hxxps://theicegaming[.]com/2023/02/22/ps5/

Analysis

user interaction
yes
max time kernel
598s
max time network
558s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://theicegaming.com/2023/02/22/ps5/
Sample260703-xa6d2set3v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4120	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275776194235835"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{19D1F6DC-780D-4A59-9607-FD65466120E3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4088	3616	msedge.exe	80
PID 3616 wrote to memory of 3624	3616	msedge.exe	81
PID 3616 wrote to memory of 4120	3616	msedge.exe	82
PID 3616 wrote to memory of 3624	3616	msedge.exe	81
PID 3616 wrote to memory of 3624	3616	msedge.exe	81
PID 3616 wrote to memory of 4600	3616	msedge.exe	84
PID 3616 wrote to memory of 4600	3616	msedge.exe	84
PID 3616 wrote to memory of 2420	3616	msedge.exe	85
PID 3616 wrote to memory of 2420	3616	msedge.exe	85
PID 3616 wrote to memory of 2420	3616	msedge.exe	85
PID 3616 wrote to memory of 2480	3616	msedge.exe	86
PID 3616 wrote to memory of 2480	3616	msedge.exe	86
PID 3616 wrote to memory of 2480	3616	msedge.exe	86
PID 3616 wrote to memory of 544	3616	msedge.exe	88
PID 3616 wrote to memory of 3904	3616	msedge.exe	89
PID 3616 wrote to memory of 544	3616	msedge.exe	88
PID 3616 wrote to memory of 3904	3616	msedge.exe	89
PID 3616 wrote to memory of 3156	3616	msedge.exe	91
PID 3616 wrote to memory of 5604	3616	msedge.exe	92
PID 3156 wrote to memory of 5784	3156	msedge.exe	93
PID 3616 wrote to memory of 4668	3616	msedge.exe	96
PID 3616 wrote to memory of 4668	3616	msedge.exe	96
PID 3616 wrote to memory of 4668	3616	msedge.exe	96
PID 3616 wrote to memory of 1124	3616	msedge.exe	97
PID 3616 wrote to memory of 1124	3616	msedge.exe	97
PID 3616 wrote to memory of 1124	3616	msedge.exe	97
PID 3616 wrote to memory of 4056	3616	msedge.exe	98
PID 3616 wrote to memory of 4056	3616	msedge.exe	98
PID 3616 wrote to memory of 4056	3616	msedge.exe	98
PID 3616 wrote to memory of 724	3616	msedge.exe	99
PID 3616 wrote to memory of 5952	3616	msedge.exe	100
PID 3616 wrote to memory of 5376	3616	msedge.exe	101
PID 3616 wrote to memory of 1440	3616	msedge.exe	102
PID 3616 wrote to memory of 1440	3616	msedge.exe	102
PID 3616 wrote to memory of 1440	3616	msedge.exe	102
PID 3616 wrote to memory of 4464	3616	msedge.exe	103
PID 3616 wrote to memory of 4464	3616	msedge.exe	103
PID 3616 wrote to memory of 4464	3616	msedge.exe	103
PID 3616 wrote to memory of 5692	3616	msedge.exe	104
PID 3616 wrote to memory of 5692	3616	msedge.exe	104
PID 3616 wrote to memory of 5692	3616	msedge.exe	104
PID 3616 wrote to memory of 3980	3616	msedge.exe	105
PID 3616 wrote to memory of 3980	3616	msedge.exe	105
PID 3616 wrote to memory of 1096	3616	msedge.exe	107
PID 3616 wrote to memory of 1096	3616	msedge.exe	107
PID 3616 wrote to memory of 1096	3616	msedge.exe	107
PID 3616 wrote to memory of 2284	3616	msedge.exe	108
PID 3616 wrote to memory of 5196	3616	msedge.exe	109
PID 3616 wrote to memory of 5196	3616	msedge.exe	109
PID 3616 wrote to memory of 5196	3616	msedge.exe	109
PID 3616 wrote to memory of 5920	3616	msedge.exe	110
PID 3616 wrote to memory of 5920	3616	msedge.exe	110
PID 3616 wrote to memory of 1876	3616	msedge.exe	111
PID 3616 wrote to memory of 1876	3616	msedge.exe	111
PID 3616 wrote to memory of 5052	3616	msedge.exe	112
PID 3616 wrote to memory of 5052	3616	msedge.exe	112
PID 3616 wrote to memory of 5052	3616	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://theicegaming.com/2023/02/22/ps5/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x294,0x7ffbda6ec188,0x7ffbda6ec194,0x7ffbda6ec1a0
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,9862919815488895260,11825302925906674852,262144 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,17291717197208442910,10673438727784129559,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,3645494167999703676,17519439943065574638,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12782822350097909622,17547297742396838242,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6255451034169264820,12034577784809810070,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,1825297756122516160,8207413898564839335,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,11239028946228725520,12215888696052035579,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9528671152939874627,10879906729765660662,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,15574557320731038415,3286745797018831586,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9528671152939874627,10879906729765660662,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6388,i,4884519014926785183,3382412534001809815,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3728,i,10392855341306825550,372683886323487490,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6216,i,17774410156491763750,7943411439255417115,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4023004250622539414,14902351028361210899,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,10031253548773022812,13132591722414553346,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,986627783520742198,17626319817172187852,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5040,i,13034110416227232429,12858883357860412309,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6020,i,1060752506884338483,17143410700713574678,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4944,i,13214761891727612287,8083320521816362482,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1244751258878803167,17489168512970183780,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5776,i,15255211780367107320,9325528778479411721,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3436,i,8662060372991166664,14277754447454311083,262144 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5736,i,7472188016888272671,16397015130482717308,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,13294998143767258902,13572815225873462584,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,1716732978995680323,17417760344414795070,524288 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6388,i,17817888337992859002,8752507229564099,2097152 --field-trial-handle=2136,i,7612787022862888421,7124521604478008115,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a5de9e4cf3d059af7fb5cfc9183e3ad507de5b6b5f440d9140e64f0e169c1179
MD5 30af85e7424f18440a6c494c6d65e8b4
SHA1 fd1bd3c1c68c37c724d6359c8a89ca9215b96514
SHA512 0f92c818bb76ec37ab60112ef11f75657ae538d172d99c380117b4c00299c4e039d7c119673d6249470f1ed8e200d6235f1fd7c2e85baf8573fdd7068b57fdf8
TLSH
T1A8E026C626C8C21EB640644783B8634CC2C8366B96C8A95A570988F5324B090AFC66E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 6ddf173e362fdf4af8eecdc23a6e23ae96e22fe4abab839e1e5fe4a42df473b4
MD5 be94351205bad3793ac0bc64239c42ef
SHA1 cbfda1b541775a2d68dd49da7ab1d03e1371ff15
SHA512 df837875c37de22f7a7e90a237e68f526d513fe2aed92ada428171484ee0e7d2b46514f0f8446f74bdd92faa71c4b6c656b51de037629718cc2ebb09531c793f
TLSH
T18FE0680123E0E8AC1300C84682B8B32680C63065A3D85C79F612B0F414424005BC62E0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 1bde510a8acdd1d135fbd1d26695a7177a38cad7616e7840b7d88ef57f9430b8
MD5 2445f38166b3efa1b0ad6e117099c9af
SHA1 b3f93bf435f496b755324d28eaa543af6048af19
SHA512 2035296a44e12f4683e79ba3ae34e02da77a1dcb85b7bcc0a7e8be1f00a770d159e4d9feb7582f35800ffa0c18b03c501aace9b79d531548b2faf5089f6c5f8c
TLSH
T177D02B9AFDEC9E8EC7E44ABD57A9B4000A4802A3840B9B1310347EC034956F01E35030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a0cffd8f4db4d5063f6361a12b7a62074d55324a5306167a9ba69d818360bb2e
MD5 2962c33d1f8fa75a02a80e19e858028a
SHA1 7bacfaec352976fdda0814a908ba8613c6ca9506
SHA512 92db8700ad02dbb8fd5993eb858ee801367563c55a4146e1858d43d6624d4b7e99b21bd1038862b74e01b6db9a492ca35a1884e11b8202646ce1cb87ee83a2df
TLSH
T107E02BAAC921DC2728FE4B2AB0560B4AEA5013672680885F3B3D450C8FF172B468686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1c1b0af1705c26b910239afa1831a300fbe77de96caffe51dbb0215834444f30
MD5 a30b3b4cad51e9010f754ee21d21357b
SHA1 451d22c9ec80ca04b80b499fc95e86d2d8c7e4f0
SHA512 2b4fb653bcd048cf3d5f58511765fe3fefbde2fdbc4a214e174621b1659ade9794775087515bef23eefa983ae4c28c6599578bec0d15081fcee4310417027da1
TLSH
T1FD31C2F383F4856ECA1196F0AA18BE1FCE1D0514432C7D9A85E4EF5793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ae5cd9e6b70de1378f43e9435150f1cc42d10209e5bf1865cf7011157a9f23f7
MD5 39729ab8c0d4ed2a80f67f00207c36f8
SHA1 f80b67f0a12d18572eed9a444dc65b7ec251e169
SHA512 6347fd17d860ac837a68c56df43362d34e29ea3bfb6a3cac2d7eae324d0c6d10d7f82eeea6b2205e40d96ca928f40dcf5a7942a08a301749517d9daf7254c969
TLSH
T14A31C2F783F4856ECA0196F0BA18BE2FCE2D0514432C7D9A85E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd5c9b07cb8aa5088fb276c3bf10a06124dbc03c6f1360f2fc339a36511897a2
MD5 c84c2c7e91d10e92e21e94dc7b96dd05
SHA1 7bec7565712ea0286cab0d3e6d8f632892f06b50
SHA512 44d3898fb27836b79e62fd8d94796625deee58f541f591f8ea9a8a1031a846a3892564f62bc37181447f4af1080f89429c58eada841c5519d646b0100c8dbce6
SSDEEP 192:sxZNRfyMqZjK1Ml8UQPFZ/f3sb7IJePE0CXUSNzodp4G/W6+WNQOr/Y0dmRNSzIA:sxZNEqNZ/f3s/Ix0LZ//bd/5O+kC
TLSH
T1CD62F8166A349A7BCCDBD319F6457F53D2F9056392804E48A9FC8A0C04E7ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 baff9c37046ec923e26a0bde7d3e95e1315733dce86c89953969e63b0f158f9b
MD5 a83328faf2bcdad1924df1b6e6440a47
SHA1 434663772b22efa00badf0fa1d09c4ab03f655ef
SHA512 be518488b5d8758de38ea1cc76e43825d17921e77f81c7f5ff6f1aad7bbc8bd945964c06359e295dcc0a659625e874301976a99cf89f9131152369bf4310fc28
SSDEEP 192:sxZNRfyMqZjK1Ml8MFZ/f3s8J7IJPxE0CXU7NzodpW/W6+WNGY0d3RgSzIgj2J:sxZNEdZ/f3s8dIZ60LSW/bG5Y+jC
TLSH
T14762F7166A34997BCCDBD309FA457F53D7F9152392804E48A9FC8A0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 98285f8d28c4ef54fdc21ed946aa7e965afe516ec6d9b9365edb83c9d2a46a3d
MD5 c6ddf0367892ffe1343ed1d9166b15b9
SHA1 198ea305d257127bc3d3e4541e1b9042a71e53e5
SHA512 20d656907ea619655a22c40e783cafd9e038546094c972d4b111d5eb9fda3feca0de4ea8c45670c84c2ab4e896fa16fd31bbab826692ffeaffc03aad05e23ce7
TLSH
T1AE51D74E4E428B2AE8AC02F314F3549033354CCE5B50962768FC22326D8376E1E4B6DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cca8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index~RFe5cca8b.TMP
Size 2KB
SHA256 2f8c2677da7f32d41cfa340c737e6678305a57cb56f9edc380328a667c5353a6
MD5 06cfcf08182b350e0d625e239a8bf313
SHA1 66cf7d93c55311f5585a0e8de47a6186c12f9c46
SHA512 a44c1bfed4256ea39f1c35be16f9e79221a52799e768b8b7dea203bd390d686147f73ad04b3638a9ad309074aa73363f555b8af664566829298a05f1e34cebbd
TLSH
T19E51849E4D828639E89841B709E3A8A437391900C619BB5374FC9632ACD379E3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e480d0e215e3f6b7926c61c043861eabf2ebd37070f103d1611b569efc1a9623
MD5 afae9481c5160503073df71d5ad8614b
SHA1 924130de873c65415aa5e24ec796fc5594568471
SHA512 1e0e43b6e40b63428fe1c7937e8835b95994c0dceaa9d946a0ffd6bd591b0f5025e7ab022a68965f7fde41cbfe89f60f5c5c89ae1a9559eaeff46f4b4ab24755
TLSH
T13FE0C0B73DE72458AC2F87D9107214940060F899D4C5BE4E143E71E7A0A039A2806C72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 266df69d374751638fdb4e9904d24d35516ee4367c95b47c862b505e63efceb7
MD5 1656b4adae949791beea2191aeacd4bc
SHA1 490e681068da6f95d013778a7ba2ee27e127d447
SHA512 d2aa0f4916e0caaada383a9605386e1ce9ee6fa5a6a76789778508a6edeff5d2c1caf7729be91253362e612fffc1b3b52a1587af6839cc896850694a6107107e
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Gx9:AFBHhTofhno2mB21q3Llbfe3sLDdeEpY
TLSH
T136B28056717B12023C3D291CA7929B370E8272A33458A56F7BB900BA4E67E615DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 35bf7fcc2d019cffb15fd9b751247c1f778c84a67df85aa473b0b4450521b262
MD5 1a6bde52c0b67efba71976c2bee0d093
SHA1 c1c5c32ad65719040e3adf56d250c430cefde55e
SHA512 39b36c345d1d8fe285ee4eb21e2d5b661b8bcf08c1bf4047941ba94b7dbe345910806b4b91bdf04698942dee63f30708ccabd469869830046eb97914140d2e4e
SSDEEP 384:nZiF1tNn/s3n9Se38Nf8TUNTUlIR+/5y+CCjkpfb7oV9Ph7OSmdlkOOObjI9G6wT:wF1j+9J3YwgI/eTJoPMiO29Mv
TLSH
T1E9D24B32E855CEB7DCE74EE9B74A3A07DEE041A7868C5AC8D9C86E4D04DB1AC4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d6aae5dd43e13eb6b562db889dbfe013b6d5ac36da6ee6fa7f17047afd16c67d
MD5 fadeeaaa1f4ed785c17bbe2538360deb
SHA1 a92ed2acb7b04d88c407b072e869feecd5503f81
SHA512 96d61ee4321dcb5644ccf78256f804fc90ad129075704be0aaf97112522c9a8c7d35b0a3bd21706e40b34547619bcf0f41b095654dc466cc5d50f555430d9f43
SSDEEP 384:n5jiF9CcmyWCo38Nf8TUNTUlIR+/5yECCjkpfb7oV9Ph7OSmdlAOFqDtHy/7IgG:AFccpo3YwgI/cTJoPMOOYD7
TLSH
T1C4C21A32ECA4CABBECE75E99B74A7903DEE04153868C9AD4CAD81E4C05DB19D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3e605e70033022c60f969d8a64d1c78365ec20bc3db9e3e5d095f041d202cc2f
MD5 473c8eb6c68ffcb542b7c49078a5dba7
SHA1 4d3ce061cb1dbbb2b15719475486f3838ffdb114
SHA512 0931e44873e237f7666e59145677fd4ba21315065f314a981c10248d4fd75a82d4e2985cf963eae0acdd949698b1319d142bec858a570ddc24823dfd03bc9e93
SSDEEP 384:nMiF1tNn/s3n9SQ38Nf8TUNTUlIR+/5y+CCjkpfb7oV9Ph7OSmdlHOOObjI9G6wT:3F1j+9d3YwgI/eTJoPM9O29Mv
TLSH
T173D24B32E855CEB7DCE74EE9B74A3A07DEE041A3868C5AC8D9C86E4D04DB1AD4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a752f98757f5e7ba512742814b50e6c7e6e5ebd3b6a8b08021e4313a74c8126f
MD5 0adc6d5f0a0901ffd48ac60bed0b2098
SHA1 93bb57d578b460918f42db073bc2081429b091ff
SHA512 43cdde1feddd8cc30e8f2d498e933d0c988ff70e6f9204ad8d105982bee715dc82fa494d71a684c77974595c7e205eb5f51508046f3bf0819c4ca3420f76d3c2
SSDEEP 384:n5jiF1tNn/s3n9SQ38Nf8TUNTUlIR+/5y+CCjkpfb7oV9Ph7OSmdlHOOObjI9G6k:AF1j+9d3YwgI/eTJoPM9O29Mv
TLSH
T18DD24B32E855CEB7DCE74EE9B74A3A07DEE041A3868C5AC8D9C86E4D04DB1AD4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 76ff253f1fc31b844fc07f64177bd32b2a23fd112d7d67673e31d471888f526f
MD5 90a94324c964697e028ce965a973053e
SHA1 dc242087af02644199b742d9fc413da312a068e2
SHA512 945117fe6dccb29fce1c383056b40aa6badfd7efdacf922e5213c7e7669721ab029ee13b489ecc24681016a7730e75fec5fcc6ab9d0e017ec1ad291b23c845c3
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydv2oAajkpfb7oV9Ph7OSmdnPhkP+lFYS/Tn:xFccps3CAwgHL7JoPMnPhkoFYS/r
TLSH
T158C24A32ECA8C9B7ECE74F99F74A7A06DEE011A385889AD4CAD81D4D00DB29D1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f8760984ac22651d6e9018957f4d39b81248ba993994021a242332b522c4a311
MD5 df0fec4151d5155b880e9cbd3e42ea35
SHA1 851a300b7ead0983b86063d23b16d9bb7cfdcd65
SHA512 92bed44f1ff0536a039c1178a81522c7dc3e104a502650e65f97e65016ae1184d3d2b103607d488c1a86a3f0d41f021f067240759b9843caa1eebe120db1ab51
SSDEEP 384:n5hiF9CcmyWCs38N78TUNTUlIxBydxvzjkpfb7oV9Ph7OSmdl0OhkP+lFYS/TsH8:6Fccps3owgO0JoPMuOhkoFYS/r
TLSH
T129C24B32EC98C9BBECD64ED9F74A7907DEE041A3868C9AD4DAC82D4D00DB19D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5604-200-0x00000240B9550000-0x00000240BA550000-memory.dmp

Download