hxxp://projectx[.]cloud/

Analysis

user interaction
yes
max time kernel
101s
max time network
100s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/05/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://projectx.cloud/
Sample260523-28fcqsfs6v

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com
50	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_1257625165\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_1257625165\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_2124692858\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_2124692858\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134240517336162534"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{CD7C3C15-F578-458A-92A5-152ED8D64ECF}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{E91790E2-2B5C-4458-B057-F3B51E62E268}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 5780	4536	msedge.exe	84
PID 4536 wrote to memory of 4940	4536	msedge.exe	85
PID 4536 wrote to memory of 4956	4536	msedge.exe	86
PID 4536 wrote to memory of 4956	4536	msedge.exe	86
PID 4536 wrote to memory of 4956	4536	msedge.exe	86
PID 4536 wrote to memory of 4996	4536	msedge.exe	87
PID 4536 wrote to memory of 4996	4536	msedge.exe	87
PID 4536 wrote to memory of 5888	4536	msedge.exe	89
PID 4536 wrote to memory of 5620	4536	msedge.exe	90
PID 4536 wrote to memory of 5888	4536	msedge.exe	89
PID 4536 wrote to memory of 5888	4536	msedge.exe	89
PID 4536 wrote to memory of 5620	4536	msedge.exe	90
PID 4536 wrote to memory of 5620	4536	msedge.exe	90
PID 4536 wrote to memory of 420	4536	msedge.exe	93
PID 4536 wrote to memory of 420	4536	msedge.exe	93
PID 4536 wrote to memory of 420	4536	msedge.exe	93
PID 4536 wrote to memory of 780	4536	msedge.exe	99
PID 4536 wrote to memory of 780	4536	msedge.exe	99
PID 4536 wrote to memory of 2596	4536	msedge.exe	102
PID 4536 wrote to memory of 2596	4536	msedge.exe	102
PID 4536 wrote to memory of 2596	4536	msedge.exe	102
PID 4536 wrote to memory of 1612	4536	msedge.exe	103
PID 4536 wrote to memory of 1612	4536	msedge.exe	103
PID 4536 wrote to memory of 552	4536	msedge.exe	104
PID 4536 wrote to memory of 552	4536	msedge.exe	104
PID 4536 wrote to memory of 5804	4536	msedge.exe	106
PID 4536 wrote to memory of 2128	4536	msedge.exe	110
PID 4536 wrote to memory of 5304	4536	msedge.exe	111
PID 4536 wrote to memory of 4400	4536	msedge.exe	112
PID 4536 wrote to memory of 1364	4536	msedge.exe	113
PID 4536 wrote to memory of 1364	4536	msedge.exe	113
PID 4536 wrote to memory of 1364	4536	msedge.exe	113
PID 4536 wrote to memory of 1336	4536	msedge.exe	114
PID 4536 wrote to memory of 1336	4536	msedge.exe	114
PID 4536 wrote to memory of 1336	4536	msedge.exe	114
PID 4536 wrote to memory of 6136	4536	msedge.exe	115
PID 4536 wrote to memory of 3492	4536	msedge.exe	116
PID 4536 wrote to memory of 6136	4536	msedge.exe	115
PID 4536 wrote to memory of 5724	4536	msedge.exe	117
PID 4536 wrote to memory of 5724	4536	msedge.exe	117
PID 4536 wrote to memory of 5320	4536	msedge.exe	119
PID 4536 wrote to memory of 5320	4536	msedge.exe	119
PID 4536 wrote to memory of 5620	4536	msedge.exe	120
PID 4536 wrote to memory of 5620	4536	msedge.exe	120
PID 4536 wrote to memory of 5620	4536	msedge.exe	120
PID 4536 wrote to memory of 4988	4536	msedge.exe	122
PID 4536 wrote to memory of 4988	4536	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://projectx.cloud/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff8f0b7c188,0x7ff8f0b7c194,0x7ff8f0b7c1a0
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,7220885115730681435,5126694604352068495,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8577164051397665523,9139023459313856856,262144 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,10013841148019844670,7823543106452714873,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,10491850597358769424,12125139035072178836,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,12892099187032333761,14684453832923484399,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,5207026515279973739,5465229409520328386,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,12963235441948371216,1613825200680315938,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4964,i,18128157702048986569,14205007341770959862,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,8530186368444467076,17987606341051625999,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,2445795884278896738,10883270268306656497,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5321114581659165309,10455516892455519049,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5321114581659165309,10455516892455519049,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,12830513040922364140,17702760636897270409,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,16141499588382776429,13463040845587331212,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,16407320824037222907,7512604806975732107,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5304,i,8558015114315898646,9322121351484430901,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6416,i,12497763535820271691,10646756795823654888,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,17093765583305535578,8324672841783258644,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,3707751429280178721,17198856123717950627,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,18282982224172664198,14850484196406067647,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3028849372776629781,3939452935099878868,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5632,i,14255917087328075360,16365052214838398863,2097152 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,6452341580837366018,9805989249326312806,524288 --field-trial-handle=2308,i,4624350660142541058,16406865793113423800,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4874d5b1c2d26fb23950a839afcfe04537537aeebc495c4eb72691a0f551dd33
MD5 c621336e209b1a6ffb8679e0dafc1514
SHA1 aae1e6e3a0e3f9a2d67e3d433446db466d6bf8a9
SHA512 d5db964d93cd8275f07ed5f83e1b775c09369c845240c9d0e9be717de4088f6c237955ef2ba0918a88b38e002637b5b29b8b19007171acad9aefccaac8a49406
TLSH
T1AFF0A4E6CCA1AC3718FD0B1D60A5474AE799236B2B80595B3B3C920D4FB553B869681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 34KB
SHA256 ca36ea379200cb2b9850c80e55a943e4c5302fb294357343c98d014d4433757e
MD5 6f6a46634ead7af938f86482a2c6253b
SHA1 2d10d0a3a41ee3115c24aa0ceabac9e680944852
SHA512 6bd0a5153354b9935206976afb811c12d65b6900cc113691b4e7fc07b149ee460de8aa94a21723a41ec5ad3381a03271bf49f37e1e34be56b8c9721d023902a7
SSDEEP 768:Bnal3EgzIkJ9ey9z8H+QSRaCPkTUVFBwRBeRyD:Bn6EajJ8yh8eQohIeRyD
TLSH
T1F4F2E1CB7E8840699454DEB18499675800B06FDA683D3D6F232A4768DB03CBDEE7B25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 96KB
SHA256 b5cbf937d316c21e9ff19bca9141f56204c1134877848d77c519271ed0ae3e61
MD5 19b0c2c779b3fd711e3fd0ea54eb4c2f
SHA1 bd693868f58bb5b4a763d07fff14e660b8ea2e3f
SHA512 1efe1c6f1518ee7e017e0a97b31cbaa8670dd1d45dfcf07986e7888a3728b7c69eefb3046ed2931e59c361dc553804fd710b28a7609088090408be0beec9c7ac
SSDEEP 3072:+HGoXXyDLanLSN9xMhV6FmmC6e1d947mQyU05c:+XiDL/8Q3AT46QyU0y
TLSH
T19CA31229BFF41B72E074649EEDC2C3D5AD72938699E4362761EF8077319119983C3E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 400KB
SHA256 a4c853620a7c2d01f7c75db203efe9c2b8bd6d0e7ff55c8fd10c12faa372d407
MD5 52e528a49d253fd907626a5a3c786cba
SHA1 193a55bc10e185141ab0e52f5dcf6bd85aeefa79
SHA512 2fe7e0d753323d3d4972d629be99836aca2380355b914d51815e7fe113880c71b53eb60449420649876532466b08def8edff02b586b54e9ce77262740e38eaec
SSDEEP 12288:R4d+ZGK5AlQbQvgD897xGl/XmotVbc0jU7hBeKrcUM/:7YK5AlQObxYXH/QdhBrc7
TLSH
T15B9423B6B0EC64314621221DFED98783433229B815591B8F327DCAAD7191F47E7B2B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 67KB
SHA256 f24dfdd6bc3511efb4058eef7e8f89dbfe260fcd8c0d3641cf5738d870365630
MD5 e9fe651b65b43390006b6ce80719c6ef
SHA1 d91f0e4e4f34de21f59322209a8199b7defcae3f
SHA512 4fb1b78cff7988aba32e631984aaa97d23620fc460b0485f91c48f22cf19884e4202c7fc1c648107e6f75b8f7cc272e3388f1b9ef4eca0421ebbc76ea750d547
SSDEEP 1536:ojvnMnsRAOXWGapXq8t8wsBbNGQKV0mdWS0BF1ChpDQqbpEr3T:ojI2XWG4a8tcHubN0BF1gsqIj
TLSH
T1DB630290FEE1B7FD46C8F80B7E48D45C0C8748815AB2D44F9F572CEAA82B604A65C775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 baa448ea46be793ec6435da0b6c075aee1acbd6b77a98041d71627ed1dc5bac8
MD5 83caec109b595525c03b6ef83c615084
SHA1 f557d4ebc01e67ae9f2898b8ba0aca4f94d17626
SHA512 e1a1635549e386e97dddb90ddd98c65c13882660c08104ee5e6163f7a44ecd2e41dac120a6d441ce8c19f51460c8c0a5ac84437c326ce6e4a1a7871ee0c3df32
TLSH
T1FB816F2622050CA5EBB301729ED35B437871D4D97AF34E4E2394B9B5B90E7734B26C1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591515.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591515.TMP
Size 3KB
SHA256 b3008a2b45c9345f9b1e16f7a3f97f565409c0a8fbecdb96daf25b7bbdc03df5
MD5 7908b8e2776ba9d7470620795dfb0416
SHA1 fef37516fae441f7d82a546de277a4965c911dc6
SHA512 55cdf7700d8432cb65d0aff55258299fc7f2b38bfb77f4ea134347da638f06f1b541fe770422b023355d9eb567070ee22ddace7237b950d0fcb54fa9b98bbce6
TLSH
T12371392422060CA1EB7701329EE31B433971D4D83AF75E4E2390B8B6B90E7738B26C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0510b76d32b226fc1df24e1a1fe4f14eb5ff7c88175403862a42c470de16969e
MD5 93081b0c0d155c5be80766fe7c5237de
SHA1 41d1ecd50db004112c2343f9f2c0045e88c2a608
SHA512 f2fd4f76d11ee58f873586b70175d324e898a8e7d0e513b5aa277f27cff65651dec5e78e44cef5f4cf55fe43f204adf2de225cc4e9bd57909e8eacf98d172890
SSDEEP 192:D1R0pddXt4LM5JashYKFGrGj6V7TFUuQBXhNIYmS:D1+pddXt4LM5JashYKFGrGGV7TFUuQBb
TLSH
T1B3E16AB7C3E4C62EC91156F0A7156E1FCE190525532C3C6BC9E5AF4BA3F2872E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c23a8b281366db9406d1bc500b17ae0e1b313283f3d99c52b5446748c35f0b1f
MD5 76afa313e281e913c962c620f84a93e2
SHA1 cd9705da7fbcbb4f1c55c5b62510f22aaecf7a4a
SHA512 73e9fdab39916c1fba7c28b1147ce7e2ce62322ea4b43521062fc1b8fd76086d24726538426e591255ac2f9280c9af69fa63864ee6411dfe6a8dfe098a8504b3
SSDEEP 192:sxZ5RlyMqZjK1Ml8M9a/fosYCflzYZZyb5kzodpDsP3HW6+WNY4IBfYBBu1RMIgs:sxZ5+1a/fosYCtzmZo5X8HbZqfzsytz
TLSH
T1A372D716AA24597BDCD7D219BA45BB93D7FD547392805E449AFC8B0C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 819af6425dd071516e25bd3514027b2ee0807d107dbeeeaa6f43c890dd0da304
MD5 63b07a16855bfbb96de2faad2ea4bd2d
SHA1 138a9a8dbefd28ef207ee20865f45ef3c0d450de
SHA512 993c5aa1aed494e4fde9b2f061ccaa130bb4cca9e4dae4edee2f338d9e6253557ffd4193949d6b14342f90f0ca6acc06c3c459a2079aa8010fefd8e08fc4cad3
SSDEEP 384:sxZT+uPa/fosYCtzmZo57LDHb5Dqqfjsytz:s7Na/f0CtzPLHbbj3z
TLSH
T17A92B546A934497BDCD7D219BA49BB53D7FD5073D6805E44AAFC8F0C04E6AEC220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6346d9ad2df6e77f1ebffa5716350f6c963a8e4ccd07383fbacbd55ed724a20c
MD5 245ad08bf91eecd6b1cf2b65671132de
SHA1 99b377ec2f334356ecb65b3a3767cbc8de025061
SHA512 7ef51cca17d394180d3497b453266a737294c2e883f1eb365b0ea0e99399435965535485625247c70a93bc72018bf68169795c5308b13389e56d72f38294d2c3
SSDEEP 192:sxZZRlyMqZjK1Ml8M9a/fosDCfKYZZyb50zodpDsPkHHW6+WNYnv/YB1u1RMIgj0:sxZZ+1a/fosDCCmZo5HzHbw/Hsjtq
TLSH
T13272D706AA245A77DCD7D219BA45BB53D7FD5473D2905E449AFC8B0C04E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 14ee4a798c1dab38c1e394fcf0ee3b9bb6e62c80448e5a6e38c64a117fd3a72c
MD5 65e9dd7af71c25451092206b03dc2470
SHA1 32f6f70b034c11c871339122d582a1bb00dbdfff
SHA512 3ecc6ace3c71ed6bd564bb37972f35a4fde514d172167415dba2fa755bb8c05e81aa2d4fda292b9f298bf0f4402f1b7561d4452821df4ec0d20c5c8e15da6e5d
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OV36yVLlFX6BaroE:P4E/aezEnC6WvCuFOu1jaa6yVLfqBRVu
TLSH
T18BF20B3B2C0CCB7E4F844E9CEC2A7E9A6DE801CB5698899447FA840C03C67EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d48562ce-0fce-4732-afa4-e8e5c45ecad8\index-dir\the-real-index
Size 2KB
SHA256 7c051174a2e0c969db16a254682b319fd27ff2e8f5a52c7dcb19c91b325c1ca5
MD5 9b7c54212deb483991f18d4fda13ffaa
SHA1 2bbb8342695379b950932fcbb2ffa9907a267c46
SHA512 d80a4d9f99972103c438596497cc5fdd120b64688e87a40d2790b8c411cd8aa1b1a28814874253d8e013b6085288d6e70f62aecdeb4183c04b4412ac454b48e0
TLSH
T1A641948D4D509A6BE86840B315B364D437F088DC5A649A139CFC2135BD4775E291B7EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598d13.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d48562ce-0fce-4732-afa4-e8e5c45ecad8\index-dir\the-real-index~RFe598d13.TMP
Size 2KB
SHA256 72c016ecee8b203e9f3d78ae9fc1cf8b89e4ac224be2ed68b59f42f2ce2e19f1
MD5 8bf7302a6a02b6698d492d33e47f40ed
SHA1 f1e4976772297fdf6762c374d7194127fad14b43
SHA512 686559d13463c745e0aa48115723879176d2e961f75d0010bcf54686baf4e0a7a60f377202ffba2f65816c3171656537c4b5fcd0d0caa04ee867e9840b357ef9
TLSH
T10C41DA9B4E81862AE89440730DE3B4F43335980087557F43B8FCA235ACD27AD3E0D1D9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 96666ce6dfdef7f9503c827182ea340abacb208b98f6df610815622f84c377f2
MD5 81fe176b6d02dba8b5adfef96b49a7a8
SHA1 89d896772dbd2a37dbb78c9318b7b36eb061fa13
SHA512 8c373686f23cce6a8cbdace84e25cedf21360af930ea83930cf954ac0eebc859b779b1e35713aab326bf1d36d875faf1e1edd71a143c11553710abd09e85f1e2
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAa:8ptDYDcfvNR1ANAJPR5
TLSH
T10EB26E16713B065238BF2508A69399368D4235A33818F4FF7BB854A21F6BE215CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 440cdff66a93aec6389cce30dc93ec1eb632a4f84947da0fb205e2a982260148
MD5 f5c9f3fad22f76ee2e19cac7cfb20777
SHA1 d619448932a8e311226b63a2af4445b1a4a0d66e
SHA512 e6cc8208537c8d59f285a577ee49f2e41505cc33d3daf4df00436ffd34ca0e0064faed8ddec728ec6f7c18238d169d292f7149fdb221e272126bb0d164fbf4c2
SSDEEP 384:nhiF9CcmyWCs3sNo8TUNTUlImkrDcYh99JBfpGxOsORMlzhkP+lFYS/v1lhHy/7O:IFccps3LwgxBfGYelzhkoFYS/7v
TLSH
T140B25B36EC98DAABECE64FC9AB5E7A47DEE401B7C68849D0DAD81D1D00C719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 303ba824b4c95a1ec00e68297b3af7d3f0aaf8c3cb3c5c49fd93afc29dca59eb
MD5 b3476cb9ad343fda48c2a5b1dc247922
SHA1 c3d5e1df6df21071784b6acb888870e8245ba815
SHA512 3703853f77b12bf8117be61f4eaefdbcbcef5568371acd4ffb4261e0d26cac673c4e07721830d88fa5992a223cf95a84b1902d0569e0d5cfd65c6ebbd6723485
SSDEEP 768:SF1jZbG3CwgRFD/kGYekrALnbv2xx4+Ugblb:a63CF5sUnbv2x5Hblb
TLSH
T17CD25B32D864DEBBADE74F89A35E7A43AFE50263C5C85AD4EAD91D0D00C719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4629e50b29a13a09d2a46f3fd2ecee2fe649f56f249e8bf25fea6346a59a6cfa
MD5 1be3eb8ae58a6eed8691ca3853f9247f
SHA1 8e2c5c0803a753fe7a67572645bc8082b1388d87
SHA512 765b1699b5336134e594eaf060e08947545fa83ef7ca545162a5d472458443b01aa1c00540a22a80e52477e696e13a75016809b95806e4ecd55b63b1b739acb1
SSDEEP 768:8F1jZbG3CwgRFx/kGYekrALnbv2xx4+Ugblb:I63CFHsUnbv2x5Hblb
TLSH
T1B1D25A32D864DEBBAEE74F89A75E7A43AFE50263C5C85AD0EAD91D0D00C719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6c33402f4b020e79d14319d5b805de8b03ad09b544f831dfd3cd7faf09ea96ee
MD5 c3750555a31eceef29f267fac1013c44
SHA1 6b41f819d997077c920d8e23847c608746e65051
SHA512 0b2c7148c513e642c1f7a28086788ed3a20fd8a54301d70bfbec5b4370de94a89d884dc23e0f1e002ddc4e1cad2d2017cf01947730b67b4d27e6fb96b5c01a52
SSDEEP 384:n1iF9CcmyWCs3sNd8TUNTUlI4kRDcYbsxeJBfpGxOsORMkceALXTHy/7Ige:8Fccps3CwgpFgsGYekrALXl
TLSH
T1B2B24A32ECA4DAABEDE74F8AA75A7A43DEE401A3C5CC49D0DAD90D0D008719D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3ed63bb96eae6614bd513414cb8b88a763a90448e2bbe6c6b793c4940def99ff
MD5 f899d465b47b7f56c5d1d9b949408c32
SHA1 aef20278c7fcf28d2a595153d37b72d95758f138
SHA512 0a053a8c9145d91aac37459539e001cc18afb803172c850dc400259cc9952735a324049c4ccc84cb198414a2772e68b139092f79211ccb148a41237013b4ca55
SSDEEP 768:IF1jZbd3CwgRFD/kGYekrRLnbv2xx4+Ugblb:Mx3CF5spnbv2x5Hblb
TLSH
T1C6D24A32D864DEBBADE74F89A75E7A43AFE50263C5C85AD0EAD91E0D00C319D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ce378644da42e67098e2e69aba521035a39953d6f968d08c6757cb2ef0371e88
MD5 1ae6df420d46300cab72f10b4b801b7a
SHA1 ec8d540193b8e2037353c1f6aa45741dde2dc8eb
SHA512 1aa1d81ad6c47753b4d1603adc85d376dc513342d7cacc528a1ffb831619049cfc9cf9408230009036aeade5a28437969c56ed1adc688aedc1df41b69b317084
TLSH
T1E03114E25C781AD1C4BE0ABEA48774FC84E8D32AF1A8707D5C58E9D44739A4E644143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2740f12e538fe721ec9bb60feed118ed6742079b6445b1df8b31ecd512f5af87
MD5 6962b037dbac07c58d9733e638023b54
SHA1 c898ab1618c2f291c6016fbd8c70a93c895c50f1
SHA512 7e6418a7f193eb51e97af46a03e2094ee0a7de8c09205cea238224ffa3604b0172b28690e903f4367ad1c13832a509148d460b2d86037b04589ab5c81543a1fb
TLSH
T101412A59A6E91148B3B77F56ABFBA87D447FB9372E06D45E10010E4F4A22B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5804-282-0x0000022B88E00000-0x0000022B89E00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads