d852842db79465193ae7a51df27f4bbe3004168c76e42816a1dd2aaceaf65ca0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
teiuxctmdb/assets/img/logos/gray-logos/logo-facebook.svg
Size 7KB
Sample260508-pfpdqagw7v
SHA256 d852842db79465193ae7a51df27f4bbe3004168c76e42816a1dd2aaceaf65ca0
MD5 a4c152bb17b355b9870f95944ba366af
SHA1 9271a9a77f965c5d545a0e01cdffccb25b7318ac
SHA512 7913cc87e79a74f887d11bfa90c90a50dae2718207a1c5dae7cbea6995122c07657916848da16a3b4d5b98aba66aeddbd1be6b5fccf3fcc158ed2f33fd6f8908
SSDEEP 96:Uy/WSb55KVc+sT1Q8N1jicKMaCnWdtfSKfkY5O3JBLupE3g9GYLkp6ZPZawgz9CL:d/WStAA1Q8n1mPdcUqBKpKg9GYLhawZL
TLSH
T1F2E1A4A98B041EB6F98487E8D81228547431307BF5A5D38D89EF94F13F16ADD08BD8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4512	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31252231"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2515567788"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227169873574902"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{EB746450-2C6A-403B-9C3C-DE23A72270C4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2348	3672	iexplore.exe	79
PID 2348 wrote to memory of 1696	2348	msedge.exe	80
PID 2348 wrote to memory of 4512	2348	msedge.exe	81
PID 2348 wrote to memory of 2576	2348	msedge.exe	82
PID 2348 wrote to memory of 2576	2348	msedge.exe	82
PID 2348 wrote to memory of 2576	2348	msedge.exe	82
PID 2348 wrote to memory of 3024	2348	msedge.exe	83
PID 2348 wrote to memory of 3024	2348	msedge.exe	83
PID 2348 wrote to memory of 3920	2348	msedge.exe	85
PID 2348 wrote to memory of 3920	2348	msedge.exe	85
PID 2348 wrote to memory of 3920	2348	msedge.exe	85
PID 2348 wrote to memory of 436	2348	msedge.exe	86
PID 2348 wrote to memory of 436	2348	msedge.exe	86
PID 2348 wrote to memory of 436	2348	msedge.exe	86
PID 2348 wrote to memory of 800	2348	msedge.exe	88
PID 2348 wrote to memory of 800	2348	msedge.exe	88
PID 2348 wrote to memory of 800	2348	msedge.exe	88
PID 2348 wrote to memory of 4764	2348	msedge.exe	89
PID 2348 wrote to memory of 3256	2348	msedge.exe	90
PID 2348 wrote to memory of 4764	2348	msedge.exe	89
PID 2348 wrote to memory of 4764	2348	msedge.exe	89
PID 2348 wrote to memory of 3256	2348	msedge.exe	90
PID 2348 wrote to memory of 3256	2348	msedge.exe	90
PID 2348 wrote to memory of 1880	2348	msedge.exe	91
PID 2348 wrote to memory of 1880	2348	msedge.exe	91
PID 2348 wrote to memory of 1880	2348	msedge.exe	91
PID 2348 wrote to memory of 896	2348	msedge.exe	92
PID 2348 wrote to memory of 896	2348	msedge.exe	92
PID 2348 wrote to memory of 1148	2348	msedge.exe	94
PID 2348 wrote to memory of 2692	2348	msedge.exe	95
PID 2348 wrote to memory of 1148	2348	msedge.exe	94
PID 2348 wrote to memory of 2692	2348	msedge.exe	95
PID 2348 wrote to memory of 1856	2348	msedge.exe	97
PID 2348 wrote to memory of 5104	2348	msedge.exe	98
PID 5104 wrote to memory of 3920	5104	msedge.exe	99
PID 2348 wrote to memory of 3596	2348	msedge.exe	100
PID 2348 wrote to memory of 3596	2348	msedge.exe	100
PID 2348 wrote to memory of 3412	2348	msedge.exe	101
PID 2348 wrote to memory of 3124	2348	msedge.exe	102
PID 2348 wrote to memory of 3308	2348	msedge.exe	103
PID 2348 wrote to memory of 4480	2348	msedge.exe	104
PID 2348 wrote to memory of 4480	2348	msedge.exe	104
PID 2348 wrote to memory of 4420	2348	msedge.exe	105
PID 2348 wrote to memory of 4420	2348	msedge.exe	105
PID 2348 wrote to memory of 1500	2348	msedge.exe	108
PID 2348 wrote to memory of 1500	2348	msedge.exe	108
PID 2348 wrote to memory of 2728	2348	msedge.exe	109

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\teiuxctmdb\assets\img\logos\gray-logos\logo-facebook.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/teiuxctmdb/assets/img/logos/gray-logos/logo-facebook.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffeefd7c188,0x7ffeefd7c194,0x7ffeefd7c1a0
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,4335476306160187545,3456200122581054345,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,14271366959511800168,12656611557900394211,262144 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,2845642149570039943,6342914344542357216,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11345817719650972510,12899429670018442526,2097152 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14367450847807448879,10995760630391248132,2097152 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,12834187380226003104,4764639538646459176,2097152 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,11569371690903305698,2977388038556081077,2097152 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,12835585540081368148,4870639831337938990,2097152 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4380,i,944737651021540983,17183033589219080352,2097152 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,15028778616683376402,15030503610510884075,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,10113293258445037582,9409252388716536872,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,6026657407796194897,6301483275032124254,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3937480510315037693,6932044825396272626,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3937480510315037693,6932044825396272626,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7964553107988511277,17006374371967435479,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1136
      4⤵
      PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,13598082979389875234,10011120998534530381,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,712087092638629954,3416418115312400989,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,1241499187348600615,14979732656072881886,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,7605002481028968087,6805942779863743609,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,18325505663921687207,10628713886527505446,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,11943165246827038522,14717492859803916039,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7681783556798676915,133289522191946314,524288 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6652,i,1018264670627297494,15614339493661319461,262144 --field-trial-handle=2040,i,3491607752269578978,11228729037218208124,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:10
    3⤵
    PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1ddeb1c358383931731a7b0e1787fec53a6b7a585d78a6c75263104f5fee1ce5
MD5 ffa44b48b4aa9da7298974afa00da06e
SHA1 f96073d7542ccc76466b1a5cb405833e43126f88
SHA512 76f69ab0f3c244654feb7c2282b1e41278dcb5aee37e2af4938b2ea9b531d52f4ea12bc2f011c0761ddd54730e8ec055a4058120ec6da2dfdb38fa327206fe37
TLSH
T1B971904C93A5B42BEBF809BF36ED104537B36E3942732E6316EA40BE091DB521E84C30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583256.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583256.TMP
Size 3KB
SHA256 db6f8ac95c9d3ae5986e37211c616746ade66445f87beed069a99dc9884f3d12
MD5 e291ff489aac6df945300afe6af6d13f
SHA1 5701269f7b41d0998da9d1b7d683e3c2cd3522b6
SHA512 819b73ee9762922f8fc4415390aabe486bf138574729c91c742f4006a4e84cd8ad0996e1e55b139522cdca06a3d19c6f5c2e034d73fa118bfaeb03e2624df3fe
TLSH
T13971904C93A5B42BEBF808BF36ED004537B36E3942732E6316EA40BE491DB521D84C30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 575e0ade97b7c22f18d4e333a86643b8f852642c36acef75c516c286a20240dc
MD5 6142f3cc0992c1a39eb2cf875b1d5e2e
SHA1 6c962260bf2fe35c04ea673ef35fac467c0a4161
SHA512 b7c890e4bec32742d8eb1b8fbdf68604a1e6582d3bc2ee7bc93eb0f7266791559c353ebd39ca769aecdb204260b9884a4bae9f48fae1d62fd6bfb7e324207094
TLSH
T15B31BCF3C3E4866EC91156F0AA14AE2FCE2D0901831C3C5A89E4EF1B93E2475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b2fe692aa1c7916fd58b7c2c85f1ff163d4a2188824ef60a9cab777218ba588
MD5 996485e07dd9297faf4ce2342f1a30b7
SHA1 0a509e7b213f92762e7042b8aaf0a5cfeabd7047
SHA512 88a65649d68169442cf238f4b1011b27f98ab251d1bd91cf8d6a9166d5769a6ef054b354a0fb12b8bb719a3bae42a6c12d240b971903c06ae9ad982d1bf5a722
SSDEEP 192:sxZqQR/yM//K1Ml8McZ/fPsKCwIdpyQ/W6+WNGY0F/v/JIg4J:sxZqQB0Z/fPsKCRr/bG5rc
TLSH
T1EE52F9026A385977CCDBD209FA55BF93D6F95572D2900E44E9FCCA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5a5c2f93860cb90bf2e857693872b9086542a9f4d8edb790dd663fc8457d5cf7
MD5 f0554eb7e7d3de583113dfc6048b52e3
SHA1 d6f7f28f70c42098928c857094950c9731e40836
SHA512 9a7d547252ccf5f08f575cd200d5cd3f5dbbc107d8d64bfe4e6557b2df30b772a61bebff7e4c9258b314a8f1808d06da871b2a9eeb6b24c362e4063f3e790e8c
SSDEEP 192:sxZqQR/yM//K1Ml8UQMcZ/fPsR0wIdpEQ/W6+WNGY0FiEZ6JIg5PJ:sxZqQBqLZ/fPsR0Rx/bG56T
TLSH
T10A52FA06AA385977CCDBD209FA55BF93D6F4547392500E44A9FCCB1C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 53a2618ee2bc27a0054404a4a0a87278d00161dd3ae7d77edbcdd6f52cf8ad14
MD5 828a97bd0a013a11fd10c15ee0fc246c
SHA1 561ca1845dcc75cfbe9a2135b244d6a4cdefe309
SHA512 d36600b207caf6ba69d0296a16768b80ef32231f6179ef3ae04d219a5db787f3235c54eb65333d11766bf503a15b6f66b48d09d001864dc8ce27df3fad68d4b4
SSDEEP 192:y7beZCuc48TAfSmq9eUrmGvUu1bmhq2EA0LYHKOilesTeO3MmJT+:ylLRd+
TLSH
T115E11550B13A0B913A7E244981E1B87FD6C131A77014E93B3BB942A51F66E14DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ece9d0fc-90ad-4af2-a081-f50b131e2b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ece9d0fc-90ad-4af2-a081-f50b131e2b00.tmp
Size 31KB
SHA256 083ef925cde48f0d16909b0d68371559ba54bc2bc4def4ceb1e1485b61c0d345
MD5 91dd0307eb84d213a93acb62d7b12a22
SHA1 e872444b0fecbec715001890e6326dc4c939c68a
SHA512 1649ec4558f82f8c668dbe48cb1a508fa3565de5ac1005a7f9426474ea7d95a0c92c29561590731e4dda80ee29e0b367019d35124cfd196e158ad9b8bc022d0d
SSDEEP 768:YPP7x8t12K0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KzLl/cK0FHbro99:YPP7x8t12K0WRmoMQ3Au1jaKKzLpcTFG
TLSH
T1EFE22A3B284CCB7E4F844E9CDC26AF966DD801CBA6684D4447FA894C03C77EF951A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

153e2804-d144-4460-b50d-dc2b3d4bfa45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\153e2804-d144-4460-b50d-dc2b3d4bfa45.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 417de6b5a110cdad55c8a1d38b7b1068930eb566fc097e73cfada2c53b737e89
MD5 80fcfe2bf10f385e3cf50a340c2b9014
SHA1 af286d0bcbfeeec95669012960423ed3fa6eddaa
SHA512 cf9ac82ce2947a0a3b1ae4a9b4973402aab000ed4097e5da8c0a51b2c5a594eec95d0122d53b92a10239a93e00b1e83d106e79cdbfc7f8a24cd0d7b58edb3138
SSDEEP 384:nxiFwCcmyWCN8NE8TUNTUlIlzpmCu8QMV2QUdqDf0P/F3b61e4KV8p0nLH:YFTcpNFwgVpfuAYQUrP/FL61I8p0nLH
TLSH
T161B22A35D8A9CE3BACE78785F64776879EE050A786C89ED8DAD95E0C00C71DC170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c137a06440dc2e7a9bacbe3577ed8422945c77b5f2a47709093b0e9b73060590
MD5 0633857c1b01b118eb04625dc5cb14c7
SHA1 f968a4d90d7a8cad044e472e42c6259255bb1d79
SHA512 f3a70a4a833f7ca016b570ef6f3a52ca5beee6709560caa336d4c7278a738e70b8b1a4104e7e2d7db3eb88eba097d8f4cd70d4f1e0ac2cdcc8ed74bbd450ebb4
SSDEEP 384:niCcmyWCp8NMspmCu8QMV2QUdY/F3/61e4KV8p0nLH:ZcppApfuAYQUO/Fv61I8p0nLH
TLSH
T107827C3068BD5C379CDBA518F44B37839EB464BB86C09F69EAE99F0D04DB1D8170A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cd87413895130f1a00da7e13bab924680e92959bac2ca23551bd54c6041acf08
MD5 00a339692503ccb1a0e08aca145281ab
SHA1 5eb589a45033d7a15da4d27faa24fa438c625dc3
SHA512 2ebbfd1c8561274d8b8445768111c12c94d1856f70e8fa735130c5912e772ec10c2edfc50e73caf74cf5d445fb57f8a51909f8374c672e137e7e5e8db96db7ce
SSDEEP 384:n0CcmyWCp8NMzpmCu8QMV2QUdY/F3/61e4KV8p0nLH:/cppPpfuAYQUO/Fv61I8p0nLH
TLSH
T1CD826C7168BD5C339CDBA118F44B37439EB464BB87C09F68EAE99F0D04CB298170A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe74b758b4ba25de8c592c3a96a078774787aad1127d5e942888b52ab6c8a734
MD5 52029d2a4420afeb077cadfd799e327e
SHA1 28c998be584f07aec6d598c813d5773ad04fad5b
SHA512 981cb63e3b73868e1da306d8a504b1dfa6d5eb06c701a82e52ac970bf649c6a1551aac753ceab710e220ba41c6b50d5b622ed8839ee5e5f26679524c76a5834c
SSDEEP 192:ZGNd6Pt3QmiUykCck4qB/Fl8pbRlo7rYp+U6:ZGNd6FZbCB4qB/FNi+U6
TLSH
T1BB021A3478A86C7B8EE3AE45B487B7235FA4207BD6A55F94DAE41F1D00D769C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 add663dbac05898c2dac4c1d27f4f91d19ad1041af184ea8a846cf6f696f3f0f
MD5 e0a34fd66daba7018e5f292101f2d642
SHA1 b6dfe2cd08b824ab133296f4f7bc779376a689f6
SHA512 7a7168ae292f35af25144f2719e33780e5fd862ac888a44983a717d79a27afc97571a57c3cf6ee012afe1515f8faf6d4289931713b3f22014df77305c41f4b91
SSDEEP 192:TGNl6PteQmiUykznk4/B/Fl8pbRlkAYxxn42qsh1U6:TGNl6Fabzk4/B/F3a61U6
TLSH
T18F124B34A8BCAC375DD3A964F08777539EA420BBDE849F55E6E51F1C00C768C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e7e1349db604dc6d5f995eb088fb8750a3c2e369219c79576bd3bbd3e5fad469
MD5 2ace2e2e598fd2daddc6d23129093b6b
SHA1 c5bf97820178fbbe02b118bffed2b12f540d313b
SHA512 3c60e1130fb9f0740232636bdecd496b2b72d189edcf371b8f176e538b1f9d6fecb128dcb4b6b3bf48239f8d4b32a35edfd8fe4b36a681e159135e6189dcb2f4
SSDEEP 384:ndCcmyWCp8NMwpmCu8QMV2QUdY/F3/61e4KV8p0nLH:8cppkpfuAYQUO/Fv61I8p0nLH
TLSH
T115826C3168BD5C339CDB9118F44B37439EB464BB86C09F69EAE99F0D04CB2D8170A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ee0ad534-88fa-4e83-a3f1-a474b83c2f94.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2348_591887330\ee0ad534-88fa-4e83-a3f1-a474b83c2f94.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-238-0x0000015B7F920000-0x0000015B7FC98000-memory.dmp

Download

memory/1856-237-0x0000015B7F920000-0x0000015B7FC98000-memory.dmp

Download

memory/3920-155-0x000002A0F4850000-0x000002A0F48BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads