hxxps://www[.]kittycraft[.]online/

Analysis

user interaction
yes
max time kernel
94s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.kittycraft.online/
Sample260620-vxethaf18k

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264497262834852"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4274393721-1801116158-3678143273-1000\{FB2E069B-0879-4670-9C67-487D247436E7}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 7080	3272	msedge.exe	89
PID 3272 wrote to memory of 6292	3272	msedge.exe	90
PID 3272 wrote to memory of 2652	3272	msedge.exe	91
PID 3272 wrote to memory of 6292	3272	msedge.exe	90
PID 3272 wrote to memory of 6292	3272	msedge.exe	90
PID 3272 wrote to memory of 1512	3272	msedge.exe	92
PID 3272 wrote to memory of 1512	3272	msedge.exe	92
PID 3272 wrote to memory of 6320	3272	msedge.exe	94
PID 3272 wrote to memory of 6320	3272	msedge.exe	94
PID 3272 wrote to memory of 6320	3272	msedge.exe	94
PID 3272 wrote to memory of 1520	3272	msedge.exe	95
PID 3272 wrote to memory of 1520	3272	msedge.exe	95
PID 3272 wrote to memory of 1520	3272	msedge.exe	95
PID 3272 wrote to memory of 4464	3272	msedge.exe	96
PID 3272 wrote to memory of 4464	3272	msedge.exe	96
PID 3272 wrote to memory of 4464	3272	msedge.exe	96
PID 3272 wrote to memory of 4828	3272	msedge.exe	97
PID 3272 wrote to memory of 4828	3272	msedge.exe	97
PID 3272 wrote to memory of 4828	3272	msedge.exe	97
PID 3272 wrote to memory of 1176	3272	msedge.exe	98
PID 3272 wrote to memory of 7016	3272	msedge.exe	99
PID 3272 wrote to memory of 1176	3272	msedge.exe	98
PID 3272 wrote to memory of 7016	3272	msedge.exe	99
PID 3272 wrote to memory of 4928	3272	msedge.exe	101
PID 3272 wrote to memory of 1780	3272	msedge.exe	106
PID 3272 wrote to memory of 1780	3272	msedge.exe	106
PID 3272 wrote to memory of 1780	3272	msedge.exe	106
PID 3272 wrote to memory of 5988	3272	msedge.exe	107
PID 3272 wrote to memory of 5988	3272	msedge.exe	107
PID 3272 wrote to memory of 5988	3272	msedge.exe	107
PID 3272 wrote to memory of 5476	3272	msedge.exe	108
PID 3272 wrote to memory of 5476	3272	msedge.exe	108
PID 3272 wrote to memory of 5476	3272	msedge.exe	108
PID 3272 wrote to memory of 2120	3272	msedge.exe	109
PID 3272 wrote to memory of 2120	3272	msedge.exe	109
PID 3272 wrote to memory of 2120	3272	msedge.exe	109
PID 3272 wrote to memory of 6764	3272	msedge.exe	110
PID 3272 wrote to memory of 6764	3272	msedge.exe	110
PID 3272 wrote to memory of 6764	3272	msedge.exe	110
PID 3272 wrote to memory of 3880	3272	msedge.exe	112
PID 3272 wrote to memory of 6844	3272	msedge.exe	113
PID 3272 wrote to memory of 5156	3272	msedge.exe	114
PID 3272 wrote to memory of 3044	3272	msedge.exe	115
PID 3272 wrote to memory of 3044	3272	msedge.exe	115
PID 3272 wrote to memory of 6312	3272	msedge.exe	116
PID 3272 wrote to memory of 6312	3272	msedge.exe	116
PID 3272 wrote to memory of 6312	3272	msedge.exe	116
PID 3272 wrote to memory of 796	3272	msedge.exe	117
PID 3272 wrote to memory of 796	3272	msedge.exe	117
PID 3272 wrote to memory of 4756	3272	msedge.exe	118
PID 3272 wrote to memory of 4756	3272	msedge.exe	118
PID 3272 wrote to memory of 4756	3272	msedge.exe	118
PID 3272 wrote to memory of 1280	3272	msedge.exe	120
PID 3272 wrote to memory of 1280	3272	msedge.exe	120
PID 3272 wrote to memory of 1280	3272	msedge.exe	120
PID 3272 wrote to memory of 1592	3272	msedge.exe	121
PID 3272 wrote to memory of 1592	3272	msedge.exe	121
PID 3272 wrote to memory of 1592	3272	msedge.exe	121
PID 3272 wrote to memory of 864	3272	msedge.exe	122
PID 3272 wrote to memory of 864	3272	msedge.exe	122
PID 3272 wrote to memory of 864	3272	msedge.exe	122
PID 3272 wrote to memory of 6356	3272	msedge.exe	123
PID 3272 wrote to memory of 6356	3272	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.kittycraft.online/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8ad15c188,0x7ff8ad15c194,0x7ff8ad15c1a0
  2⤵
  PID:7080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,7818680303434530717,3295901341284222305,262144 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,6460462700545700536,5696554322572496936,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,13377162524524728018,15579816393263222267,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,18232828939526853330,6499944385672848030,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,7513576605322949317,5098354535266431071,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5152,i,4818609054189081466,885647498962044350,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5412,i,17869496697098566870,7367869315449478495,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,11014162966030604719,10562464580061115905,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,14398996293598029430,4736937206153014132,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:7016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9684117834600320081,5416007549215734954,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9684117834600320081,5416007549215734954,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6756,i,16585576592164758022,5060093637644921982,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5412,i,11326213438491863321,17558174468322366574,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7012,i,283223598476064674,2365637069723741460,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7148,i,17959724275594670818,16666470857919405806,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7216,i,1247937491759628261,2767002792553939553,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,8230100395734881215,12578061452334227719,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,9606073611595490957,4318400395616399821,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14
  2⤵
  PID:6844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,11608641771801647950,9936892465269516698,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2764,i,4195811852673969718,4586614843316930636,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3876,i,7722579562892323697,7626527821296169247,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,18163980975442482501,13552357093264780644,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:14
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2852,i,15781520522407405982,7979838988358176374,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8312,i,2236922549031302976,7765619577160988823,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7900,i,9666608841606352619,14458216590282215357,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8476,i,4158637886610119922,8776960241344774325,2097152 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,9376411291265694305,3222394888297277596,524288 --field-trial-handle=2316,i,9648209394016538929,17475767266385687507,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:6356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 afab44831d15737b93a51b5da32d6f7ffdeb215ed2ae065fce98d07ea4026ae9
MD5 577602fc13804460f1a4c682a14371fa
SHA1 75c72bc7e167208774b7c3c199ee72158d472d5b
SHA512 cf269890ba0a2bcf1c40983f5ab82ca0bed90f59b35f5275ced490c8da7884427c1e64cec45fcf6fb345409604822a89ee8e179211bc96abdb7d379a2baa2ee4
TLSH
T112D08021350EB882D11B10FACD62C316711985636263D10E7991D02DCC974D0B3C5597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a61df6b1b5973a8f8515610c489bd12e6e001f8527beb5b138216e21393998d2
MD5 1413e4dcb4a722f7a2c851bea622b10b
SHA1 a394fd253f2f3468ec63381b79a7be8f141d441f
SHA512 78510b7b5833d69d44a1969dccddd809ed47ba6d93baa551566bbbb962c07880ca89cc801765cdff99b247b04e98234ccb9c522675e88277eebfffcde1a48baa
TLSH
T1BBD08021350EB882D51B10FACD72C326711985676663D10E7591402DCCD74D063C5597
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 569801e84bed0d412834b33b12eb8b338d8e59f2c92d4b6b87fcb4b17ef4de9e
MD5 14f0c3438f5f28c7b2bcc6c8bc93c2ea
SHA1 f751ed3954a1626ab16b9190b230fafd98189d7f
SHA512 9af8640aa9c52903aa1dba967023fba5c1e51d751496dbca80093b337b28e1e156902a9c75bcb8c963618dd4004fa9999a701422daed0a1880dc9b895af2d1c6
TLSH
T19DE02BADC936EC3708FE0B196560464FE76113276B41994F3B7CC20C8FB067A4686D6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 41KB
SHA256 f175536de92b50f5a72e5add77099eae0c385aacabd7864c42025dada7abe5b0
MD5 99aa84a3ca99f8eebc0fe295cc3018b0
SHA1 7614a01f11ca3e6cd6d3dce203b4ff5dc45562cf
SHA512 21f322ea65ca6004934fb1411f4e1dcb78d38337f70fbce501e359175602825dda278f193d8bf0f2d3e3313a8f925e32a715baa74094617b4f23469fef7cad70
SSDEEP 768:407sZoAZ4dSewN109I11hKdSRV3yy8VtOYKAYgH31tRQsunS5w1d4xif63P/jpr:R7/AZ4gsq110tYAF7RQs3Nif6//9r
TLSH
T18513F1887DDD5C8563DB3DF84F642B611BC44290B091AD73B46E9FCC46E1CA2A8CCC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 42KB
SHA256 43693f7bdd6146e783fab3f75ba0a51aa3cf9530adbf790dbd686fc8a17aa3db
MD5 93b6f18ec99bcb7c3fa7ea570a75e240
SHA1 60b9e3062fe532cbc18b897fac542c56a03544c7
SHA512 ac1a9398b74eb75ac4d52b9a9054a1add5a836f2572b99307851a0bb6d93288a13199e06e5df4f1391209403bf775c9235a679bd081ca7f62b7752ed0fa691c6
SSDEEP 768:Y6isHlLX1zBleTdZ0MS1wQ1vBIG2z1oCA2/Ovub/uOe:YKlr1zBleTdZJYN5INz1oCdGmbK
TLSH
T1691302114B110F51BAD1B86B6FD628CC764928F30D40697936A437A64EFC2FF89C0E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 53KB
SHA256 00f90db31f42975fcdc5fa1f70660568be68792ec11be2aac36362f435a6e555
MD5 ebee194a9b773f166dc16096f8614aaa
SHA1 9d6a893af295c90e9e9792d7e54a80034192255b
SHA512 b1e67f381c8266ff60e09cccba6cb17fe0df4cc8d373e15f20f14b6e8c2f6bab4c0e91163e57c3c2f4593ac23512a43b2129caba1945870be4493d1def2ddcd5
SSDEEP 768:mxXl0PgYjIjF4TgXYxK9cESKs97eV05TWW2J1KJzO467QEWDvOWEGOFddkmEbY:N24DkPfs9quTWNIVO46dWDDEDkmOY
TLSH
T144330207DDCA01028FFE6B665BE7754BDE45A4DAE1310C13A23C609B87185E485EFBE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 3622ac26f66bb6c0618d56be7f3ddc89e11afee2b6027335cd29e62fea5727f5
MD5 0319d4e4be5b885d6a55fad87d2f5e5b
SHA1 871be5c82d2e62b65febedd014d454b18a4100ec
SHA512 db3e5fee7181747f191b857c49ede2492fc8e32d53962ff02f0112d5de2b37e56e8190ef202265949fcb0ac68fd44d91d0cbba21ea70def926e5839c7679f1ae
SSDEEP 192:2iM03AEp19JIc0OLzQPi0YvVaMq03k1jcJY/HyAtA+SNeihuTHFDBPd7ngkQ/8Ek:2iM03Ak19JIc9LzQPi0YNaMq0U1QJY/B
TLSH
T119E1CBC061D411A6CB7F9B7820C48DD9BBF39A8C091F4B17F38463757E933AE9859898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe597e1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597e1f.TMP
Size 3KB
SHA256 116eb913d4f5b9b81842fe51476f087a77ef5339d8ab2d7973d38d21a3fd49a0
MD5 5b5567be08582ee715a5c75219db6f3d
SHA1 377d7903f54c5a47b0eeef0b485062cf98dd5e70
SHA512 9496d832adbcc14c48e9bbbcbb7994ea6c2768b0ca22b48660bb5213956efc3b4fe3712e3fec4dfea13985a37adff4407b056518e115ffff9e3ace7e277279a7
TLSH
T12A6150C530270E7FDB2C47BC64C2D8D6F3737406064B2E1A3A8453B8BA16F2898E2C05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000003.log
Size 539KB
SHA256 ff3d4482d06167eb6043ceca0d691317d0d002afb6dec6ba8843fff1e78c79ce
MD5 4723d5bcb4e4299f7f2359fae9d89265
SHA1 eadb4ea9cdf7ac4d0cc8e160611aa3fa8704ac29
SHA512 046f6aebe1116ab83fcb580d4575432207eeab840c9ef9a93da8b723aff10532bb2cda64f4f01c2ba323b172c93667ea4c33761d2431951d76daebab43ee9bac
SSDEEP 3072:a9l9TDUjgODjCIyuRvJpLCUTbwzvgmUNafAWsbGqyHOSzddXK11t8gJ/TcEooXal:RYTTYyd
TLSH
T144C4CCE1B5E86569F3B72B356D3C2B94593ABCC99C40E11F16E8EA4D0476F409AF0323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 f338b774a165f73c51b42fec66eded6dd0a646b4225032a830d5ca61f0057aaa
MD5 afb6915852432701050bf8b5ce4e5a4a
SHA1 7da113523b78c15767be6bc2ae3d3d3104882aaf
SHA512 b9235c22920e1b19d32c8573cc556c59d4f05f847a10d059a5e337f2a54136e6d3349d3842884ad69cc0195b92d7fbf8a249fee11439f47b2355acc2a7048a56
TLSH
T10DE0D8A8C5C9D21FB1146097152C7B0DE6E3392E97CD6D8A9F44CC187882448A46E251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9373182145f6786ea19ee11b816d5d750375970c0840a155c242288da890be75
MD5 e7f35de9ecb01ac2df84055cfa86ce34
SHA1 0b384e707e2557b45b299801818dad7e2851c186
SHA512 200b611712cd5c3171744c4e9ca53b02b2f40cbaf830a61e42e1edce8a78af922dd62f041a1ac8215b8dbe0ac5778fe9699290becbaa67b3e342bee6b2d8948c
SSDEEP 192:D+17A3yGDUo+OIrhhWGjhnij6Wv7H4AYSSgl/h8W9b7eJmUlEl3CDzdrxNsPLyGR:D+17A3yGDUo+OIrhhWG5iGWTH4AYHi/L
TLSH
T176129BF7C7E4862DD81196F4BA146E1FCE2D0924532C3D6AC8D8AF4FA3E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 db0c404bbdc84e3ee36eec45057a90a12ddbb18f1e499800f49d91bdc32e0dbc
MD5 709aa7e938572e2a743cf29f753195ad
SHA1 3aee0b1044c93bcbe95371d1771ab2d1517f6fee
SHA512 59ca00631c440d2b06e5397e0ae89c01e0f625b760475e3b1104c657320ddaec432b003d563860b5945cfba7be1641aed7777989abae7738f016d8f54fc0a444
TLSH
T1A4D022232208B0BAFAAC3E85707EAC8FC72740200892DDE610D0999C2A3A46C06072C1
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 aaaef31108eece31b13b261f6a1c2ed9c65370b5c53155e73796a3eac818ec44
MD5 55488e6fff7e52c3ebedbe22aebf3265
SHA1 5bf419f3c44cf0376a9f5b479a79ff7efbb6ee63
SHA512 76dc6dbb15901b3ca9b01fba871a2c18599c64ede0b099d05970509d2ff8ae76ce4fc0c0a77c6a6b40eee84881d6e9a6ee32bc6be8af88c3c16b901dacf79b71
SSDEEP 192:sxRFRayMqZjK1Ml8wFI/fXskfWsZuArzoA8pxtwi/g6+WNTv7g/YJDVqDvmGzIgl:sxRFnbI/fXskuS4r/5A/7vddR5
TLSH
T17962C7166978997B8CDFD609F686BB53D2F91173E2505E44AAFC8A0C00E7ADD210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 42f7b7a7afa06559453d0ef246d0b62723f698644f625df892bdb54ea22c4f2b
MD5 183826142f27e2ea1b19342434152212
SHA1 ed06332d5d9e33b1a02314c825f04f7b1280b829
SHA512 0f62458ce71cb288d9bd4b3c65556896351f24b17186b15a9bbc7da8fe0629b60f35a97f3d75f9990b0fd56e4a7bc3c201546e2781a42cfd96566872b4f6d399
SSDEEP 384:sxRin8nHm4I/fXskdSSDQ/5zUoN/R9vdrRYNnJ4:sY8Hm4I/fVdU/5bvq4
TLSH
T11192FA166564497BCCDBD618F956BF63E6F91063E9504F48A6FCCA0C00EABED210382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e25dd80c97e59b125c8b0dd0f85f2e94afeb6e70ae5ad8b6291eec96f35349d
MD5 a2caf4cec50c3a1bc61e397e66ff8bb6
SHA1 5c815beef529610eec1f51ff53a65233b3e59730
SHA512 8346246576ec500f5621c38bf8ffe0d99d11e8676f08cdb8bf287d5b498f05a7dac33fe71b5fb02fc58f5ac1b527ab19f391757c3c209cefea960ab4ddb130b5
SSDEEP 192:sxRVRayMqZjK1Ml8wFI/fXsFfWsZuAwzoA8pxdwi/g6+WNTv7g/YJDVqDvmGzIgD:sxRVnbI/fXsFuS7D/5A/7vdjR5
TLSH
T19F62C8166978997BCCDFD209F686BB53D2F91573E2505E44AAFC8B0C00E6ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 91fc157443756ccb2afe439faf44133fd4a4f983ed29b8c599202b7e2311fab7
MD5 228b97a96f0957e881904ac80f29f1c4
SHA1 185b120738fa31f15de070836d56a356df9658f7
SHA512 b0c2acd693248aa632daa1b57206083ec5be7f3a1ac1a43bb8cbf5c6685a8d5377b01f4c44d254f8825a7641f107e4405772b3e0f10dca598fc4fefdd6f89d8f
SSDEEP 768:Aeax56WgGMffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4u8CcrofF3czg:Aeax56WgGMffAu1jatBCHd3cM
TLSH
T17EC2FC2B240CC77E4F845E9DEC29AED76DE801CB9B588D5447EA880C03C77EB911A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48c1fad2-b38f-4e55-8770-7f1ba17f11cd\index-dir\the-real-index
Size 72B
SHA256 8cd93a15cd5319661fd79b31380db538b1095c5327bc33b409182c9bc3486f96
MD5 7d32b4f3ebef84451cf32e1b1ae21128
SHA1 bd407096de9027b280c99e927b5e0f752e9de884
SHA512 ee4ca5004836af347990d7428f0a5db6add695f5d0f8f53decb4d722e4d7f16ddf2313c7352cd0f4abada70a2253c82ca66240e75e4315cc4adb64ed4c91c3b6
TLSH
T166A0021403D44047C07312F02DD642612251792AE2111709C3D41355CD51576459340C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48c1fad2-b38f-4e55-8770-7f1ba17f11cd\index-dir\the-real-index
Size 72B
SHA256 da4fa18144749f01858cc9774738ba952f87a6e92d8df2cc5d4bc9b0438284d9
MD5 195ba1a491bf1e2c8c2fdc5b23fa1154
SHA1 1e4f567a762ec99b4a4ab9fa715a4999d9ccf534
SHA512 390005088e1f1ab6dc58451fc8a3800de7b41db36856297a71b236f376524da6b51d51479aafcee1280df08e23c92b7a2118ac361077ff5f66adec1d5f55279d
TLSH
T1F3A0021183D18407C42A12B515D242A152118C10B500120A60D34245DCA04A0454330C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7c6f714d-1468-4727-aca4-5c93d94ad7cd\index-dir\the-real-index
Size 3KB
SHA256 94bb8ef5a532a9ad2e4c3947997b0309efb452d86b21e5e0b8a61966b7970ada
MD5 a5a83a6b3787c937b41150cd2991ea57
SHA1 466caa7fc53737b0147f9720846ee1b9a7989d30
SHA512 918e5e2b1b51d555e4f46bf52fb6c97ee9f01a6f0d978005cf4fcc33248d544e50609e74235ba57a3af5ecf271962efbe31d85966f6b16adf425942502ff874e
TLSH
T11451A79D9C472B46DD7821B268B204483B32B5EC6B998E0379FC55387CC723519B9B5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7c6f714d-1468-4727-aca4-5c93d94ad7cd\index-dir\the-real-index
Size 2KB
SHA256 0a40d5a844c202186c76e1807917835cb4f04cbd4ca8f9a50d122cbc47cca344
MD5 f25a2f0987b24dff4c1776986730ef75
SHA1 ccc29ccf2a3be677fa5a5d505df1fc9b6e00cf80
SHA512 bf3fb9c5906758fa8987dcaff39fa7fe185fb8ffdfa31d4827fec7f201374865dd8d1d15b0bbe6923bc0c4b7357a7b26daa3dec1f779a7b365373ca365431ce2
TLSH
T15F51A79D5C472746DD7826B264B2044C37376ADC1B984A0374BCA9387CC72351C79A9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7c6f714d-1468-4727-aca4-5c93d94ad7cd\index-dir\the-real-index~RFe58dc61.TMP
Size 2KB
SHA256 a387cdf82368534e8c289b51fd94fefe77bc891a3b1c90641374c9df9f1ced24
MD5 9fce05074a7ff549432705e191fabaec
SHA1 9302679d4f97c76140e6c8ad4c54a1a29602096a
SHA512 9be6fbc224df8fb30741267c65075cf29bf947aa0c2508d9f1c2c3493541db65146d51d7a8c3915b27105ee6b485e0420cd26aaf222ab2058a1899bd7f170791
TLSH
T1A751A46A9C436B2ADD600273A5D64458373FA6609A489F0730FCD634ACC377D3C6C2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98792884-0606-42f0-bdc6-129bf2d5ec1f\index-dir\the-real-index
Size 72B
SHA256 3b7584bee8c56c3caae7b65fd2962eef3e419b3e00b9ddebcb9313d5795a21ca
MD5 dea0fcf31f43cfffefab4b3f30438731
SHA1 cb5e8aefaa7019c8faf28fd9bf7eae85af63b35b
SHA512 81fc615edc9f5e19a48a141af27cc78e45b06c3ae59615558c5e7512150ae02c7da3dd0599afa0d41eff1ba39e015a061a277c68dc1b4c2c4a24c343943035fb
TLSH
T14EA002274954214DD50286B461D242612316DD6D0105970A509294D5CC5517C5D21155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ceb3a03f-e10e-4bfb-9444-4eed162f03b6\index-dir\the-real-index
Size 72B
SHA256 bdd18cc7176d899a313b26cd6655491902561b8ef7ac29c6504fd10b32be6a55
MD5 74f3b18dfb08a4a0038dee9b70f3430a
SHA1 155c5c2b9f03ec79428352c13b1914e61a4acc3a
SHA512 c355c66808c6c6e31f775f071518aa98ab3b285a18e036bf00138bbb2d5932c1f4f39dbf4a0fa8f3b4beb7b92eba9539935a728359f49b789a363771f067628e
TLSH
T199A002B483540242D01123FA5093068166145A3C0117435546E9F97DDEA91E455255D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596613.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ceb3a03f-e10e-4bfb-9444-4eed162f03b6\index-dir\the-real-index~RFe596613.TMP
Size 48B
SHA256 523e4be54ec5835898a48d7ad921aea13fdc05ebd094f6065d42a2d52226d9d4
MD5 36b7e174f5b72a7c4cc7b2bac0eb60f7
SHA1 3eeb3f270998c84cf0d233c2504a4b9bef093bb6
SHA512 c1275eac327f82b874769b183e4d539d110574da610bac5d8dbca6ec84b905e4cac3c9a8922282b4eba5bacd97cdafd3ac278aad0e59f3fe0195f21481bfa8b7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 dbeea2f13b697045136be4f827e7ac5f3ae5ae2e54f39d94bc8701d268bc7351
MD5 8125dd8184643caa4bd682e683d99905
SHA1 b15c053a9272e4a958367b96f2be7067d0228224
SHA512 d4c7292178ea3e4a24ec4ac23d2f412bb95bd89cd497b781fdd07b6b05e8f644020101a635324a6461989abfa6c50f0e6deccaaa2e863c9d5ea1874b8b037e64
TLSH
T15AF05C772EF32814FDAFC3C660F5607104157C188D9AFD0F1416729B90B1325311EC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 59b119ec7bdf677faf6978cb813e8a5cdc41a36002ef8266f49c2b4a48b7fe8b
MD5 584d77400022043a44d038030820e760
SHA1 5938585cae543724c853283fd57ab22e03db0fae
SHA512 96e389bc6af2247f893bd836d76c9c94a48fbd0fa281df98670d7b044a4253565697862f26b5e6fefa7b87674ee29491fdd9614b0dff14b6a2adc356137986a0
TLSH
T1A0F055B72EF32814FDAFC3D620F5A07105067C188DAAFC4F141AA29B90B2329305EC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c6cd57c6b35ec3d064f2675ec012cae429583335a822b1be13686ca8c44c6a29
MD5 83d9e2fb8ab405898331d59c0d346271
SHA1 e7e9703867803a181b8275415cdbd17215669e2f
SHA512 a9d2ac23e244256de55178b87383eacb7ff0f27bb6eaa4407a20ee2a7521128d8e65bb2835ca882cacc4fcf9862510d675f807df1ff85c088db972f1d992115a
TLSH
T1A2A00223A554124AC0344374B1CD12976213C9248E05271291E5D165AD611508137046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592ff0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592ff0.TMP
Size 48B
SHA256 80e37f91a0b425717acb8510f7ab2d541dc995b695915eb3acecfb08406ef5af
MD5 939c1634fb9ebe4cce942cd032e0dae7
SHA1 d4e5c43973c14eaabf1b906de75afe90fc179e49
SHA512 d8a11685689e2c46a60003e6df95918305ccd873ffee219389fa7eed50030253bec476937e36056312bc13844b49c02f9f39cef925356e2309b7c6f118f9a6f5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 95447ff65132c7511686bfbb0712ceb19b536e06ad4d71fbfc5ffcd533f7703e
MD5 f992fcc3c47c2af562135df8c074cfca
SHA1 3db710820b891c821aef76849befc2c61ac9f65e
SHA512 dc33ccd97cfadb75c4770970e8e69c522625837208d25dc1d664ff769e90331ce5e5b49f06b54706a1d04e4eeea067eb6b00c30b2123e2f783a0eb19a0365f18
SSDEEP 384:CEsqH8wSgMr85QoaiVuNqCBUsDJO9ZfLHob0Vx1pVnopZUP2PHbAzvHvR0HR9MDC:CE9RKPHbAzvHvR0HR9MDvVfDITSf3dq3
TLSH
T113B21A517A7E220139BD2918E194966F634234B3301EA93B3BBD34E51EA7E004FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4bcc10304cb0ceb92b940d15f29c6702fa23c8598c5c6d35076cfe0fa834df11
MD5 caa8b19d5a28e0b2cb3aa8b9736ec93a
SHA1 d66c4091ff2e1e30362e9d3e1c17801fa21c978a
SHA512 98628a3f36d0b46fa7a56b2b9005e189648973a76682d9c71f7459269af66e7ecaaa9ab3627998c474d05a254b1e5660107383bb13e4fad35639a8122f291846
SSDEEP 384:naiF1tNn/s3n9Sn8NW8TUNTUlIRC/F37KtEhS2c2HfoBZ4ShtAfxuaJiZI8Lk1IJ:RF1j+927wgCJzSq6Z4LfxuaJZvk
TLSH
T124B21936D864DA77ECEA9FC8B70A7647AEF1416385886AD4D9CD2E0D00DB2DD0347C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0e2149e73101f5b3eeb044bd9eba5a93c39774a3901fa7acf792f8bbc96da997
MD5 ece2ec11f0de1b431fc967887f5c284e
SHA1 127b46521ed056b81e72f964271e35999ac82a3b
SHA512 0b7b36aaa10c9bd842c7f900ee0a6a8ccbea9d36cfd9d8a9560cabcbf3036ff2ccccf7585ac4df264b5cde6fb972fc2221569e4cd14f5a382ad94aca150d381f
SSDEEP 384:nziF1tNn/s3n9SP8NW8TUNTUlIRmTMF37KuES9c2HfoBZ4ShtAfx88aITGT0Im3W:eF1j+9C7wgPJbL6Z4Lfx88ai+0fvi
TLSH
T197C25B32D8A4DABBADE69BD9B70A7647AEF00163C5C869C4D9DC1E0D00DB1ED0347D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b352f117e31c4a42bb02794f0b60ba821223d069989a0b8ce09be34980096ed8
MD5 15b30824235de1639fc503e70b7ee69c
SHA1 9169a2b2839bf78fb519a285a9d941dc81ff5766
SHA512 9bbd95442a53a3f22d6fa299f4515b1be81fe1926e23ca533c851deed2dd0ae674ce0b32384e0c91981b9c65850f5f1c91ead8b01173249bc4dcbc0296913926
SSDEEP 384:n2iF1tNn/s3n9Sn8NW8TUNTUlIR2TMF37KuEltc2HfoBZ4ShtAfxuaITGT0Im389:dF1j+927wg/Jw76Z4Lfxuai+0fvi
TLSH
T12CC25B32D8A4DABBADE69BD9B70A3647AEF00163C5C869C4D9DC1E0D00DB1ED0347D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a23b9e51dff56fc1f42047da384b30f54a421015efd5bde647db1b7c76b61325
MD5 9b1dc6938d418ea10ada76f990f751f8
SHA1 88b5e4c1229b3cf8a652cb5ee0fd43f4aef2fd1e
SHA512 d9935bfaa9ec28a41baad5de3a4ccb2f98c54284f3e30ba3190ee260794983030dc5ca028b55749ad51cfb82b3cbaaff34afd0cbf0d15db4d32de5ef974ef978
SSDEEP 384:nniF1tNn/s3n9SN8Nl8TUNTUlIRP/F3fGeAc2HfoBZ4ShtiSITGT0I+8Lk1IzTx0:iF1j+9AQwgJZ506Z43Si+0Gv2
TLSH
T179C22836D864DABBEDFA9FD9A709764BAEF0016781C86AC4DAD81D0D00C72DD0347D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21ff45925160834e552f2665265b4ea0a7baae4f52de5d46f0a3b5bb7ae8d0b8
MD5 6cad2c6dfea9ebc876aa16cb73bd2872
SHA1 fb8d1c1b24338e4956fbb5210b5338bc32d8db60
SHA512 2b17c747f7c12e8d1dc5436aa2c2ec650fa388d081ca6374a97b2539a2fcb548142fe964829cc0f6e36b051062a4478ad581642a304d3a68cb2f8f139e0d6582
TLSH
T14EE00903934041FEC1BD473424976B342AA3843206E312160E2161691D663402E30EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58fa0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fa0b.TMP
Size 392B
SHA256 06c9dec781c67dd1bc314a0b9ca370e4a513ea57d2eeeec4f491d4d216ef2ee4
MD5 04ee6284bcaffe3142481f241bc67ed9
SHA1 6150e901d5eb288cbc6daacf98d098d76e70fe2a
SHA512 2718e9dc953d6ef922fb5e640c41176fff12ea2d39da77bb7d0046c508179fd668145d7dc6c07bda7935c599f2e776c11a7473de64b3b68175b7c1e6cb30b1ab
TLSH
T179E00203D30041EFC19D033424D76A343D73443007C311050F3061791C643402F208C4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads