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32aa5d0b530c335d7d282ad70b1cbe952d74a823c80b7bb4817537ab84763b4e
MD5 1cc79240c4348f7f4680ff4b298ada6b
SHA1 d0d107ee4f21d99f890d046d7f9c231ea44728ed
SHA512 23e580f8d107694fddc5f265ee261a75cfbf83754d5a78c9baca9dd5dd8e173fd84e4b434d4ab238b52b43a0a659886e2e01b2128bff554041830e038c8c1500
TLSH
T10371F88151E1B85BEFE601F99BEDD42CB26081253176DE3712D691FD0A1F741E047670
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cb1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cb1b.TMP
Size 3KB
SHA256 1aca06017d82c8d7b9102823fd83d92dc00c22fd9b7849a1f9b13d69942f4a52
MD5 5093e74cc7008095fe48c057234978d8
SHA1 a1b0a27068bbf5c1bdb87c6ab7f7cce93f15433e
SHA512 f77591b41544af23947fad9ed9c5107ae22b25d3776ffcaace16c3f7fe15c1eb89c0c655dc925621d38e02494cc4a501a0416df49ba03619ad369770dfc382ad
TLSH
T11C61F89551E1BC5BEFE600FA9BEDD44C726445683172DE3B16D290FD0A1F741E047570
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 af70214aa290da202bc8910b9c288960de432966e281b0a4784faa5946e679de
MD5 5e6ec23a9c7e75e899f5382c21069688
SHA1 6464dfb9e5c1e85f7243893097625bc370094123
SHA512 4b75fad7f747f00a9d2d7bd26ddb110bde4b4cce3a5ed0b6190e6b4aedb0a550c8807b1d1c8b570f2aa0613d6daf7431a1c561ca8be41ab92f087227f37616d2
SSDEEP 192:sxZIRqyM/jK1Ml8MFA/fKsY4Bus2KIdp25/W6+WNkJe/PGg0Got4TLIg4J:sxZIAdA/fKsY4cC/bn/+Jqc
TLSH
T1FC52E8076A346977CCCBD219FA55BB53D6F51522D2940E48AEFCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 373e9c0aaaa9c95ef479142f14f4272e2dcc1b7538f7b352841d1a61ba4d1143
MD5 e3eb870051f6df34aab1e3969a611dca
SHA1 4c0fc135841c5ae6cd1d727fb3c184f61adab3ad
SHA512 40f250ddf9c5a294fbb96aa1e0995e866df76d9650ccf6832b471f673d0b2b3941f9f7455b9364480978dbe53cdb1a82073e55fd79f5fb207b7c48f44ec2b45c
SSDEEP 768:sx91L8/j2w/7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3AZzJLlg:sx91L8/j2w5EnqeWRmqSQBqu1jaKAZzM
TLSH
T19C030B3B2C4CCB7E4F804E9CEC26BE9A6DE8018B9698C95447FA844C03C76EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 88934890e011aa8abac034f05e7559b01e8d7067a935b92260dfe3833f36440e
MD5 36a560c38258d5c48e59ccbb43759b61
SHA1 51f16338d653041e078fb1cfa6c5235fd4f02c9f
SHA512 75bd8404dddf3e6402e50bf1107e7319684073c6ad1657a4d36f59479cbf3fb0d3280e0c652c9ecc3d27bb5f125febcc966d2470ab23f194c21cd00f686ed8b1
SSDEEP 48:KkeIXKzqUlxIZKCkcby5aIPK/K0UkHIUOaGkWH:KkegKzqoxSKCkSaa4K/KYK
TLSH
T10A91F001363A12432ABD3D4D8554BA2B86C130A33214A42BB7FD56628B67E32CDFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d2f35d9-c8fd-4a20-ab1a-8e4c2508769b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7d2f35d9-c8fd-4a20-ab1a-8e4c2508769b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 af500b44a0ee2279991330ed12438d2cbcc27a1fccb5b4b1b973d1d8f8d04e4b
MD5 3b8fec70d47cda161202a213a00c152f
SHA1 9001c9f73c14a2f2af0e017bae8497f2048ef87e
SHA512 f56021957f9d0b3ca6a64e44708eae3360562bc78e87d49c8ed225a6724aa7a66512dea4740cb566ce65fdbebbacc7bf35b1196bedf1a22c6b4f75860d71698a
SSDEEP 384:n3jccCs+Bt0S3v8NrUMl/6ZtJX5Q/5+f8IXGh2a+LpQsf3V:zccQPyujw4Li2a+LpQ4V
TLSH
T1AA827D76A8742D7BA9F39A59B0563643DFB410BBA7841FD4EEE84F1C044B29C131AD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 360c8e45f858c533c3b681852749d76a5e2ea6cbbe29ced83898e333def63a54
MD5 cd8ed177cbc8dfd648ddd19953a0daaf
SHA1 1099742339dfece4139042cc48fd0416c03ff13d
SHA512 a62bd49b5d4fe9219613efc142952d57296679bc160157d1cdd71c083c835eb649fc919ef748df7c325969f1fd9f5d836a6daab27c255e548fda521f9d80dd04
SSDEEP 192:ZGN66hNQmiUyQGhNNYX5Hw/5+XjzornWYQ/U6:ZGN66RfGfNYX5Q/5+f8/2U6
TLSH
T16002EA79B8687C7B9EF3AE45B48622179FE4103BE6955F84DAE80B1D00C765C2346C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6fafc0af2aef032368ff713aaaa022ed0d3ff578b810f366d97e03eb4c429d93
MD5 b902df36c6767693de05ad49700e22d9
SHA1 f6c0437d4ec8d43337c77b6dfad347fb5585f3c4
SHA512 049a0ff6a2198b1b8dbbb4bd3cd1b8e53f05a1c4c639788c457849060b34e82a8bcd84fe0f4580318c50ab19a071a5108913a2d1a30e759713f2d1bbdd898b18
SSDEEP 192:vGNO6hDQmiUyjlNvYX5Hw/5+XjzorIX+hUqLAqoU6:vGNO6/GDvYX5Q/5+f8IXGx2U6
TLSH
T10612FA76B8687C6B9EF3AE95B04732139FE5112BE6855F84DAE80B1C008B75D134AC33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 954f01b44767662cc728fd0b1b9c3d6ccc88ef15fa3f62911fb6d0142d42c2ac
MD5 7bd3e4e8cde095c684f57fce069d5b36
SHA1 4014af8b8fd660620baec5f0ff212dc87f4e86a4
SHA512 83a50cf1a10f0805fa3181b5f412e6706a2502316b149f073686d2e0e4e736a5fc7c377fa65b75ffc80871a788cde7fb970c91db22534924d65d15b3cae89744
TLSH
T173E00152530004B9C52C533050132B245AE2802842B111455A2055580C276002E35F85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5887b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5887b9.TMP
Size 392B
SHA256 15b83250441adb17dac74841d4140c384ef63bd127ca53b967c7c2fcbe22b7b6
MD5 e7c195461cb25369df7a76bdd2b17e45
SHA1 d23087465cae68c906a8c0a7eac1d56108e3d899
SHA512 052065fc52b2e7994da17e2b17785e42bbde45fe6b293405ac08b20ad1608627889172058f4156713432f814c106d268c786b61b19f763e06bce09301ed4afa3
MD5 SHA1 SHA512

Submit Download

eb9b8c18-1ee5-4ccb-a318-25d5bbbe1c0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eb9b8c18-1ee5-4ccb-a318-25d5bbbe1c0e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

a82d8d21-5a87-4ce3-a85b-be1c7f033f4f.tmp

Path C:\Users\Admin\AppData\Local\Temp\a82d8d21-5a87-4ce3-a85b-be1c7f033f4f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5c02a22-3bf2-4b06-a9a4-5a17b1ecd870.tmp

Path C:\Users\Admin\AppData\Local\Temp\f5c02a22-3bf2-4b06-a9a4-5a17b1ecd870.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir848_1683518656\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22f47709-a65f-41a5-8f53-c4f3cdd561ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir848_684417346\22f47709-a65f-41a5-8f53-c4f3cdd561ba.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-163-0x000001E519EE0000-0x000001E519FCA000-memory.dmp

Download

memory/2372-533-0x00000294CC440000-0x00000294CC52A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads