hxxps://uncoverla[.]sfo3[.]digitaloceanspaces[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/04/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uncoverla.sfo3.digitaloceanspaces.com/
Sample260423-e3f1ragy9p

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5940	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1815599781\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1815599781\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5940_924913572\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\fr\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1349298276\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1349298276\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1766342654\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1766342654\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1902861307\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1902861307\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1795879017\_locales\ne\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213920803653318"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{26D201BA-9935-49EC-9B09-05B23529D9B2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 4664	5940	msedge.exe	82
PID 5940 wrote to memory of 5024	5940	msedge.exe	83
PID 5940 wrote to memory of 5068	5940	msedge.exe	84
PID 5940 wrote to memory of 5068	5940	msedge.exe	84
PID 5940 wrote to memory of 5068	5940	msedge.exe	84
PID 5940 wrote to memory of 3064	5940	msedge.exe	85
PID 5940 wrote to memory of 3064	5940	msedge.exe	85
PID 5940 wrote to memory of 2116	5940	msedge.exe	87
PID 5940 wrote to memory of 2116	5940	msedge.exe	87
PID 5940 wrote to memory of 2116	5940	msedge.exe	87
PID 5940 wrote to memory of 4736	5940	msedge.exe	88
PID 5940 wrote to memory of 4736	5940	msedge.exe	88
PID 5940 wrote to memory of 4736	5940	msedge.exe	88
PID 5940 wrote to memory of 6008	5940	msedge.exe	92
PID 5940 wrote to memory of 5176	5940	msedge.exe	93
PID 5940 wrote to memory of 6008	5940	msedge.exe	92
PID 5940 wrote to memory of 5176	5940	msedge.exe	93
PID 5940 wrote to memory of 3704	5940	msedge.exe	95
PID 5940 wrote to memory of 5196	5940	msedge.exe	106
PID 5940 wrote to memory of 964	5940	msedge.exe	107
PID 5940 wrote to memory of 5936	5940	msedge.exe	108
PID 5940 wrote to memory of 4320	5940	msedge.exe	109
PID 5940 wrote to memory of 4320	5940	msedge.exe	109
PID 5940 wrote to memory of 1224	5940	msedge.exe	110
PID 5940 wrote to memory of 1224	5940	msedge.exe	110
PID 5940 wrote to memory of 3416	5940	msedge.exe	111
PID 5940 wrote to memory of 3416	5940	msedge.exe	111
PID 5940 wrote to memory of 5316	5940	msedge.exe	113
PID 5940 wrote to memory of 5316	5940	msedge.exe	113
PID 5940 wrote to memory of 4248	5940	msedge.exe	114
PID 5940 wrote to memory of 4248	5940	msedge.exe	114
PID 5940 wrote to memory of 2984	5940	msedge.exe	115
PID 5940 wrote to memory of 2984	5940	msedge.exe	115
PID 5940 wrote to memory of 4192	5940	msedge.exe	116
PID 5940 wrote to memory of 236	5940	msedge.exe	117
PID 5940 wrote to memory of 236	5940	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uncoverla.sfo3.digitaloceanspaces.com/
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc0eb8c188,0x7ffc0eb8c194,0x7ffc0eb8c1a0
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,4719862178097336074,7144250277486404266,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,12305066973445479031,15156141746986923224,262144 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,12109453117871969946,14328972524895481004,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,379900538131480937,16214493303352639844,2097152 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,15568987225643146924,8787899010879409694,2097152 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13991341281588909680,3138768443541989311,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,3722782435206183966,4254986497403890409,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,5292385549026223420,15460715433768489510,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,5292385549026223420,15460715433768489510,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,14688712692398553561,2414145555834966126,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10995267918603070292,14046929579227838202,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7409625201529450325,14595070729159619357,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,14490447795905647012,5308900745194446888,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,16824500915758729131,12986024014204537266,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,3871492073679728503,2208916039321883407,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13298431695394066108,12651199088718619606,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,8686243275980277003,1559828131146520266,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11066461337628863897,17568327368554518421,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,8033294337357004564,14989968321506889881,262144 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13942498525638190529,17669972859118809143,524288 --field-trial-handle=2300,i,2673428272434057850,16133591331170066181,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40a64a56a478a0fd099a66c59798b6e279b6b7a22b9c8f9d0e45f56135026fa1
MD5 032db306dcef8996b2e04b1c5fb92915
SHA1 02e99bb7c04d80a0b1c444a4a3141092712f9615
SHA512 12a489ea13d1adccd0f85ea48f28ceabf79d50bb27aa46f0f1f6549e12735380b43d6896a6cf0d0fe25fa658a6b4710cab9bb1e977ad5ee1195bab21537d0a4a
TLSH
T1B7D0806C15715C35CCD66970059577293736C862AD5397561877243C0CC345119AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 124d32447902b00f42fa3f59cfd83ceb7ab12dd322f9918876a0e9161296330b
MD5 f8e69ca94220f6c63d19c2a95ec40a97
SHA1 77a8ca82a87b08fa7c00e9c3e121025febe8d349
SHA512 4da29610907c504f91db2c4d862f4d8532c6f6c9145fed1d84d9312e1a7a40e7fd5a853edc2ad75976219e5501b7cdbf6aa839d3d929cbddce3e7eaab7edf383
TLSH
T108E022AACA619D3718FD071D24544609EA60135B2B828A9B3A3E960D8FB423A47C7C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45eced561895ae6dabe00ce00607e0c07dc2f4d6729f7c1788873498297e2ad1
MD5 5f5af334fb13368d85654e8b7f8bd58b
SHA1 8eb6a7d5cfa641033f205c670592157c81c482fa
SHA512 226d973f312b14f74607d5ea38e1ed5de810f790f3fab4a731d36b429f2552a1452bee98fda7bbcdf03437befb5841dfa182abc1b9c54ac65c5718be0d9fb82b
TLSH
T1B141C0F383E8856DCA0195F0AA187E2BCE1D0A15436C7D9A85E4EF1B93E3461E14295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9be4ccb7d54f5aff417ed628e6b9147fd3a9b1482b9f7f4777fa6a30f5fcdf8c
MD5 8a0fb7e8067eb30ead73aff897e6f93e
SHA1 4dcaa3f9cc2756b70afd52ceac1c1241c04d3307
SHA512 f725daecab100b230a0c81c2677b6a863dde3b404a07cf351c0d91251a85f7d4a65dc3d1254a0afcd6abff5cf9bb9e028fa387e1d0cba58c65b965f06ac078e3
SSDEEP 192:sxZX+RgyMqZ/K1Ml8UQhkT/fds8tC0c1cydzodp/pJHW6+WNC+t/YtPqEguVIg5D:sxZX+5qyT/fds8tVc1wBJHbF/XWPp
TLSH
T18072091AAA38997BCCD7D619FA41BB53D6F91523D1904E449AFCCF0C04E6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a08512a6759a816164b0480f4f385f5fe75a6732e20533c5ec434e22e0d42431
MD5 ca33f55b7ea2a973e7d049ef0ad38387
SHA1 371f77d30db0f1db3a0808496d3b98c573c15e5b
SHA512 87a4d4f6e6949edf0fe338a63ca89386d93a3c9670d246d0d1dcbffc419e823d26999991522f69b984953db7008f594ab0be69ca0bc0b98963fa4d9154c3fcd9
SSDEEP 192:sxZX+RgyMqZ/K1Ml8MkT/fdshUC0c1cydzodp/pJHW6+WNC+t/YtXqfguVIgjNJ:sxZX+5MT/fdshUVc1wBJHbF/GWjX
TLSH
T1F87208166A38597BCCDBD619FA46BF53D6F91523D1900E489AFCCB0C04E6ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 10d8e8439586e96185fceb8a50d402815bbf8e20bf063521d64a1221016050ae
MD5 5c4c7c8d6c8c6a8e257d6f57fd8a79f2
SHA1 3a40c8ad3337ed81bbdd75b89792f80d5d675bb0
SHA512 87566aeaadeb012bab385d54cebc6fcce9c4d03b7fc543618e375bbe7d49f9ca715aaec1682d31cb3d62b1afa4ad3583b285c6f10efae3c07d48f4a39e177901
SSDEEP 768:wsk8n557pLuL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/I/eLlkqHdvroM:wsk8n5PE/PvWvP5kFu1jauI/eLiId8yv
TLSH
T10DF2FB3B280CCB7E4F800E9CDC2A7E9F6DE8028F96D8895447E9944C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 7f37f29e740a21b5db23a248edd3e2aaffbfdceefb0bd8af171e8c30a2b0ab55
MD5 9e4243191b343c996e9446ef452c7745
SHA1 d0edd8ae7ede92d6526ec611bbd485d4714c2d27
SHA512 54f107deff10297c4bca365d18568c310f14db62fe86b2256b35cdc83d938f412e511e3b9319ada5dc3287030618206dcfa66887abcdcb94ffb954c2e7179810
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAw:eflBf6532xxBzXcn5H3POrXOP5l
TLSH
T149B22C51713A02913A7E69CA85A6B81E42C331737418E43B7BB900B61F6BE21DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1fe16fec2fdd92149aa72d89f99dfb932333c3db55a2de8984aa344236d00066
MD5 89edc83d74bbcbcc0445053a670725df
SHA1 1a4ed082779c275d5e8f9746ff1b780bc80a56d9
SHA512 e11c45a51aba64f119bda3bcba06cae3ebd569403fda99bc8dbcee54c6f3f391b95ea52b082983913eed5493f2751e95cce22278a0e6cac13373222fce7a0d3e
SSDEEP 384:nYiFJjccCs+Bt0S3be3sNW8TUNTUlI4kqqOABAgZ/6Tvf7Yg2tjOXI5tGnTln+qj:jFJccQC3jwgQK/AYg2tjO4UTln01tHq
TLSH
T159E2B2F194E78977E9AE8B87A37D6E029AFCC153B5884994B7C40D0CCC861BFD306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cc0c941bb105ec9209b6f695460162dac272ce5e7dd528a3fb2fd33772fa1d46
MD5 4b0cd779f738808814000ce0b72c66b9
SHA1 dc70e5b82d273d9f6d5e0536c457f53ce833f134
SHA512 8e39d402424b4388f92bf70dd07a0977e2224a46caefbb6d793cb2f923bad24a248141bc15732e45bdb40312695a5a6bf47b13745be231ff0eb66be2d20b26a9
SSDEEP 384:nJiFavqMg3sNz8TUNTUlImkrqOABApHVTvf7Yg2tJERYV/Vw1mRarN1k+5vI+K:gFayv32wgRTpYg2tJERYk1mEO
TLSH
T10EC25B75E898DE7BEDE68FC9EB0A7A07EEE00167C58C4AD4D6D81D0D009719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 193edfdf84a72a66b9a038b0f13517ef83abd6cc9a8ae6625d0a5e3c4240fbaf
MD5 30107cb2bd74749de69fb5b4c89735f2
SHA1 a3cf485a9614c8e2490baf570a998acb49b1dc66
SHA512 f0b8fd8f1101ef47f4c4457eef68887137eadd29eb55fac70b4be85cf7b45fdf61f291fd506838e41cd4404aa30125739fbcad1cb62f4487e23cfbc27a2c1773
SSDEEP 384:nOiFJjccCs+Bt0S3C3sNW8TUNTUlI4kqqOABA6Zc6Tvf7Yg2tjOXI5tGlTln+qc2:lFJccQi3jwgQMcAYg2tjO4ATln01tHq
TLSH
T16AC25B31E8A8DDABFDE78EC9E74A7603AFF04167858899D4D9C81D0D008B1DD170BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7e177ad0b06e55ac9b5163a104bea4c0049e08a80e3ff0a0f94ffe6284485bbc
MD5 49640ee33d46cc07f5cea1f761fea4f6
SHA1 0f796e20d30d16b11387a213aa9309f0f9161a8f
SHA512 3e29ceb80ca5ccaa4ebdef26f410295f809db779ef93953e4d7d27b880603305476e0eb7cc8eb0e06766a72ff1b998fb7ae431862c1239bd1ebc7b194c0486ea
SSDEEP 384:nRiFJjccCs+Bt0S3C3sNW8TUNTUlI4kqqOABAgZc6Tvf7Yg2tjOXI5tGlTln+qc2:4FJccQi3jwgQKcAYg2tjO4ATln01tHq
TLSH
T160C26B31E8A8DDABFDE78FD9E74A7603AEF04167858899D4D9C81D0D008B1DD170BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d29a19f0002222c951d3f71bd28f58603efd8d14df7d4a97dcec9bb4e6349e2e
MD5 743aeb8c09787f12832aa4bdd38ae6ab
SHA1 749d0d0a68509bb4e9066951b898acab7c184e25
SHA512 f17c94005a78c8470683960bf8b92255651367087594f142c70b84ad0f9fb3f8ce655c92800d12d21078e019684ac35a08ec7ebd6d3e6d915238860fd26c1988
SSDEEP 384:niiFavqMg3sNK8TUNTUlImkrqOABA5A4bTvf7Yg2tjOXI5tGiTRYV/Vw1mRarN1O:pFayv3zwgRU4DYg2tjO4tTRYk1mEO
TLSH
T19AC26B75E868DD6BEEE68FD9EB4A7A07DEF00267C58C49D4DAD81D0D008719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 30c9899f44b617b35683f17ad7c78f375004087f564fe5fa74702c16492beb02
MD5 dc315870113f85a5525c7eadfe269d0f
SHA1 2963a09c0050cbb8b88951665732497b47f4a2eb
SHA512 92cba1b7335f3ea8ca17a6c44db1f22aa09ff85289ff56c605d22cfec4a32cda98eaf92f4aad585cd92e057db94bed3ef37091a7c254374200a766bf43183446
TLSH
T101414EE1493E2AD1C4FD0A6E649738FC91D8C32AF4B8303D6420DE98073A60E644043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8e69f4b90364bd1ce3d3693c007a0a06ad6fefedaa4b23d9b34d709b7dbd73c0
MD5 20f2d91696b0725b209b6e008e0464aa
SHA1 09b75cd1eb39bbdf39c7c15dd4d7ec49431852df
SHA512 827d45bdd31df9940201785188c44ca11921ebfc36b54d628512de7746cd850ff49342dfb01cc99fd92930e959fdaafb968d54ad0c44811b444d4c1038185006
TLSH
T118412EE15D3D2AD1D0BD0A7F749B38FC95D8C72AF9A8303D2864DA98473A60E658043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b569fd2305c246fb3cc3da3353825b4e887ef03467f6056a396ea76506a68ec0
MD5 69275bb3f76e0878b00274a7ee37e7c1
SHA1 25e54e97d31ac0cfce5fccdb8176420fcd2590c0
SHA512 042187f07a534c232c2e8ee0ab6f7abd6431c1e0cbad063ce69c029e42f68ed4c693a4155b05f993ca5c9550b83f242d0b518e379d286dbda9dc0a676269e63b
TLSH
T1C34142E1493D2AD1D4BD09AF745738FC95DCC72AF4A4303D2864D998073920D254043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1e3ffd30014b729494af4bf2189499583a73e14e899275ff78a0a2e8e7724b00
MD5 2d3a1ccfb9c2d7cf9dc1700a8ddee94d
SHA1 f1fac183ed98847ee026b886bf048337978c5557
SHA512 39fa2567a2fa0982d8040260ed84d90adcc196e1ed238f65300dd129034fdd548292dd985c43c8688511a39c37ac4a4445fc3adae1e1d1127ca0237cc1fafa22
TLSH
T1494120E1893D2AD1D4FD0E6E649778FC95D8C32AF4B8707D6464DE98473A61EA04043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2bf3301e4622cc92751b6cb61a9bbbbcdcbdbaa8fe754050454116cf6cfbca89
MD5 eecb8e8b911f48ea98170eb16155e4f1
SHA1 d56c5c5b2573074474f00b73e505ba8aca4e9110
SHA512 a91264775b8a264b510dada5d2dbbb153d45912986f89364eeaa1256656ca0f090415609feb9d108778c01249d8736afd22b0f5650f884880ed3a05fe7171f34
TLSH
T1E641F498B6F91548B3B77E1AAFF2B96E487A79372E46D49D00000E4F4A26A00C861733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3704-210-0x000002AF0C000000-0x000002AF0C353000-memory.dmp

Download

memory/3704-201-0x000002AF0C000000-0x000002AF0C353000-memory.dmp

Download

memory/4252-35-0x0000019D42860000-0x0000019D42909000-memory.dmp

Download