7f8b71ddb61965b5fd8f49312e0cffd7203643465a8cc30a96c31508b3dde39a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Memense.dll
Size 12.0MB
Sample260704-dkpphaex8p
SHA256 7f8b71ddb61965b5fd8f49312e0cffd7203643465a8cc30a96c31508b3dde39a
MD5 eb4cf3ff356f969d8223279d569e5c54
SHA1 23101734cb2b7972596954dfc01250470950e81a
SHA512 cc7be7f8ee35667becf5cea741cc4460db530f3f18026d2a897651a38661415b50ae47a089483dd3514cb0b6eb381a25891378653c10f51bb0dc1abfc5ba8227
SSDEEP 196608:0vnj8PBRjjZgDpJ7LBz7o3vgLlua/GYH:0vjaSJhzM341
TLSH
T15FC68A2B1B53B1A5902852FE0CFF371C26B8B3D6EA4877C6C15DF82E4B156C914272DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6104	msedge.exe

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	24	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a15ae76c6c86edf6	3
HTTP URL	103	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a15aea76fe60640d	5

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1184347845\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_424757896\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\surnames.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_448240709\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_528924151\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_424757896\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1228574980\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_448240709\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_528924151\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_424757896\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1228574980\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_686688507\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1184347845\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_424757896\crs.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6980	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276078832047115"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{8BF11FD6-793F-442F-9666-8BDE6550EE92}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6104	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 6104	5800	rundll32.exe	90
PID 6104 wrote to memory of 6860	6104	msedge.exe	91
PID 6104 wrote to memory of 3836	6104	msedge.exe	92
PID 6104 wrote to memory of 6980	6104	msedge.exe	94
PID 6104 wrote to memory of 3836	6104	msedge.exe	92
PID 6104 wrote to memory of 3836	6104	msedge.exe	92
PID 6104 wrote to memory of 3140	6104	msedge.exe	95
PID 6104 wrote to memory of 3140	6104	msedge.exe	95
PID 6104 wrote to memory of 1284	6104	msedge.exe	96
PID 6104 wrote to memory of 1284	6104	msedge.exe	96
PID 6104 wrote to memory of 1284	6104	msedge.exe	96
PID 6104 wrote to memory of 5844	6104	msedge.exe	97
PID 6104 wrote to memory of 5844	6104	msedge.exe	97
PID 6104 wrote to memory of 5844	6104	msedge.exe	97
PID 6104 wrote to memory of 4828	6104	msedge.exe	98
PID 6104 wrote to memory of 4828	6104	msedge.exe	98
PID 6104 wrote to memory of 4828	6104	msedge.exe	98
PID 6104 wrote to memory of 3012	6104	msedge.exe	99
PID 6104 wrote to memory of 3012	6104	msedge.exe	99
PID 6104 wrote to memory of 3012	6104	msedge.exe	99
PID 6104 wrote to memory of 1160	6104	msedge.exe	100
PID 6104 wrote to memory of 1160	6104	msedge.exe	100
PID 6104 wrote to memory of 1160	6104	msedge.exe	100
PID 6104 wrote to memory of 6684	6104	msedge.exe	102
PID 6104 wrote to memory of 5920	6104	msedge.exe	101
PID 6104 wrote to memory of 6684	6104	msedge.exe	102
PID 6104 wrote to memory of 5920	6104	msedge.exe	101
PID 6104 wrote to memory of 3700	6104	msedge.exe	104
PID 6104 wrote to memory of 6584	6104	msedge.exe	108
PID 6104 wrote to memory of 4472	6104	msedge.exe	109
PID 6104 wrote to memory of 5308	6104	msedge.exe	110
PID 6104 wrote to memory of 5452	6104	msedge.exe	111
PID 6104 wrote to memory of 5452	6104	msedge.exe	111
PID 6104 wrote to memory of 7044	6104	msedge.exe	113
PID 6104 wrote to memory of 7044	6104	msedge.exe	113
PID 6104 wrote to memory of 6328	6104	msedge.exe	114
PID 6104 wrote to memory of 6328	6104	msedge.exe	114
PID 6104 wrote to memory of 2600	6104	msedge.exe	115
PID 6104 wrote to memory of 2600	6104	msedge.exe	115
PID 6104 wrote to memory of 1156	6104	msedge.exe	116
PID 6104 wrote to memory of 1156	6104	msedge.exe	116
PID 6104 wrote to memory of 3164	6104	msedge.exe	117
PID 6104 wrote to memory of 5548	6104	msedge.exe	118
PID 6104 wrote to memory of 5548	6104	msedge.exe	118
PID 6104 wrote to memory of 240	6104	msedge.exe	119
PID 6104 wrote to memory of 240	6104	msedge.exe	119
PID 6104 wrote to memory of 240	6104	msedge.exe	119
PID 6104 wrote to memory of 3412	6104	msedge.exe	120
PID 6104 wrote to memory of 3412	6104	msedge.exe	120

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Memense.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/miarey.266191/
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff44f7c188,0x7fff44f7c194,0x7fff44f7c1a0
    3⤵
    PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,1092891976551689174,12669467152743933543,262144 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,1965878395640983926,18099964688920252926,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,9780532655266061601,15954922195430790547,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:13
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5503103145540028813,9664426949447936973,2097152 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,1510255458150140207,15091917244542608319,2097152 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5092,i,7081747523526671039,2714914566434817026,2097152 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3700,i,4346955837487258402,2473417160289064644,2097152 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4380,i,10342668677389142268,7255436306797565563,2097152 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,235929706980794148,15423763350971746713,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,1594695618696925317,14265405678105115763,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6862569972152404231,422813587226435219,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6862569972152404231,422813587226435219,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,6680572666803952741,14118328709581891033,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,13221189139180527754,13065659989329571642,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,2993403906591977289,7986552242249978013,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,4416534229842029018,15174831655643842314,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:14
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,1083981171113620377,13130294187081385254,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,16078475386215180174,14841655630042127624,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4673677828989363922,11151013031000101731,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,9424584650077430702,10486395333105413416,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,3273796957821237786,18019712750965299876,262144 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,11143509996285802578,12394053860923399743,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:14
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5240,i,10753320827178890990,1580530912877062524,2097152 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,13789574535979102470,16833384242176823688,524288 --field-trial-handle=2284,i,2694171727401424287,160745945199588095,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d3eab18e987ca6275a88fcbb78e633ad4796780937b1abf7f56aa5e26ab1eab5
MD5 fe2db55ca0c8a4d6b6051bb418cabaa6
SHA1 9669f7eadb5b9785ee69fc2195bb422c244fa6b4
SHA512 f2c4a8033467e30634441d4769833b1edad0964bfe197320861681feaccd3cdcff1bca5798fa287d762607662f7f620f245687055ab4bed81e1afb159400d82b
TLSH
T1B5711D12A067FA2AEB6A1176D5EA3CC8FFF084A205D39E1D806BF23584CF7087C43011
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 07bc182c9bc488cfc07234fb7d775736e63d22890863ded81806e8fd61831ea6
MD5 313ec06b416ed5ad2acee117ea102fa5
SHA1 2c96cd9f6190a6d5ea40597325be98669fa48b5b
SHA512 e3d6357375924cfcbc331fea6c06f0629206eb9cbc888b28bc46d35aa1743025d6309fe684b21280a9fe873002d24afeee43e5ae9d5375e7c6c8c3499045f6cf
TLSH
T1FB612E169027F92AEB6A5272D5EA3CD8FFF094A249D39E1D406BF23184CF7087C43111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cf22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cf22.TMP
Size 3KB
SHA256 a1b98ff4d88f936d823bec81e3b3e6510157922271b00559ab8e2c7fb602fe27
MD5 d6f04b279a3835f76b84224b37d58630
SHA1 0c46273c87b1f049cc10f69755ff6f4c7d2d06d6
SHA512 a47e5ef8e77791b46614e918b8b74a5408b71ec5662be11287c0e6f68ed1246b9c98589b7c31aaab215a45abe5462539f7d48466cc13655d5af46205231793d5
TLSH
T18D611E569067F96AEB6A52B2D5EA3CD8FFF084A609D39E1D406BB23184CF7087C43115
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 04d73f15a3a722c7c2cf76ef01938f456cc884a98ce871fb60522583b55fbc36
MD5 661250894595e8aa3a98d7f9aee0a1ff
SHA1 c4dc77d9f2af3674def3e92bd1bfd1d14d26666b
SHA512 4fe8279b7c01d8c17025904e3bf2f62887a73f03fe51e8cef3754dcc56b94f23583675c891d734df3047081d094f0c3ccd25042b8b5cc1ab5a3cbec83b485c82
SSDEEP 48:YALlgyDPNfO1Ew1Xh1Xj+E5AslRs1foKsmjhhnONgCCgmzs9VzEszzsU9sPusQPw:D11ONLJntixjhnZszvBICPj6eGwQ
TLSH
T1FC917EF3C6E8866DD91156F0A7187E2FCE1A0958432C3C5E89E59F4F93E24B1E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4ef81c85b440b3dc552fb4a9a9b716658e2562b0079858ab73608004b11e72e9
MD5 d9b57d924bb00fe3ede053380cb058c5
SHA1 facaa5dd518ce2f89c1da2e1af62249cd9adaf0d
SHA512 17226611bee8eeb32f34fd86411ebc3fb935f33957a50de2096cce9a30ae0607168e56371a5cf28b5059f96b16fbd95d05881be10835ad96d81283045845bfc8
SSDEEP 384:sxRe/qYl/fcssABaSRiMQvr/5x/PsXIERV:sKCYl/f8AEDhD/5FPsXI4
TLSH
T11472D81665385A3B8CCBD219FA817BA3D7F91573A2945E44AAFC8B0C11E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4863458e2543629d6d281a4958ce4a9bcf4fc9c6447d89ff0618e30f4da68db2
MD5 9a351e603a5a4d339487884ec0d18f27
SHA1 45f602d42777ab527560fdd161c41f9cc2eb241d
SHA512 0df54283b1adeac78bac1d1b6ca6ba021f9ba00f1405cf59f86858330eb544271d96d669216847ffacbf9d8935eb0ec9bf7b3961074a017f08871dca1f1bc9b2
SSDEEP 384:sxRe/Cl/fcsXjPBaSRiMQvk/5x/XosXIEjs:sKql/fDPEDh8/5FXosXIR
TLSH
T1DF72E8166538593B8CCBD219FA45BBA3D3F91573A2945E04AEFC8A0C11E76DC210383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 236f48d327c2343fa2a2fd339985eb3b2cca59b475388f669e8cd28787023749
MD5 2acd44103c1e1645b1ad4f7e201af113
SHA1 7e3e0e47574658538ff40404588a6b23daf38e6f
SHA512 3e7e818b72e8e6aa9dd63f00d76e171ccc6cead5d03dcba7fce4a0cbd10c0abd5bdcc482908f83b699275f229dc74d1f20c7670d3b7fb1d040ac0d5cccf24cf0
SSDEEP 768:PRbg3u7pLuL75sWgtVf6p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWokUfYHrovRzBH:PRbg3uE75sWgtVf6pu1jatokoYUvRh
TLSH
T129E2FD7B780CCB7F4F844E9CEC2ABE9A6DD802CB56D8C95447EA840C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f784cc4f59728a4bed680c7399be6f0133720a23e8d71248a548ab4ecdb88118
MD5 fdd0c0f584a441e102b95ee31e986d83
SHA1 192eb9a5645ab8f47ceab0889194f83b57f1fdc3
SHA512 3736819a9295a1cd8881312c999aa147b210911a9d771a22afd8931b137b62d2e1483280a102d94b4d70096254318f3bea38a58d254b23e3ecbe4d284b8fe4f4
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/p:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBb
TLSH
T14AB28D5171BA2B00383D240EA2B9841F5A4630A230DEB97B7B6931E56F67F005FFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b6bcf648e3edc463a803f5e60b4f8c9714aafd73cfb6f7359265ada1eb76017b
MD5 cf09f0b3378f0c769ae75725db52c283
SHA1 5d44b25e987747dac9e8d3e934a33320f69f976a
SHA512 d39e606f4a2130166545865c6b8d4b9bc56b5853debad8fcd8011807704bd6fb4a0936711f1d2f445cabc9dd1bf797b6c7f1ca54949bda131d1ed65afa35eac1
SSDEEP 384:nviF1tNn/s3n9Sv8Nh8TUNTUlIRo0zv3oPOfoFGB4Po34TeM/Lap2mn15wbAjEJs:6F1j+9SEwg38GWDTj/Ly2mn12bfJKv
TLSH
T137C24936E8A4CE6BECE68FC9B7497756EEE4126385D819D4DAD84D4C00D32DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 50e6c20ceaa8e66a07631fbaf9a29701e254ffbda4f875924ecf351b67807f12
MD5 54a86340c976202cf7313a7f9bb760fc
SHA1 127c80de6459494eb1e769f8d8f3cace330cc265
SHA512 a045bc28ebe61a425cf76d94e278378e15da706315cf2ecf118ee43f875b8c3c4384055b968340e7be45e1419735e0766c5bd7c92029794105f65a3522662fe9
SSDEEP 384:niiF1tNn/s3n9S28NZ8TUNTUlIRw0zLsQPOfoFGB4Po34TeM/LaHXI3OObjI9G6S:pF1j+9vswgIEGWDTj/LYI329MD
TLSH
T187D26C36E8A4CE77ECE68BD9B74A3656EEE0126389C85EC4EAC85E4C00871DD030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5111148444b379f07f8a289090887c568b8216fcaef9d79d15d3e81b6ea059e8
MD5 a1d309bffc63e856e9c0a86c6f586b0e
SHA1 45848fd1e89a2168f78aa36cd7236d69afc1f088
SHA512 1645cde6f3543984e64aa8b1d924f8fdca043b288f8c370bb09fce90c6b84e790dd9b3652e9851d33a531dfc2c6497669691fd4cc12a2cfe147a67fc6a035a01
SSDEEP 384:n8iF1tNn/s3n9S28NZ8TUNTUlIRw0zfsQPOfoFGB4Po34TeM/LaHX33OObjI9G6S:nF1j+9vswgcEGWDTj/LY3329MD
TLSH
T16ED26C36E8A5CE77ECE78BD9B74A3656EEE0126389885EC4EAD85E0C00871DD030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 df8871f4462497546f6cc170406a01db5e255a00ec67258d3c1bbc99f0dc632b
MD5 c0a92d9445bc55d3ad7954ee5e013f05
SHA1 8337ddcd72324af9667062b9faa9f020a9ecc48e
SHA512 ee7295392f5ca3afcd188394143cb07e0965daf6b05316ab6ea17914dba40291c5d164b5319d9e4d3d45edd2139b3ef402d3283e35bb45f62f792ad9c0a7bd84
SSDEEP 384:njiF1tNn/s3n9S78NZ8TUNTUlIRw0zfUQPOfo7GB4Po34TeM/LaHXC3OObjI9G6S:OF1j+96swgE4GWDTj/LYC329MD
TLSH
T12CE2B1F298D78A77D89E4B97677D2E429AFCD263B4885984B7C85D0CCC821BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f0838bcb15e7b287842fa67e3ac7d9aa141ba7dcf68b1f2f4b2f9b0fedc4c3c
MD5 6881d1af77c4930408c348377ca321cd
SHA1 6f9506245f4d18ac01f5aaa40da0e1b7fd43b63c
SHA512 65f117dafd12f980023137ea9929f675daf0ba0d4aa6af4c97cf66d79b24b6c88d7a1983470aa85e52832e2f6c84bbf26d1c8d0a8c5b9e5b2389e326079b2cae
TLSH
T11E412FE15C3D1AD1D0BE0E7EB88B38FC84E8D726F4A4343D2888E998467961D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1503a0e5d6dd34de1c7ded623f58581b5dbfa49678704f6ed5fb36517828db88
MD5 d0d6c36b145df0632a1a3cc55c1f3989
SHA1 d01dbfc401a59c726797124f987d71518270bedd
SHA512 cea97f32ada3996ce2d07cf92a1631c5c6e2ba527b415b88973401d8f55121dbf2854109f84901b25ffb4366a724c4c5bcdf1acfc709609c780fc4d8a249fe5f
TLSH
T1D94110E15D3D1AD1D0FE0DBFB88B39FC84E8D622F49434392898ED58862D61D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25f2e4d08343515ce82de5a80b09a6f3f9dc580e5a68d8380f149c8106a475ae
MD5 03a88ed062de4752b391daccf63272d9
SHA1 6619fc7e27dad4a8ab455f794738406ca4d826ee
SHA512 7c77c5f39ad05c5c1f3d3963029ae972a16d8ae8360de3713c48c28313c4ecba7b334b1caa4bce267e9d6d5e6b46c641178dfd7d76214d47e5a5c5a6e7e531e1
TLSH
T1804100E1593D1AD1D0BE0EBFB48B39FC84E8D726F4A434392888E998466A65D158143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8da1818eb6f75f23881516959cd35164d2c634fdef1fade39ece712dbbfc3aeb
MD5 bd8f93bd22bf851a3b01df2c965c1ccc
SHA1 4f1b7152f5e17b52c90a671e0ea88bb13d56eef0
SHA512 ddb28a785e304ad0540359b3328cdcc27c8f3923d4320531476b1c29b7fc8c08efaaaa7876f61ac417aa7acfc1ed7038de7eb311efdca7ee85e72e0e0a4e8eab
TLSH
T17031F1E15D7D1AD1D0BE0DBFB48B39FC84E8D622F4A474392888ED58462D55E254143F
MD5 SHA1 SHA512 TLSH

Submit Download