hxxp://aquario-fish-manager[.]website

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
07/05/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://aquario-fish-manager.website
Sample260507-ehrlraax8p

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2424	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1177868263\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2424_2035757226\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1177868263\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1498346014\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_2125965906\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1177868263\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1498346014\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\lt\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1601243408\_locales\as\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4268	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225998168559871"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903610002-708294114-949261322-1000\{A68BBF6F-317A-4DF9-984B-2E932DB6365F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1036	2424	msedge.exe	80
PID 2424 wrote to memory of 4268	2424	msedge.exe	81
PID 2424 wrote to memory of 848	2424	msedge.exe	82
PID 2424 wrote to memory of 848	2424	msedge.exe	82
PID 2424 wrote to memory of 848	2424	msedge.exe	82
PID 2424 wrote to memory of 3148	2424	msedge.exe	83
PID 2424 wrote to memory of 3148	2424	msedge.exe	83
PID 2424 wrote to memory of 2072	2424	msedge.exe	84
PID 2424 wrote to memory of 3092	2424	msedge.exe	85
PID 2424 wrote to memory of 2072	2424	msedge.exe	84
PID 2424 wrote to memory of 2072	2424	msedge.exe	84
PID 2424 wrote to memory of 3092	2424	msedge.exe	85
PID 2424 wrote to memory of 3092	2424	msedge.exe	85
PID 2424 wrote to memory of 4680	2424	msedge.exe	89
PID 2424 wrote to memory of 4680	2424	msedge.exe	89
PID 2424 wrote to memory of 4680	2424	msedge.exe	89
PID 2424 wrote to memory of 3388	2424	msedge.exe	90
PID 2424 wrote to memory of 5192	2424	msedge.exe	91
PID 2424 wrote to memory of 3388	2424	msedge.exe	90
PID 2424 wrote to memory of 5192	2424	msedge.exe	91
PID 2424 wrote to memory of 3780	2424	msedge.exe	93
PID 2424 wrote to memory of 5052	2424	msedge.exe	100
PID 2424 wrote to memory of 3628	2424	msedge.exe	101
PID 2424 wrote to memory of 3140	2424	msedge.exe	102
PID 2424 wrote to memory of 2888	2424	msedge.exe	103
PID 2424 wrote to memory of 2888	2424	msedge.exe	103
PID 2424 wrote to memory of 4620	2424	msedge.exe	104
PID 2424 wrote to memory of 4620	2424	msedge.exe	104
PID 2424 wrote to memory of 1744	2424	msedge.exe	111
PID 2424 wrote to memory of 5292	2424	msedge.exe	112
PID 2424 wrote to memory of 5292	2424	msedge.exe	112
PID 2424 wrote to memory of 2204	2424	msedge.exe	115
PID 2424 wrote to memory of 2204	2424	msedge.exe	115
PID 2424 wrote to memory of 2244	2424	msedge.exe	116
PID 2424 wrote to memory of 2244	2424	msedge.exe	116
PID 2424 wrote to memory of 2560	2424	msedge.exe	117
PID 2424 wrote to memory of 2560	2424	msedge.exe	117
PID 2424 wrote to memory of 2232	2424	msedge.exe	118
PID 2424 wrote to memory of 3056	2424	msedge.exe	119
PID 2424 wrote to memory of 3056	2424	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://aquario-fish-manager.website
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd68d7c188,0x7ffd68d7c194,0x7ffd68d7c1a0
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12437484670577704877,6147629549002261233,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,10613058360654520688,6460727330908082488,262144 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,9936355839250049648,9515476931210999287,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16682448207606766437,10938396329897859519,2097152 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11975902280727577374,15052222166868055810,2097152 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3424,i,7551932273277389079,5599776385773274919,2097152 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,10867213765497157585,4563384310450430088,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,140057719637408949,4745841241128948318,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,3159452348034400211,17884561645245934473,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,3159452348034400211,17884561645245934473,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,16010120332860959132,9212808675407593254,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,13172976964278285719,14972629001658154494,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,11549380645125242469,4933576781107528890,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4277677236599062191,6585146244821227745,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3717408201697637766,9732717758568268771,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,10624830477955112650,2107138260089357600,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,10624830477955112650,2107138260089357600,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,17759287822404112816,7851592249599435990,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,5000030013088396602,17461450370789509363,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,8060989877516774210,15192438935180419360,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,15103812557978974335,810835376329292455,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,9730266310496201681,8136760295861046791,262144 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,8472961177142562299,10182651777450456052,524288 --field-trial-handle=2308,i,7465830063269012978,4462094979002111967,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69a1d6c2546f99910c6f349ddb665d530af289283332c1b54d92ff0340de7fbc
MD5 9dd12f0f7f7c020c27ee69da3c41ea58
SHA1 83e40ce506be9fab44d721ec8ab9f5af9722b38e
SHA512 b7f32c8b78e6734eebbbe7cf2944484340e3f32441ca6943b39c0a677d4424de3f45feaa48338f99996e31b46c55212827a384d66c07ed3571ba6ffd51c436ad
TLSH
T195D0C02C13B12C20C0D89938028C3B4F2E1CCC12054B47153C7338BC0C030103CC91D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 681328c8413fda75a51189b78f6379b1ee0309d75144ca8ff33a2656ec84cedb
MD5 0ff4eec6742c3eafb3e4d2b1be8a17d3
SHA1 87b776cff4e20b419791c0a7a5a49da8d91229fb
SHA512 525896cf68edf91db0d0dc681112ed436a3ebcab42ad2f03d796fa9e2472cd279feafba9b809dc18476c574b82a1f657dead8511e80a203527b2971ba86c4824
TLSH
T100D0222813B11C20C0C4993802883A4E2A28C812054B47152CA228BC0C430103CC9197
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a1872aeedbd75a1d6ad55e2e2fef53a66d65deb180d8713673c2ac704eefd1b
MD5 55922ef7c1a5205923ec1da515445414
SHA1 9821a75c4e0306b575e9ade930172141ae7fc98d
SHA512 647f36bdf918e42f3407f24bb192647dbe3918140a0b29146d9fe6efe9e32464a969eb48f773dcc839e9c61a36704655c5795669688b0de5c854fcfcce7808dd
TLSH
T129E02BBEDC21EC3B18F80B2EA0950346E710134E2B804D1F363C83084FB167A01C5C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eafb61f7dc30f5ec8f575a6397a85a42ce72de5ac124a5f65a3cdb5b11c86dda
MD5 14ffc0d5d6f0cb240c1dd3b012c3e93a
SHA1 0426bce1711e071ed720752608518e1e02b9caf6
SHA512 3ac856f98d7ad0813a79eda5f6c0ec857851db4270c0c32c23a8227c5c2d38ba083b351294df0e4a991dd7233eb242ca0bbe190b9280b2eb8e5bef9ddef4eb0d
TLSH
T168715F74F05C8529E7A054B519E364A272F086793B470F2D27B9D9F48B41B6351B0B1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582d26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582d26.TMP
Size 3KB
SHA256 7bf6473bf226ab4d9ac130c77f6bb934aff0d6db46d5b9e60731c8ceab9e2c52
MD5 5f15779e5b22a70fb8a525fbb95110ad
SHA1 cef46f96a005b3ffe797ec5f09584a7149b2452b
SHA512 bf4fad63207397e498e94597500092c691cb0986c714e16b68a2f59817f092c571cfa5c9333f92226a9e333118fcf21f1888e6ce036a2802da35f70bd0c8ae45
TLSH
T1B4616F34E05C8429E7A194B519E374A272F086793B870F2D27B8E9F48B41B6351B0B1F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8356e30ed8d4632f2dc98258a40ce7615a6997959a34c8ed453b3d2e4e06e78d
MD5 bfc64e32815fbb08f5bfeff9cdaa47ad
SHA1 9d474c3a11ff5533bd2a998ff8465c42effdbba8
SHA512 61d97ff3a0d920b4749e1f6b71bdd2de7e61a65a977a8c2fb8814320e4e60ccd995bd9d744ef58b1c6646ebdc1372af18b56a92e30475245e93dcb77fe8f4421
SSDEEP 96:DVOYlklO7Gz0cj17baOWq7hjiw4TWUaj6cmX7:DYe6O7GwA1GZq7pinbaj6Hr
TLSH
T15C91D0F7C7E8495D8D1216F4BB147E2BCE2A091893683C1985E8AF4FE7D2470E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bfe441e267da1bde7a06378d99b96d24d5097c43d793858daedc464688184d6d
MD5 8900d524c025232e930f15ce7e6b9e3f
SHA1 58cab061b3c6ff864119e1f83244b78af5ab8328
SHA512 43d5917a0f4a52de59100d9823a1b377b1bbc0b145ed959d6dbb8e7d4550154ac0a84ea0e2a0b397e02d0d5d89ac0c9cadb3aae252336dc065c69ac90c3d6c10
SSDEEP 192:sxZ5RiyMqZ/K1Ml8UQt70/ftsltPmUBHDl/DipzodpzaHW6+WNpM19/Y+UkqD8IA:sxZ5nqt0/ftslpVpBeHbi/E2FH
TLSH
T1AA72FA566A38A97BCCD7D319F6457F53D6F95173A1804E44A9FC8E0C04E66ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a0e14f980b1df1013380ebd99278a4b2b1e796505cd815fb8dc41e4a22c7b8d1
MD5 4c6030ac4e86409a8d1e7459643775c5
SHA1 7228b4b27cad5fcbcb6583af1b980d33273aa055
SHA512 a494226b7c1c8ef55208876ba54efdc9459cab267636f98e0f59f3f74a148e7b0586d20531de164e3e20f0e2b01b4242790e5b6d4f7c8cf077c84899fdf8e04a
SSDEEP 192:sxZ5RiyMqZ/K1Ml8M70/fts3tc6+W27l/DipzodpzaHW6+WNpM19/Y+UXgql8Igo:sxZ5nj0/fts3GnWMpBeHbi/EIjs
TLSH
T16872E9556A38597BCCDBD319FA457F53D6F95173A2844E48AAFC8A0C00E6ADD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7e7c452b285f767238f3b4d402e98e48e3fd783de699f847f80644631c332ed9
MD5 7e3b54900b7561f4aa1e82ba5b3ed9f6
SHA1 df2fd6c089bf893c9acc035ad380d8341a90df02
SHA512 4b87832e79575c5f4064ac195a5d9adfb7db1445299ccbc2e278bd0674905063c99efba590a1ecbb086bdb91346378f8fe10b285f2eedc75bfafb57914e97074
SSDEEP 768:vLIL+AI7pLuL/GeWvGSVq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDD2JLlVzetYro2:vLIL+A0E/GeWvGSVqu1jaKD2JLrCtj6H
TLSH
T1E3F21B7B6C0CCB7E4F804E9CED2ABE8A6DE801CB56D8895447FA480C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 0f785e4487712de7cdec2c47c0cdab74c6d9dd3ec5c9347f0c42812d27c07311
MD5 498a8a023959a016c189fd3765965cb0
SHA1 10a0cbef86cdf4879b7fb450257ac1b5daaf3273
SHA512 ac2b87dd6aa0ac173b18ad81b8970975fe9a4de4c982833d46d44a1ee79ed1be68af8265502dedf50372fc107e130d846d6d8ea3e384ad0c1ef0892f9aba5e27
SSDEEP 768:v4IL+dc7pLuLn5eWvGSVq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeD2JLlVzetYroP:v4IL+dAEn5eWvGSVqu1jaPD2JLrCtj6G
TLSH
T13AF21B7B6C0CCB7E4F804E9CEC2A7E9A6DE8018B56D8C9544BFA480C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a793aada6626efa9677d1a069c68c20f11d30a1fcd43c30693beae38d4313a6d
MD5 8ae0df2fdaec0309e9e7d576b3fe3bba
SHA1 f31c5a577b66a26474d2ea39bf7023a69ab4a032
SHA512 e3a9db8fdbc3adcf9cf07e47cfb8e25a07ab3bf323d91cac295ee9d11ea18f167644c1b7317d642a3cab420f99ad93477f761e4ce6ad4a06299d349127034c97
SSDEEP 192:W75v/AjXMvdf93ElPpR8VhT/jyneVJ91JLKZJOrxt5f39lRnu:WdHAzMlfNE9k9ftlRu
TLSH
T1C8B24E3071BAC2103A7D3ADC9599BC27574230A27058E43B3FE904A64F67E254DFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a01046ebc7794671a14cb25917f04192b7c998fb3a304cb507710e672714bcba
MD5 9ea2251d3f9eef204c71317234cbbad8
SHA1 56be390076987e90e5f1878f539f10ed6229fe59
SHA512 4e4fe2c0f77700ad2a65356e4338646951dad85e74633bdbc80aa504550a30b6c93407529580837149511175299115ac6893a993d251505b4160ecd6a8badaab
SSDEEP 384:nCiFrcXqni3sNI8TUNTUlI4k8FMLFzRZXD4fwKbp7bOvuGSNxo91tTzNeQaLNjkN:JFzi3HwgAFYVbKVnOWGYs1tAQkW
TLSH
T17EE293F5A8D79977E9AE4B87A73D2E429AFCC153B5484984F7C80D0CCC861BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 697328368df8663e7b992b1724205c4d48833a424647bfffd9c3207e48e2a88c
MD5 6bd3dc0bc9688f04f3b6956c109802b1
SHA1 7b96c6c12d35af5324c18d0f21ad5e4a9018a6a2
SHA512 b41e67e09a4d8d5bb3dd19981f7750b3716efa881b0e5921e88357177947f55a975813383416c6ab9a651e1b8c38fb661be25b117f3e4b74f238dd2640135ba3
SSDEEP 384:nniFavqMg3sNE8TUNTUlImkrLFzX0BD4fwKbp7bOvuG40CIm+5aLNjk+5vI+b:iFayv3jwgxaFKVnOWG40CIm6kf
TLSH
T164C25B76EC94DABBEDEA8FD9EB4A3603DEE04257C58C4AD4D6C81D0C109B19E530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9fb4d5b179c1269ae7c60a00ec1e84e29251192896ba958afcfc676df602799f
MD5 7617486ecdbf1e210c4c7b2bfd78be2f
SHA1 824d2cd773985a7e5459debf72751280b2026793
SHA512 b69fdde8d3be061cb635a9d2c83b982b80573c9bc0dde5d98b1e500a984101a8cc3c38ea78900155af499492d525e50cac2e583e6de00a062197dbb552bdaa58
SSDEEP 384:nJiFrcXqnG3sNI8TUNTUlI4k8FMLFzdyXD4fwKbp7bOvuGSNyo91tTzNeQaLNjkN:gFzG3HwgAFYGbKVnOWGhs1tAQkW
TLSH
T1ECC24B76E8A4DDABEDEA4FC9E70A36439EF05263C58C4AD4D6D85D0C00DB69D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a8bff8c86ec35f785ea7a4a1ae17338809966d2b397c5f1d35980a775a642f4
MD5 8582039b1276fcaf371bfe92621c1ca3
SHA1 b5c2c9582fcafc407144a351d6b71f1ac0909219
SHA512 cf3dfcb934410c734297dfa1e67810813a042538521f537ca28ee9f851a41ab2da230067e5fde95c121f770c8b7c713b42c78b859801e807aeb03719dd7aea6b
SSDEEP 384:nziFrcXqnG3sNI8TUNTUlI4k8FMLFzRyXD4fwKbp7bOvuGSNyo91tTzNeQaLNjkN:eFzG3HwgAFYWbKVnOWGhs1tAQkW
TLSH
T1EEC24B76E894DDABEDEA4FC9E70A3643AEF05263C58C4AD4D6D85D0C00DB69D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6abbeb8f0341d3c87c9ced7df411ccd2267d569c375daac9fbb40134afd5633b
MD5 f16a520f3fc7871b84cdb61ac4491e88
SHA1 8b05c0f2c20a50f1428f0325cae17a507ca5da13
SHA512 e948cf487b3495a93418314e2353f73f1a41159629fb2a898a1d438a5b42c26ad1c5154e60e5cd8ca7882ad46ac9ea5d3d76494919152c58cfcab717ccd05a39
SSDEEP 384:noiFavqMg3sNs8TUNTUlImkrLFzuykD4fwKbp7bOvuGSNYo9CIm+5aLNjk+5vI+b:zFayv3XwgxNkKVnOWGlsCIm6kf
TLSH
T146C25C76E894D9ABEDEA8FD9E74A3643DEE04267C58C4ED4D6C81D0C009B19E530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 963690674a7cc20aeb78f908f157fc69b6cdaa2a47a10822cc95df158f72e85b
MD5 b33350c7386c242f3f194c3adaf10d4b
SHA1 ad7fff2e6dc161fc1a8df1317bd9522f0f7ecb95
SHA512 7034f79b3ea6a1412885ac98bee9a17d118a6c50630290cf7af717b77e511c448d4dfee6eece9c8e4d2c2f966dae4eb965d1cf21a4ab3f4df2c920588ba7d0f3
TLSH
T1944140E04C3D2AD1E0BD0A6E749B38FC95DCD725F4A4343D2824EA94063E51D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fbafbfcd4b2bbf9bb493538dfac57f5cdda7e86b418847cfccfedf244362aac0
MD5 c784a08d73636cac3e1d06dd4707a5fe
SHA1 4fa1f97589a9a7295c3b744a69b457dc92f75c1b
SHA512 68db7a92048afeef3e05933ba3dc230bb07344209144c30ab847aaea0f153c1ef9af3c7f99d8c7a7fbbe7c8df63218d5b2c5968cf4eba0de179833f082e431c7
TLSH
T1D5413EE14C3D2AD1E4BD0A6E745B38FC96DCD729F8A4343D6828EAD8057E15D388443E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e7217bfe3521812c8c337692f7f7929d29a504b0d85677d613514381029c51d5
MD5 f7503e753d7c46b57b3061d43d39530a
SHA1 a57cd90274c2661edd09b0418f4faa48f262e1e3
SHA512 2e6e0ab6a750d13353b0dbd6167f4655eb026ec5e55eea793e848d56972168909bd712cc3fb88d9d07dd0c472999041a231b45eeb62cd0a063c61c6e41debd14
TLSH
T1394120E18C3D66D1D4FD0E2EB09B78FC95D8D329F4A8347D6828EA98053E51DA48543E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fcbe123dc88ccc9a27dbe587fd150acbd797c461b55f0b6f9c7486215066bea9
MD5 1f54a37f5c6fd7a0e92239e3829f1fa2
SHA1 e934a1c422b02208701e47e5a8c2b5049f3bf2f1
SHA512 caefcf6c0a3a5ccde779d5e768c58ee1ad10116a968ac6b19462f81b6b9e4ec063fee2760cd9f297dbfb5c59cc6d22a7f7ef4b2a2d9ff996cf01f07ee86d1516
TLSH
T17F413EE14C3D2AD1D4BD0A2E64AB38FC91D8D729F464347C6824EA94063E51D648443E
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b9e566abcf18e9ba283f1b3a5ce6f24c935b3a78db9c80170578649be5386b4
MD5 a8bdc21b0769ec613f0c9065c970f698
SHA1 942da51e0f6a4aa580c709020f5e41e52312de5b
SHA512 3b405ec5be374341869a9d40247d72384336a67a1cd1184d3e78f4ee0edddf7ea6fcc68ae70797d3f9823e2bcf3e40d8d39e577fd8d4831fb1bfc3710ae66ee9
TLSH
T19941469DA6FD0148B3B36F4AABF6A86D487B7D772E0AC55D00010D4F0622A01CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1744-552-0x0000021EB0F00000-0x0000021EB0FA9000-memory.dmp

Download

memory/3780-213-0x0000021D04000000-0x0000021D040A9000-memory.dmp

Download

memory/6040-35-0x000002221D2D0000-0x000002221D46F000-memory.dmp

Download