f7ac55a4d0eb3c2edb34c3f4d7333bea49b6a883a933bd76e398374d6f11832f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Size 19.7MB
Sample260629-hsvypsht5m
SHA256 f7ac55a4d0eb3c2edb34c3f4d7333bea49b6a883a933bd76e398374d6f11832f
MD5 5c5701d712ec1ed2cd540a14c80315e7
SHA1 4164bc9e20b6274ecd38cd7bdf4ba5a60ea8145e
SHA512 b2b2a30191681342aa28aaae7b61c53e7b75071cf00f8a0d0ce837e3acf136502d91b040c243b1f13defae3c3ca9bec14c4013d9789f3d092cdf3f554a139771
SSDEEP 393216:H0MxLfYIhU8z7zhff4E3npAdO+KLcQHwnPp/QgE+JxcUGxMzAOP37:Txj3mE7P3pS7KZQnPtT4Da0Q37
TLSH
T13727331277E59431D1621971D6BAD36A987BFD321732C4CBA3D909AD4A31AC2C83DF32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	4272	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1483344598\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5788_1483344598\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4272	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271900490998500"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2882181966-868590553-1461876573-1000\{0BF87D20-3269-4F0D-A8DC-3A8875488A61}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1380	msedge.exe
1380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Token: SeRestorePrivilege	5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 5788	5604	2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe	90
PID 5788 wrote to memory of 3428	5788	msedge.exe	91
PID 5788 wrote to memory of 3380	5788	msedge.exe	92
PID 5788 wrote to memory of 4272	5788	msedge.exe	93
PID 5788 wrote to memory of 3380	5788	msedge.exe	92
PID 5788 wrote to memory of 3380	5788	msedge.exe	92
PID 5788 wrote to memory of 6020	5788	msedge.exe	95
PID 5788 wrote to memory of 6020	5788	msedge.exe	95
PID 5788 wrote to memory of 5336	5788	msedge.exe	96
PID 5788 wrote to memory of 1452	5788	msedge.exe	97
PID 5788 wrote to memory of 5336	5788	msedge.exe	96
PID 5788 wrote to memory of 5336	5788	msedge.exe	96
PID 5788 wrote to memory of 1452	5788	msedge.exe	97
PID 5788 wrote to memory of 1452	5788	msedge.exe	97
PID 5788 wrote to memory of 3168	5788	msedge.exe	100
PID 5788 wrote to memory of 5472	5788	msedge.exe	99
PID 5788 wrote to memory of 3168	5788	msedge.exe	100
PID 5788 wrote to memory of 5472	5788	msedge.exe	99
PID 5788 wrote to memory of 7152	5788	msedge.exe	101
PID 5788 wrote to memory of 1868	5788	msedge.exe	102
PID 5788 wrote to memory of 7152	5788	msedge.exe	101
PID 5788 wrote to memory of 7152	5788	msedge.exe	101
PID 5788 wrote to memory of 1868	5788	msedge.exe	102
PID 5788 wrote to memory of 1948	5788	msedge.exe	104
PID 5788 wrote to memory of 5156	5788	msedge.exe	108
PID 5788 wrote to memory of 7068	5788	msedge.exe	109
PID 5788 wrote to memory of 2952	5788	msedge.exe	110
PID 5788 wrote to memory of 2744	5788	msedge.exe	111
PID 5788 wrote to memory of 2744	5788	msedge.exe	111
PID 5788 wrote to memory of 1380	5788	msedge.exe	114
PID 5788 wrote to memory of 6524	5788	msedge.exe	115
PID 5788 wrote to memory of 6524	5788	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_5c5701d712ec1ed2cd540a14c80315e7_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffc2bc2c188,0x7ffc2bc2c194,0x7ffc2bc2c1a0
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,11227988771512870359,6448795143841920497,262144 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1556087467850905369,14970777749822070724,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,15103969898206142633,11346383450216268642,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,7887999000914965880,13765215383381463440,2097152 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,5099252009460094986,8571560222335110714,2097152 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,16648981085483883797,6204836089985309648,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12525747937901392782,12454238692183819138,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5688,i,14549939652675648084,6775071844470557275,2097152 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,149553937763418384,13921745200858332190,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10326040099361184350,3974089887360408838,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:6472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10326040099361184350,3974089887360408838,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,9606190669084820780,3432450965194237333,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,4726744889289552237,10568954513278897046,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2874672376961744173,12698377572302923088,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,11646514054649084256,8316723780668783944,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,10865519786534248384,4475174978646693457,262144 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,7577311721778656522,7241822140433402569,524288 --field-trial-handle=2316,i,7092989743424583532,5032659299674009569,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff07219f3594693f0fac57895f6888104d17957d039d3530d82987134771108b
MD5 26fba9d3c09d715a1b951844cadd62c5
SHA1 9e4dc8d0a08f2feba8c030b217c14a6a5c1e4827
SHA512 fc2fc417004bf59d775f5e0fafa0e6d4883632e585e21934aba3d8697554f979efd3a818d1e74c7713d51b1993f1678a707621ebef66bdf01536cd7793ff1e31
TLSH
T184D080357B46EC53C0163071583743A4625682166567D5177850D01EC846595B7D2147
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f60cd2d9231e56b0a0784a59fb17664fa333e06aac5ee1d5692effc5152b5c30
MD5 cce4d9b2c5f5fb7c3bfaaab4af8f0448
SHA1 17b40c534fd35eb849f575565dee407cf6215d92
SHA512 5e1cbca923a813696df373e5b185a1b3fc4f73a39029b41c0ce02bf3dea25ad383c02c9763a6d8965f882055fcabaceefe0852b44c19af280ddaf74994edc4e6
TLSH
T119D080357B46EC53C41630715C3743B46256825A6967D5177450801EC88659577D214B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ea6706d15702873ce0ab9bf68458af1a0dfec43d299915bc68c067e565472d9c
MD5 6e9f6d7ff4b853584ce54a7e8e44aff6
SHA1 6b294f9d44ce710075fe620362d3d25082aef6df
SHA512 b4289497cd30ded7d4dbbe93beec96570e7611a76921764efbc48b9993d7908d1c62eec973f1b0450e82933ae41c818f51c8e07497fb09a8175fab2d9812a91b
TLSH
T1FFF078AACC31AC371DFC1B1C30A44B4BF75013276782998B3A3D820C8FB257B458591C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4de846c009d3e77a0275be8ca6cb61ee81afa88c9d41b028d67f4e9a77a4dee5
MD5 23e679a59366f08ea8dd413b1cff7849
SHA1 3f644b2fec1b1a4c6f30a76bc40352de27f44b95
SHA512 bc9fb225d24a986e4a70ee1ea52fdc7eb76b77504d1945ab62c69d8480cddb8fb3effc7f1378bd406e26ed9d922562c59731015a5f2ba61009a5e03275a4c5c2
TLSH
T15C418DF7C3E4856D891196F0AB186E1BCE2D0914832C3D9AC9E4EF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 12f4354b3e650cc7d1b91b2db84adcb1b90c4794124441894cf8fe1560b485ae
MD5 4e766f36e0492e3be3a7b9fb4aab9126
SHA1 d57737ffb0465b7af96c6215d8554f902c00bf95
SHA512 f3d2c361ef547c1d83d30a104e62159ac656893dc89917fe63b7679a210f20a1c2180c84cc1c357a3c8f7830dd1aea3f39578f13d9c889ec4bd745403ef68fc9
SSDEEP 192:sxRKROyMqZjK1Ml8wlC/fIsdiMpPZ5NtBWlhzoA8pw/g6+WNIY0X94K6BGNIgjxJ:sxRKRTC/fIsd7RLW+w/5Il4K6Gj7
TLSH
T14562EA1569245A7BCCDBE219FA55BF53D6F81523E1805E44AAFC8B0C05F7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bd6fdd82b8b131e4b2a55dfcc9e3ea34d4b2f853e7193b6ba710cc5fc1913422
MD5 168d459799d9a2f8b432861241d0dbdc
SHA1 9132a4aee00ae1e744123fcbbaa8536cc8335c7d
SHA512 ee4d249ea1f91cc2606385ad50e8424a5b4f30a28926fe22d68bbc2490e003db5fd36c8170382bda93e24dc21917fb6f29fa05da5e76e65d56370ea8c549eefb
SSDEEP 192:sxRKROyMqZjK1Ml8UQ+lC/fIs/nMpPZ5NtBWlhzoA8pw/g6+WNIY0r94K6BGNIg1:sxRKRqwC/fIs/ERLW+w/5I54K6GiNa
TLSH
T17372DA15A9244A7BCCDBD219FA55BF53D6F85523E1805E449AFC8B0C05F7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a256e4ba7b0e90014befb6b401e176994b7ba36c25c61db74511f2935d098323
MD5 b48fe72ead2186c75fe9a2b0e708a926
SHA1 10f3fe3a1df2f491baee2dd826fd33d8298bac7c
SHA512 72ec5fbebb0a6abfe69197365ae3c3c402a734b05dda614bea194b24e042cfac3444076d244e588b4923f05cd9d80c2aaa54749b095434fe0a167ac3129414f4
SSDEEP 192:6H76D7ElhDfFJfpdBJ9XvC79TzZAPkbfRFL:6b6XEHDdJBd79/ChT19
TLSH
T1E7B25751793E220538BE2918D1A5856F674130B3301AA63B7BBC60E61EA7E005FFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b74ca25e-9c34-4b7c-b39b-34f13c58b1c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b74ca25e-9c34-4b7c-b39b-34f13c58b1c9.tmp
Size 32KB
SHA256 81ba3119c30a8c64c65131dbfd1f4d4bf1aae9b5d672296fea1c7ac78cb272d3
MD5 5cdfef31c9bf6c9ddf459f5ea0f92aba
SHA1 3cbdbc27285543ec2a64175be6af807659c8de8d
SHA512 05759311fb30f033736f133b48185f4e6007f345da0a051323e8615ef405ea6eeaa2e5d893956ca3b07a31489c6c13774f27dc5761c3a2142403f9dae9cf0d32
SSDEEP 768:PXoDFl7pLuL7jGWgoqfjs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsP9RiW5oroVcAX:PXoDFzE7jGWgoqfjsu1jafP9QW5TVcAX
TLSH
T1D8E2FC3B680CCB7E4F84499CED2ABD9B6DE801CB96D88D5447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60c94688d12f5146c8ee69cbf3de5a515400697a3e490dac1d61e0bc420c7c82
MD5 f8d9b43242e18f8ef67e566cd869b9e2
SHA1 258a4fab6a9f4672042f1819dfd6d05d240822e4
SHA512 763e22d4c300cbd7c521369ccb132c7303e931a76fb371f01bbbdcb0c354e081c301052ae0bb331cd70de94663331ec8f5cde1865fc814e5bac8b8dc153deb98
SSDEEP 768:ZF1j+9nIwgNI+GGiyuQW1m1LbOmn12bfJz:o9nGDWy8g1LK0yJz
TLSH
T1D6D24A36DC64CE679CE78FC9B34A3646EEE001A7858CA9D8D9D98E4D00D72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 88967ca8d5335346a69c5469b8e334354f11374197c0572240fe0bf6393cc40e
MD5 b585d3b809773772335ecc3e11acd563
SHA1 f7f666907a5235acd86516d0ce0a8c947fbb60e1
SHA512 ccdedab9a791b991795e93ef70ed88424ec6f214d9887ba9d04000371e2e1b1bd16ee14260d963a695df489720664e0affdb35024ef7b83232bb65828f4df881
SSDEEP 768:rF1j+9NIwgzz+GGiyuQW1m1LbOmn12bfJQvz:q9NCiWy8g1LK0yJQvz
TLSH
T1EFD23A32D865CE67ADE78BC9B3493646EEE001A788CCA9D8D9D98D4C04D72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3c4a9f5fbb82a4503054bf2d2ebc9ac8c917535d6366d29976a2975673e073ec
MD5 dfe0a914589a4d884cbf08cd5fa7a060
SHA1 f4ef331fd0e11bd5a56e71fab6d1f3f8d796c331
SHA512 8bd38af7e499f10da755775f3559550c03e29e56d9e7ec07ca9a928ff0aa25c135cb981e03df5b477139532a0b91f849842651060718eaf512a58e2e3235fbdf
SSDEEP 384:neiF1tNn/s3n9S/8Nt8TUNTUlIRfUGhn37kQfoFGiyuQnWv9yZlLZyFyBITGT0I+:1F1j+96EwguoQGiyuQW1m1SQi+03vf
TLSH
T1C3C24A36DC64DE67DDEA4FD9A309760BEEF001A784C86AC8D9D95D0C00972ED134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 72e7e09ba2c25479c5fe2f9336026250442730c7abbb888fa36e1516c057c9ba
MD5 c853f07bf6f761cd8f4a251c7c330d6d
SHA1 a87394ab4e94b20ac0af2b065ba9b26443853162
SHA512 5c6600d69d9f3556902a87485c2230ac28c7968112992cdc29fffafc4b22c8312acb4a73474925637fb990e3cd420f71f901adf6f2bcb58f42ba224dc5670a7f
SSDEEP 768:TF1j+93IwgNI+GGiyuQW1m1LVOmn12bfJz:C93GDWy8g1Lw0yJz
TLSH
T1B1D24A32D864CE679CE78FC9B34A3646EEE001A785CCA9D8D9D98E4D00D72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fcbf8bb602f5a4594b276c66273aa8330642982828c4c7b21613fb5ca9bac565
MD5 cbcbf97c43d524c98417ab50f72fbf62
SHA1 65e59373082135a473b315393bb8dbaaaffe4ef6
SHA512 cd4a8ba8d7d7b88773a9270a2fc865845613caa44ac47ccf2a5064676b319ec68332addce56b8ef3670d539dfffdbf0b650806521cc8d1b3ecbc20deebf41c26
TLSH
T13A3164E15C3D1ED2C4BE0DAFA08B35FC84D8D326F59470786894ED98463D65E254043F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5604-0-0x0000000004750000-0x0000000004751000-memory.dmp

Download