1de6ada271bc6aef73bf6802bf174f32411e0f94236f84d036868606a9da5218

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Size 20.4MB
Sample260628-zz7phset3w
SHA256 1de6ada271bc6aef73bf6802bf174f32411e0f94236f84d036868606a9da5218
MD5 83e2f5f5e13813928c40ea9de6f9aa4d
SHA1 d55c094505cbcd61d68c9d6ef08a0a8c4e1b0943
SHA512 c6405b857fa458480c633f616b317ac507231315e02119b762b347c5a9df2d5cb763584b862a7a026f84e9ce935775ff9258fc987799da25ad733bbad63b7a4d
SSDEEP 393216:H0MxLfYIhU8z7zhff4E3npAdO+KLcQHwnPp/QgE+JxcUGxMzAOP3a4Hc8h:Txj3mE7P3pS7KZQnPtT4Da0Q3a4Hc8h
TLSH
T1C027331277D59431D1621971D6BAD36A98BAFD321732C4CBE3D909AD4A31AC2CC3DF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	2340	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1216_753841570\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1216_753841570\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2340	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271546435063986"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4274393721-1801116158-3678143273-1000\{5609E596-BD30-42A0-9AD3-492FDB78F65E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
6820	msedge.exe
6820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Token: SeRestorePrivilege	5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 1216	5956	2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe	90
PID 1216 wrote to memory of 6684	1216	msedge.exe	91
PID 1216 wrote to memory of 6592	1216	msedge.exe	93
PID 1216 wrote to memory of 2340	1216	msedge.exe	94
PID 1216 wrote to memory of 6592	1216	msedge.exe	93
PID 1216 wrote to memory of 6592	1216	msedge.exe	93
PID 1216 wrote to memory of 6680	1216	msedge.exe	95
PID 1216 wrote to memory of 6680	1216	msedge.exe	95
PID 1216 wrote to memory of 3024	1216	msedge.exe	96
PID 1216 wrote to memory of 3024	1216	msedge.exe	96
PID 1216 wrote to memory of 3024	1216	msedge.exe	96
PID 1216 wrote to memory of 6952	1216	msedge.exe	97
PID 1216 wrote to memory of 6952	1216	msedge.exe	97
PID 1216 wrote to memory of 6952	1216	msedge.exe	97
PID 1216 wrote to memory of 2372	1216	msedge.exe	99
PID 1216 wrote to memory of 2372	1216	msedge.exe	99
PID 1216 wrote to memory of 6884	1216	msedge.exe	100
PID 1216 wrote to memory of 6884	1216	msedge.exe	100
PID 1216 wrote to memory of 3884	1216	msedge.exe	101
PID 1216 wrote to memory of 3884	1216	msedge.exe	101
PID 1216 wrote to memory of 6792	1216	msedge.exe	102
PID 1216 wrote to memory of 6792	1216	msedge.exe	102
PID 1216 wrote to memory of 6792	1216	msedge.exe	102
PID 1216 wrote to memory of 6000	1216	msedge.exe	104
PID 1216 wrote to memory of 4732	1216	msedge.exe	108
PID 1216 wrote to memory of 6928	1216	msedge.exe	109
PID 1216 wrote to memory of 4512	1216	msedge.exe	110
PID 1216 wrote to memory of 3768	1216	msedge.exe	111
PID 1216 wrote to memory of 3768	1216	msedge.exe	111
PID 1216 wrote to memory of 5992	1216	msedge.exe	114
PID 1216 wrote to memory of 5992	1216	msedge.exe	114
PID 1216 wrote to memory of 6820	1216	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_83e2f5f5e13813928c40ea9de6f9aa4d_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7fffd9e8c188,0x7fffd9e8c194,0x7fffd9e8c1a0
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,16798850990291640474,763682048716372386,262144 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
    3⤵
    PID:6592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,838189694212200151,12728152143069724902,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,206941134556141843,12252807246635770056,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,10831572398492911911,11484682988109784027,2097152 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,17418026207458440054,9549003426922148265,2097152 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,16056175959024378654,4013649370075291091,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,13635605144860646760,13567361076095723009,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4992328855051702208,12231546328749782396,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5880,i,12701085813839465992,15095518004631904721,2097152 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,15210614760934385126,13639178521582838223,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,15210614760934385126,13639178521582838223,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,3573785725828321809,15048823807342997473,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,3346136866685359952,13051264082792456770,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:6928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,10119174373642572170,8601423633699529556,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,1178046054094960264,16683707673155462886,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=908,i,17638233150237817097,12964929650773562249,524288 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,6191101921190957320,11352713669018821247,262144 --field-trial-handle=2412,i,16419037251053493496,6238654267482927952,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a61df6b1b5973a8f8515610c489bd12e6e001f8527beb5b138216e21393998d2
MD5 1413e4dcb4a722f7a2c851bea622b10b
SHA1 a394fd253f2f3468ec63381b79a7be8f141d441f
SHA512 78510b7b5833d69d44a1969dccddd809ed47ba6d93baa551566bbbb962c07880ca89cc801765cdff99b247b04e98234ccb9c522675e88277eebfffcde1a48baa
TLSH
T1BBD08021350EB882D51B10FACD72C326711985676663D10E7591402DCCD74D063C5597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 afab44831d15737b93a51b5da32d6f7ffdeb215ed2ae065fce98d07ea4026ae9
MD5 577602fc13804460f1a4c682a14371fa
SHA1 75c72bc7e167208774b7c3c199ee72158d472d5b
SHA512 cf269890ba0a2bcf1c40983f5ab82ca0bed90f59b35f5275ced490c8da7884427c1e64cec45fcf6fb345409604822a89ee8e179211bc96abdb7d379a2baa2ee4
TLSH
T112D08021350EB882D11B10FACD62C316711985636263D10E7991D02DCC974D0B3C5597
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c5b27b295aeee2f378d826dc2b1a672cbf87b97f34462bfa9e09db446e1219fa
MD5 cfa5a62642ee310a3fb1f4e6e2a4a0c9
SHA1 d1fa4bd0279f189ee587a5c9fe7f879f09458ec1
SHA512 1944ea65e127f13869bb849f890cf05905b7e010dec461ccf29f48e8bd8ba6f5976feaceaa54d1637c7def171ce973dcee8f68df8452403393c8576bb437d71c
TLSH
T19FF0D1A9C921AC3708FD0B1961A44A0BF751132B27819D5B3B3C820D8FB163B468692C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e1fb4d054dfad991809281db43628c0b283de449df1270f84cc6ff8398f5889f
MD5 658c0ba4b707b88868efa6c44c12e6a3
SHA1 c140738b058f0884b388f80e37c9a5eacc65c198
SHA512 53e049abd9cfecaadf0692de353598efbbfe2799ca32a611c9e3ea17e80dc4a6317c0b00987a2034fea7fc5a4e93c9402e9b876f8840dc0b79cc0f09175104d2
TLSH
T18551BDF3C3E8856DCA1195F0BB186E2BDE1D0515432C3D5A89E4EF1B93E3471E14195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 671236b39b3f432f82f606639f4d2b2e42036aed5423cb98ba84b68444bbd6db
MD5 944f8374e2eaad6606a6c900bb6e0fe9
SHA1 bdce2b380900f9add81599b573e99b92cd11a80e
SHA512 af61700edb9f7d324eec22411301c20e3cdb062ed5d449f37d52ba2bb5bdb4649ea59e1d36048901c6e06e2ac792371e1bf321362cf5763054827a8b15a2bf71
SSDEEP 192:sxRZRByM/jK1Ml8wl6/fSsk4mWsZuApqmXzoA8pw/g6+WNIYJD6qDvvGF/Igjs/J:sxRZhT6/fSs93SPq3w/5IAve/jY
TLSH
T1C062C815A934593BCCDBD209FA867F63D6F85563E1940E44AAFC8B0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 32b4e3214f62db27368840eb25ab737f2a2c74f27619c9e380433112548f6c70
MD5 e01a5038e4cfe52b3fe4f5f1854f7fdc
SHA1 7c4e79cfae011def43d2b743694c10492574f778
SHA512 8c423cfad4e80b66267194500c7c4fe6b091462f20d4ccd3b93e26268f173a55b5b48456957f6a077f99756fbb9c73831bc14b2c9473ca7d705dc77f038a9402
SSDEEP 192:sxRZRByM/jK1Ml8UQ6l6/fSst41WsZuApqmXzoA8pw/g6+WNIYJDEDvvGF/IgDft:sxRZhqM6/fSs28SPq3w/5Ixve/7t
TLSH
T13572D815A924597BCCDBD609F6867F53D6F85563E1840E44AAFCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 99ae6b0cdbb0eb2e8035e5cc82f644b7e303e7ad5ad6a170c4894be408ccaa9b
MD5 39f78324e1fc31275543018292c2d5ed
SHA1 1a44cc5cd33fb8aabb638fb91addff13c7657f5f
SHA512 49b092bc529ef2ec7939cef8a18489f338958460247026773b757b0ae768cbea3852a09f25aecf145d8e4e7d901760e87d60bcf01ca520a492a9972acede4688
SSDEEP 768:AeaxFJ7pLuL7n6WgGMffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBrxu8CcrofF3QA:AeaxFfE7n6WgGMffAu1ja6rxBCHd3QA
TLSH
T139E2DB3B680CCB7F4F844A9CEC29BD9E6DE801CF9698CD9447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 de310c521151cb8a976f24a58a876b0b35e84434a881e96ae58e5eea612b6e46
MD5 027efa06aa8296a64cb073c404ceefa0
SHA1 a9f76e57ba16b46000e142c0458e1f41ab559f82
SHA512 d105c7189f95f9bb7b466694e86764ebca2764e28fd17e74f50c183b5fc09b2cafb08737a2bf365cb68fdff2da3baa2584ccbeded5db297bbad4b0412a0b7728
SSDEEP 384:CEsqH8wSgMr85QoaiVuNqCBUsDJO9ZfLHob0Vx1pVnopZUP2PHbAzvHvR0HRdj:CE9RKPHbAzvHvR0HRdj
TLSH
T1FCB21A517A7E224139BD2919D294956F634230B3301AB63F3BBD20E64EA7E004FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ff5ab798869dcb9bd8e4751473b1817f18a5fab7214b99fd046c845307e28802
MD5 7291a63fb71ef3cc64480c93a96cb845
SHA1 3165b1e9393257755d93d0fced4787b4f3c2c035
SHA512 ae3615f2860a2069b380d93ac906671b51855a67af0e652246782b5396e27c1fa360e030f702f3de0bb16adca48da4710cd426075313d29629ae517ecdc9585b
SSDEEP 384:nZIiF1tNn/s3n9Si8NB8TUNTUlIR3/F3+4cruc2dfoBV2quBnjYRUyBVfnRlmn19:ZTF1j+9Lowg98p+gVdHVfRlmn12bfZbI
TLSH
T1CAD24A32E869CE67ACE79BC9B74A7647EEE45163858C1AD8D9D80E4D00D72CD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8b52a3b6070df3df6cc8c08eb64f7945086529ab3b4b1e6ec5725fd5e265e4e4
MD5 e3c4364bfd0aa697723f55aa9a06fc22
SHA1 eca88a47fec7c4a4ac077bfe0c5a2591020769f4
SHA512 aeca53b7278a6445bdcb17d328e99634edd6c80a9eceb1102d2650547018c8180503e5835ae51364c439227737f457b606153d3080430b344cade51bc8dad31a
SSDEEP 384:nfiF1tNn/s3n9SN8Nf8TUNTUlIRG/F3fGeAc2dfoBV2quBnjYRUyBh0ITGT0IRaR:qF1j+9AOwgKZx0gVdHh0i+0+aLvd
TLSH
T140C22832D869DA7BEDE69FC9B3097647AEE001A3C0C859D8DAD81D4D00D32DD1347D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cc2327c6a2bc4bb2ab86458076a73253e04e802e65a856b214f0ca5a5492a213
MD5 49661920147360a957ae2e0e04cb8902
SHA1 dd6fd6048f18598e6ce028ec47943dcb6d0b65b5
SHA512 6bbf8f73b17f1b38158b17d35c8ce9ea0f1880af501ab180f2fa223a7780613c9cfb6ab11f4c0bd40e1a06d32350fcdea2362c6e74ad9e2914b4439a860847ba
SSDEEP 768:4TF1j+9RowgK8++gVdHVfRlmn12bfZbRv0:4C9RDfH0yZbRv0
TLSH
T1DFC24A32D869CE77ADE79AC9B74A7647EEE011A3C5881AD8D9D84E4C00D72CD070BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5bfbed93893e653d902775a76c6303f50806b5ed19ab2311531169e7e8e40568
MD5 53c34e7f72df2f369160b8a6dfb594cc
SHA1 cbd5794f77f195e668dc6b341cf36e042e31eac5
SHA512 125c3f09ede6410550828afc2394b5f87cc89c0a45ddc5aa8ae1ea6d65e19b6974ec872f7efe2f411d3cad118be74420e21fe9282f3130e6e412154a315b432d
SSDEEP 384:nZ8iF1tNn/s3n9St8NB8TUNTUlIR3/F3+4cruc2dfoBV2quBnjYRUyBVfnZlmn19:ZnF1j+94owg98p+gVdHVfZlmn12bfZbI
TLSH
T16BD24B32E869CE77ACE79BC9B74A7647EEE45163858C1AD8D9D80E4D00D72CD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bb6cd0366f8aab459790a634748066ac6b07773eb9b44735c058ae8fc87ed213
MD5 59fe3277f68b1278600d1b174e3acdb6
SHA1 560311676125a2179d5505c81dd061377ab1b6ba
SHA512 2ab3686f64ba80b91b1f3efc9842a3920c2ad19ceafa0b59691d766bd4d74401fbcf93b1067b976cc2d2a53e77956e45762775aecffd5f7f82fc9da57b36d6ff
TLSH
T158311DE158391ED1C8BD0DEFA09B38FC44D8D326F6A430786894E9980A29A6E264043F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5956-0-0x0000000004460000-0x0000000004461000-memory.dmp

Download