hxxps://google[.]com

Analysis

user interaction
yes
max time kernel
899s
max time network
441s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample260705-c4brbact8l

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
226	4480	msedge.exe
226	4480	msedge.exe
226	4480	msedge.exe
226	4480	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
224	raw.githubusercontent.com
225	raw.githubusercontent.com
226	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holzer-safety.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydroxide.peaceful.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276926546857317"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{1E209C7A-4674-45C3-895C-EAE809AD5FAB}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4528	2316	msedge.exe	86
PID 2316 wrote to memory of 4480	2316	msedge.exe	87
PID 2316 wrote to memory of 4796	2316	msedge.exe	88
PID 2316 wrote to memory of 4796	2316	msedge.exe	88
PID 2316 wrote to memory of 4796	2316	msedge.exe	88
PID 2316 wrote to memory of 4048	2316	msedge.exe	90
PID 2316 wrote to memory of 4048	2316	msedge.exe	90
PID 2316 wrote to memory of 4072	2316	msedge.exe	91
PID 2316 wrote to memory of 4072	2316	msedge.exe	91
PID 2316 wrote to memory of 4072	2316	msedge.exe	91
PID 2316 wrote to memory of 1904	2316	msedge.exe	92
PID 2316 wrote to memory of 1904	2316	msedge.exe	92
PID 2316 wrote to memory of 1904	2316	msedge.exe	92
PID 2316 wrote to memory of 3492	2316	msedge.exe	93
PID 2316 wrote to memory of 3492	2316	msedge.exe	93
PID 2316 wrote to memory of 3492	2316	msedge.exe	93
PID 2316 wrote to memory of 4780	2316	msedge.exe	94
PID 2316 wrote to memory of 4780	2316	msedge.exe	94
PID 2316 wrote to memory of 4780	2316	msedge.exe	94
PID 2316 wrote to memory of 3312	2316	msedge.exe	98
PID 2316 wrote to memory of 3312	2316	msedge.exe	98
PID 2316 wrote to memory of 3312	2316	msedge.exe	98
PID 2316 wrote to memory of 4376	2316	msedge.exe	99
PID 2316 wrote to memory of 2260	2316	msedge.exe	100
PID 2316 wrote to memory of 4376	2316	msedge.exe	99
PID 2316 wrote to memory of 2260	2316	msedge.exe	100
PID 2316 wrote to memory of 4844	2316	msedge.exe	102
PID 2316 wrote to memory of 2248	2316	msedge.exe	110
PID 2316 wrote to memory of 2248	2316	msedge.exe	110
PID 2316 wrote to memory of 2248	2316	msedge.exe	110
PID 2316 wrote to memory of 2896	2316	msedge.exe	111
PID 2316 wrote to memory of 2896	2316	msedge.exe	111
PID 2316 wrote to memory of 2896	2316	msedge.exe	111
PID 2316 wrote to memory of 4900	2316	msedge.exe	112
PID 2316 wrote to memory of 4900	2316	msedge.exe	112
PID 2316 wrote to memory of 4900	2316	msedge.exe	112
PID 2316 wrote to memory of 5484	2316	msedge.exe	114
PID 2316 wrote to memory of 5492	2316	msedge.exe	115
PID 2316 wrote to memory of 5500	2316	msedge.exe	116
PID 2316 wrote to memory of 5784	2316	msedge.exe	118
PID 2316 wrote to memory of 5792	2316	msedge.exe	119
PID 2316 wrote to memory of 5784	2316	msedge.exe	118
PID 2316 wrote to memory of 5784	2316	msedge.exe	118
PID 2316 wrote to memory of 5792	2316	msedge.exe	119
PID 2316 wrote to memory of 5800	2316	msedge.exe	120
PID 2316 wrote to memory of 5828	2316	msedge.exe	121
PID 2316 wrote to memory of 5828	2316	msedge.exe	121
PID 2316 wrote to memory of 2928	2316	msedge.exe	122
PID 2316 wrote to memory of 2928	2316	msedge.exe	122
PID 2316 wrote to memory of 2928	2316	msedge.exe	122
PID 2316 wrote to memory of 980	2316	msedge.exe	123
PID 2316 wrote to memory of 3512	2316	msedge.exe	124
PID 2316 wrote to memory of 3512	2316	msedge.exe	124
PID 2316 wrote to memory of 3848	2316	msedge.exe	125
PID 2316 wrote to memory of 3848	2316	msedge.exe	125
PID 2316 wrote to memory of 3848	2316	msedge.exe	125
PID 2316 wrote to memory of 5124	2316	msedge.exe	126
PID 2316 wrote to memory of 5156	2316	msedge.exe	127
PID 2316 wrote to memory of 5156	2316	msedge.exe	127
PID 2316 wrote to memory of 5360	2316	msedge.exe	128
PID 2316 wrote to memory of 5360	2316	msedge.exe	128
PID 2316 wrote to memory of 5360	2316	msedge.exe	128
PID 2316 wrote to memory of 5372	2316	msedge.exe	129
PID 2316 wrote to memory of 1412	2316	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd6931c188,0x7ffd6931c194,0x7ffd6931c1a0
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,8974600978249924645,5023894616738404093,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,7732425436268918194,8162451743294578570,262144 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15033562198499712163,15567176383042143003,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16186180787334223384,13823122071227353328,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,1669189887889722112,4712072148004697929,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,10958498333564884726,18273831980755113007,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10261648171170034095,16176161866760764753,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,15523474382841808630,15802990342498173729,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,2729790207862880405,9708734413126351026,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,7868749658961446021,12282314945046957641,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,11138171469914337323,13036015291829877282,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,11138171469914337323,13036015291829877282,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3648,i,9843716723472069766,1133119678344102623,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6244,i,112919230264874196,6783627226104514819,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6396,i,12049696648713838601,8104568093971140011,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,14789568624920611051,6954920689137220610,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,9175847565294962824,11316323562014708144,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,2867499072156198388,1198490866854287288,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3556,i,9525982420641191629,6927638971279924172,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4598526761356992092,12062641119936731581,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11892399537546810575,3063145966459212111,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,84207476333458296,11099136882348574466,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6456,i,17939804435344797036,18265563235488580715,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,4375747640320882316,12029741573629631632,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,2251091122959461462,10809786808401996428,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6796,i,12256581994810051737,6473254686780959922,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3415482308332237590,9444044012496245358,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,10488723486609201748,8634621633086059407,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6512,i,5700625342676497230,7896354830812673140,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,12912829606952808347,7704084214755529187,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,16521911142658856484,4977661618886422781,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,12661229425276184274,366867147239528848,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,12661229425276184274,366867147239528848,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,5625699946670253759,12361107156901018677,524288 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7176,i,16700058384397381572,2738063147688274276,2097152 --field-trial-handle=2240,i,10520766905619772966,16366541855389098624,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3600

C:\Users\Admin\Desktop\Holzer-safety.exe
"C:\Users\Admin\Desktop\Holzer-safety.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5200

C:\Users\Admin\Desktop\Clutt4.5-safety.exe
"C:\Users\Admin\Desktop\Clutt4.5-safety.exe"
1⤵
PID:3168

C:\Users\Admin\Desktop\Hydroxide.peaceful.exe
"C:\Users\Admin\Desktop\Hydroxide.peaceful.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5420

C:\Users\Admin\Desktop\Dead Fish-GDIOnly.exe
"C:\Users\Admin\Desktop\Dead Fish-GDIOnly.exe"
1⤵
PID:5376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x498
1⤵
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09feb6a8021b01251b5f6507b6843fccdfcdd4464b96e9d3ed20c244a8b69237
MD5 6f3a72a603e4c2e57dcece0f8aa5191f
SHA1 9e6771ad6e182b93ee302219b7137b05c84ced36
SHA512 2f74fdb8c0d1e59213bd621128713ce3155b88e8f4c3fba3921bf00a8bd8c972e9b32b5f8f0ce5f687614e89910d8adec4071f3e000c8cd3954eb582e27b6463
TLSH
T12ED0A76475297896D23E10355431D210F6655063622582457210880D9D7C8855BD57A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 6bafbd71e736efc96b36e6a83d3422c50e18b7fbed48e3d382c6efae61065c90
MD5 e1fa1f4297058324b435e13d5dfce7b1
SHA1 f3bf96ae362fb03c74ea9aa6e97c8464d5bd3f42
SHA512 2e781da401cef1cf670b2da4c59194603dd9e56635c1bbe9bcc2db2416b73a1752af6682001a739a2727795b8adf485c9240cad97e096690dfb431f50ff0992e
SSDEEP 96:h5gJbRbcwZXSsdfAW8lIInhtFFy8x8Gc1lSHv0GP9Vh5Yx0CNVECx7COFDkSbp1M:hlwZCAa7yBlEt1VWtlFgS1kSErNH7
TLSH
T1D50272ADBF92E691FFA025FAC0C22BA0F1710EE9B5076D588044CB7CDD1A3BE1156709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d201.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d201.TMP
Size 3KB
SHA256 3f924a2719428fd376b3b8a37b19ad4a48750be9bb510396e3ae3568c188a61d
MD5 2ca8dbaf7a30777355e7eacf00115361
SHA1 1ee2a0c3e910336bc210d6aa01d64dc487ddeb0e
SHA512 50ea85151cc0c1f644bac6fb6d801cbe23a7394be098c29d67a458a3ddb122626cd073fe592ac37a1ce491311e5151984ae2f03cd621cc34bd62952b2bf6758a
TLSH
T18361B56D1E46C063EF603230D1D2A1F574724D7A8E67BE0AD0C8DCBD580DBE746AAB18
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c5c1e9db55a30c83f90da82f1e3dd150d2d281ecfe8c9dbf678c41c1f287c253
MD5 eea4f46b93ab9e98c5218f9b939795d7
SHA1 954db32b199d3e713260e24eb3acc7134db76067
SHA512 b6522afb07165377e383d4883ba1e9884371e01ee874610918cd22df4384e06c20b84cc81cc08ba4052ff0b441de51aaf70145b02020676b3f9ce6fae7390ff6
SSDEEP 3:MsEllllkEthXllkl2zE/lVPM:/M/xT02z4P
TLSH
T1044404047FC00407C5001174C051C3507370DC111733574334514D335DCD7540C10150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 3819904b8e68cf16056389b283f0e34a5bfd7de180e0fb3cd2aeb4ef0ab1b532
MD5 977af74ab7c56f2eb7fd726ac8c1c0f0
SHA1 08c64ba81a56ede9c10b019d680401591c99850c
SHA512 d748837418ca427839cf17bad6bc26c82271d623ef2bca582025478e64a8a4f7f53735a008c2a05a286f2c62d6b722c4a7f58b9e929b4b9fd52a2ce9a477a609
SSDEEP 192:Dz9WHq2LZxp5WJW2N+ne/bJm8b1JO6IIJI8I6IeWQhDrU1RejsPAZNPPqaPLfP8+:Dz9WHq2LZxp5WJW2N+ne/Nm8b1JO6IIv
TLSH
T155328CF7C3E9C22D891116F49B15AF1ECE1A1A28432C3D3685D8BE5AD3F2431E11675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d409375eba97e84e13bc9e7061f2d4a0ad0023a125018cb407257016ea52e5bf
MD5 566ff74d389b3a7aaff64467fbe4ede2
SHA1 8faaec30f30623c66142366a88b947c8c9da7abe
SHA512 c640ceff1941e7d7a85d44cc9ff1355bdbfc7771b1a548e39966f6444c5dd7824be3f9b20cae93a0b1b1f7e3440f26b6fa4dbc9aa9eb73ad4d3ced21f3f6cc63
SSDEEP 192:sxZyR9yM/jK1Ml8MkU/fyswNAoL5IdpqXNyHW6+WNrlK/YH4VjVIgrJ:sxZyjMU/fyswNnLSFHb0/N9
TLSH
T19152D7166A34997BCCCBD209F955BB53D6F50473A2940E48AAFCCB0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4ec6f0b9c1bbfc7fa0a068208e02bca81bc23ba9255dfab422420869effdedbe
MD5 3d0888f233d3bd0261672b0ad0b1dfcc
SHA1 e052a9526fc9a64b0c3ad3f53f17e19d9973d9f9
SHA512 f0fc3bfa186e39be86f8e0dbf860e770b21bff0c02a4fabf2748bdaf21919a4f587183b996d02ae03fcfc2442fab4a5ae976855c82c708a4c012b131427db5aa
SSDEEP 192:sxZPR9yM/jK1Ml80qU/fys+WpVTNAoMDIdpvs/vPHW6+WNIzYDp0+lK/YnMUN/IZ:sxZPjgU/fys+WvTNnMcUHb0N/AM
TLSH
T16872C852693459BBCDDBD219F955BB63D6F50422A2900E489AFC8F1C02E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bb91706bdbf4c6d5f64a8c209868e792231d0efdb26a2da5b4e69e3ccda8704d
MD5 3e116b643d7d094931e8fd5c6d1c0128
SHA1 88efcd9d0949fb52ac87fd33b0fbeedb0473927f
SHA512 585df6f6b90c2b4a6fc6403ef9328fc6f3dab75b9a8c017e64e330611578f844981c79b0a2a1de14de0a094d74bd427cfaea3856d1867b94821766899519bac4
SSDEEP 192:sxZPR9yM/jK1Ml8MqU/fysnNAoM6Idpvs/vPHW6+WNjYDp0+lK/YHQOYVIg5UJ:sxZPjCU/fysnNnMTUHb1N/X6
TLSH
T15B62C8536A3459BBCDDBD219F955BB53D6F50422A2900E489AFC8B1C02E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c8baa78cebd3dc0a1105b2d05409b7c9e5f8907c61d2bd9c7cbb66e3874d8923
MD5 fc991e872708fdfc3540a33ce7bb0011
SHA1 1cd353fe6fc1f742f86e105e0ba5cfa390e70056
SHA512 479eb0720816d86ddaa63f0064f1fe1efa94dd05df6b4695b27d8bb7a76df4254d02e0da50a844a4cc710cab0e600362e8c709c178640c76e40bb4aef10938b9
SSDEEP 192:sxZPR9yM/jK1Ml8MkU/fysnNAoM6Idp9s/vPHW6+WNjrlK/YHbVjVIg5WJ:sxZPjMU/fysnNnMTKHbw/wU
TLSH
T14552C813663459BBCDDBD209F945BB53D6F54462A2900E48AAFC8F0C02E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8bb223ce362c66be1a8a008af4c0d80a5eaa94a0e96f65918915b350c4317e00
MD5 9c633bcb7f191e25b7a68b270edbdfd5
SHA1 3bf15ca128118d509380b61e1f45f41af22e318d
SHA512 13787fe60be16c729e2241a1b980e1ef836e7b79d8e428e0ea9db671b695eccbb570f871ae3a989bb8293e7744bbb6f234490cca425e00cb7a8b002f0d9a8d7c
SSDEEP 192:sxZPR9yM/jK1Ml8M9U/fysnNAoM6Idp9s/vPHW6+WNjYdehy+lK/YH0PVjVIg5WJ:sxZPj1U/fysnNnMTKHbAN/fU
TLSH
T16C62B853663459BBCDDBD209F945BB63D6F54462A2900D489AFC8F0C06E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33e733dd8510cb84bef2ba8d6e763969b9a356dc43d6b23908e4c51888afcc00
MD5 63f01e5885c77f91d629b6b923d58fce
SHA1 e297b4504a38d87f77f8831887d5cc859a5b3d4e
SHA512 77ee2dd955a43df7235d33a74625a1527c11323a9cb6832a3784998338732bcdd2054a78795d30746521c457ce6272adfb4a8ff99f89ad3ff481a59765d9113c
SSDEEP 768:LGUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R4roVw0V:LGUZYTMWvg0Pou1ja7eLZmRD9V
TLSH
T1FDD20B3B280CCB7E4F844E5DEC266F967ED801CB6A584D5447EA894C03CB7EB112B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8762042223d112d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\b8762042223d112d_0
Size 194KB
SHA256 4c9ff7e3f9ae2ab5aec918b3724393932e0090060dc1a62aaa0ec1086b68053a
MD5 e5c081346d36f1ec14374d8b9c50663e
SHA1 8138ec07882135818a95810e310686dc47960c32
SHA512 d2cac507431bc5bb967fb645a4ce12ab040d1b6f0bcbdb8b2de47f3eb3b60580a6f77572c2b5e8a0e28ce7aafcb614a5bfe4ce0774eec62b81194fece40676f9
SSDEEP 3072:0egF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:0egF1cc9zByRIZa8HlI93h
TLSH
T100146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 75c34cf98cf70e2df6779f3eb30ae661fb59768c85e527e8e894dccda34b0dfe
MD5 38f20c690c031fd38f06a3f0e3808401
SHA1 eb2a64815f01e9271cfc4f0d5ab6013280df6b3a
SHA512 884a08aa90156f15425fea4fd2d45b402e1946bfb9989b208fb60305a1fe0877d6a2e2285390d12b2911be5e537931368611ff163b6266fefb02fba3ed8da091
TLSH
T1CDB0112C22A0AA22E88033B222C880C023302C8233028B0222A208288883288020A828
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f7757bfde7d242a67e816867d5c28ff6594dd5556767460fcc843212f010097d
MD5 f9b6ec27592a4ff5ea1bda247adbedd0
SHA1 d46b4b01373503c8c5a1063ddbc29b597b204e7b
SHA512 1468bb0f6f3afb7f13bddff54792527144efd359324be12e8d461abd8d5ed364de8d5ed7b089d8a0ccdfc642013342d9b58e30c254c3922e986e997fcf42ca0c
SSDEEP 96:KA1eK2AozWKco+GjaKAQAx4fjxvPxWDGsA7xKI4ARxUJhe7PSiIgKNO7Qh0gS+X:E0F9TbzWQh0gS+X
TLSH
T190D1F31271BB02033D3E2908A399D73A4F45B5E33858A46B3BA904B15E6BE345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 b83259e04f97f3790be134ad205a749a1fc44bea11082ca36e7e891ed9eaa7e6
MD5 b902b5d34fb8dc658c91ab32d4755fbc
SHA1 eff1ac39ac7ebc3da3906129ff31ffb0fee6c949
SHA512 bc33cd85610bf7d1e22248f6c76e83920ee12b2dad0f2fb928c058ecdfdb3ed63af8acbd84351283ed55d31f629778dbdd2d89e43f7c6fa2b4b6547db0ece51d
TLSH
T167C04CE3257086EB4A74AADC2028B61DE55B428D8DC4EDF8945850926074D3744065A8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58acb6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58acb6.TMP
Size 157B
SHA256 86748a7dcba242d874e1a99e9bc14073fa0e7c22496624ac86c3bfbb98b88ca4
MD5 6b836f8b1860dc3386ac34da1c032b80
SHA1 2a1eba54a90f2e280b151d5409493f02386d367d
SHA512 58a2b4e9ac0df5ed5acf4b3a5595e089e558181a15d3793c133c898b8632a1b67d2ee9e1817b2c4f0c461d3bc2d83fe5d31a81474b77bd40147ee77cdb237cac
TLSH
T1ABC08CE3253082E70B30AACC2038BA0DE05B4D4D8CC0DCF8904970422034A338409468
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59018d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59018d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6fc4ef723918f35b147bbab68aa32888396814a6de200a275626fcd8472bae1b
MD5 93af74735576408eb2a4d793cb8b830f
SHA1 4e7abe9f13b3474f59a0b20026333dbe5db5a20a
SHA512 4203758440fade74ed274cb18f6fc3b6351c736ed316006f06e103a06bcf59ef97375fdf7f10396c6e1dbede181b34b6931394c2db4e8c20cf7761c890ed69bb
SSDEEP 384:JtNn/s3n9SfsNl6KEGAzX5od+H8ykXuROObjI9G6w7fk:Jj+9U4oONuR29Mfk
TLSH
T1AE926D33A8246D774AD3E595B44B36239FF49067A7842F80D1EC6F0C02DB6AC531AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9a8bc05409fb2c47d2a14921e349509451fa450df37d6a69788c49b8eeda7bfc
MD5 496f2f00424fc31da6c1246d98da7f46
SHA1 463d8ba3b8966197cd901da878ed86eaeb811afc
SHA512 9fd2ebba4ca2fd43b11217774d4e95e4a4ce015d15aa230b6ea5d33b5a56b77614393fd8caf7188ca208da3a91eb746f1726533ef5cb7c812e6f2fb537d5ead8
SSDEEP 384:uiF1tNn/s3n9SSxsNp8TUNTUlIl6KXXAzX5od+H8ykXmROObjI9G6w7fk:FF1j+9fowgnoONmR29Mfk
TLSH
T10AC21BF258D7987AC99E9747B77E2E128EBCC067B5805A40B3D85B0CCE861BFD305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 00f2b3c37794f4b93c091e31d3517b932a0bcc0e3ac7f451ba89bdcca52118a1
MD5 110e7537027c488d65117a2ab7dc0b89
SHA1 3855fba62d01667e10004dee933f6f393cfd5529
SHA512 615b948f4db9bc9c9177e22110ac995213df7544a8609705332a83cc313383135c21172c10c48d7454f98d3f0ddb2e5f1330593ad4c78d1a9e73391b9959aafa
SSDEEP 384:uiFxtNn/s3n9SSksNz8TUNTUlIlOKYuAzX5od+H8ykXrksvvA4BpPEksPE9YlB8M:FFxj+9uWwg7oONrNY4zB9aut29Mfk
TLSH
T1D6F27CE298C74DBAC59D9BC7A73EAD115ABCC037B0445908B3E46A2CED8B5BFD301815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 609e48a5e1aa1f874d4dae23763ed6c076deb9ab6d5c4cd0a975bb459cd75cb6
MD5 8776825494a103d4576c72efda9343dc
SHA1 dc1832dbb96c9090a8ba3765b7e2c297dc3f6493
SHA512 dc7526dd380cca0704adfa1986bb24157e2dcfb308899d13a0e774394fab323a154f128c45bd6a984426143c8bdbdb1aa62f3e802cb27a31ed1a5a565dc679ae
SSDEEP 192:yONa61VWQmiUyclgGX5Obd+jTjzoryu/a13j+U6:yONa6WjgGX5od+H8y9h+U6
TLSH
T19C02D935A9286CBB8EE2BE49B44737139FE42067EA542B84D6EC1B1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8e1659f5af12fd16922e29537aec8ac353aa94572525c5c60a216267ab94f13f
MD5 d85f5cabdfad9cdb6ccc67e09a68500d
SHA1 789698ce69d9a043f48aa6e3d05f574931388b9f
SHA512 54dcb90005b3a6beea548dab930cb0a56cb5d82ce09cb281e4f9f031d5c1f087bd04d0c7483fdc34828498bd34375a0e1098632c665826a0332ded6954ec1c88
SSDEEP 384:3tNn/s3n9SfsNX6KEGAzX5od+H8ykXuROObjI9G6w7fk:3j+9UGoONuR29Mfk
TLSH
T1F6927D33A8245D774ED3E595B44B36239FF49067A7842F80D1EC6F0D02CB6AC530AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0152cafb5d8d75a5defd6be987942e4818df6b8f22610cdb9d395f54d802f821
MD5 ae70e9a4682366c263df4a53ca9350aa
SHA1 986129e0cc74a33a244373b002ff4c375f68e385
SHA512 bc80ed8d5ef0445459a1b0436b76800b7c75ec74b70867070e0e09375e0e176260d4d83620504308517f11dd4d6c933b0a87ba260839702503c6fe98d6f56125
SSDEEP 192:0ONA61tWQmiUyvlgGX5Obd+jTjzorykX3bjJlq8U6:0ONA6qqgGX5od+H8ykXZRU6
TLSH
T11312FA32A468AC6B5ED2F595B48B32139EA55167EB847F80D6EC1F1C02DF65C230EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a6e97227c0924f56e2df74fc28db369bc7bd5c388e3c2d69323ab38253ca2e36
MD5 7452fd99d807267bcd058d40745aa105
SHA1 0259514dbe6050dbde1ac8a8a77fb99630ad427f
SHA512 39e6618a699dcea8edaf67a68b54e5ed4048cc8e1343acbf04995790fc149e5e04754ea2e840e9227edf909bf74507939e9df29ab3ee50c8a4035c63b54dec70
TLSH
T195E00204D610183EC578133008D31B306AA1804206120205422001797C2170427001C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58659b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58659b.TMP
Size 392B
SHA256 ca8fe93ffcf511eb8d3a568e3c59bdfb93bf629c0b8ebbeb84c43aa7250582fd
MD5 fae1a6c503c4fe2e811c38dd67387a24
SHA1 82f1a7392368345b79c8f2bf6834196cbb49480a
SHA512 2bf43c9f305749c16a4f7f97dc7e2bb7784f4c7790e07630f454c987c093c55423c6ce5372c7d34f08bfe0ea7c416bf9590e9aac65238bf23894fd76bbd1bbbf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 957a43ec1c2f074af05acb9a55611f02df6d4bd7dd5219db58885d3cf7ccf4b5
MD5 774bcd9559d1b9574d66dfc9b30941d9
SHA1 4003d00c1fb384174b329ac87c0ca3b4653f488b
SHA512 7bbfccca058b1d2b09b01ebcf5faeffcceef27ba5b6eed77789492a5e46cf6f8431a6afbc93a94225a2474af985b7779973fbb629bd5fa150eb4ab44cf55eea5
TLSH
T1DA41FA58B6E91148B3B72E5AABF6686E847FB9772F06C45E10110E4F0A23A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

glitch2pcm.wav

Path C:\Users\Admin\AppData\Local\Temp\glitch2pcm.wav
Size 6KB
SHA256 90e3e0fac8083d462471088bd422ff20df6672c07d2d8d4665d03a5f93d7d0fc
MD5 23e1cd34dc48a5df7851e54649a0f892
SHA1 651ff36dc4f7e9d3db7379b19907404a1c1443ba
SHA512 57d08f0737fb8027a1509b7a6d03a95510dd8dc92c8779a5cf76e09d5dcc5bce700b119ad5b862dcf1e4593a95ff8b5591e3cc0f536a626483f7a20baf3abcdb
SSDEEP 192:V0bGoVBhpuR26KpmXmaEuNBl1VwOmrraMhVhgmi6eCN:VA8R23aEil1VOr/hVh/v
TLSH
T1C7E17D8B53686D392267D531A3BFCE9E6E2DF4B18327F7BA2098C1275CC5662C903530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch3pcm.wav

Path C:\Users\Admin\AppData\Local\Temp\glitch3pcm.wav
Size 1KB
SHA256 0b40b129efa7ccc3941f3e5163ed07883a2b9a7fc5dfb5efc23818b1a2f4f48d
MD5 550fad71629a333c7169473e09dbfd36
SHA1 a94584d42772d094ae716f4704c2982dedee932c
SHA512 d42a9de9a2bfc79594b37ec771b1b9f0830ab4816bfb47fbf96f84fe193b211cfd107ff1b27e08ff0591b07bc25b849e861da54f8f9cf2b4a7405a8994a4ca96
TLSH
T144416EA9C3904F22CF1F9F3811376B2259B3BD51FF4EFB166C0976152E63AE1460502A
MD5 SHA1 SHA512 TLSH

Submit Download

glitch4pcm.wav

Path C:\Users\Admin\AppData\Local\Temp\glitch4pcm.wav
Size 5KB
SHA256 aafb5595899c98e6faf92590cb7367ecc82d122ccfb9587168e2b4d1abfefb48
MD5 f885d017b9103d7b0762e343ed6ba54c
SHA1 748197c413f0635d7198461810fe7a39b6246e6b
SHA512 a119b65f2667a53d22fd238e1f54ebade69b0727733bc6e811caeb1fb9ffc8c9dbf997f45ade598d0e3141b38b3f44f741e04dbc0bd5215027b77cf1ca636395
SSDEEP 96:3bxhd0h7z0lk8ZYjC3qXx0kXL7uRY7j8MJLPkSRxHkdcM3QnKTlX:3FjosqZmRY7j8MJoSRxHkdt3z
TLSH
T147C128037B08EF82F15DA6F54C9E3B095BB0E56337131BCB96400634BC681DA2F666D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitchpcm.wav

Path C:\Users\Admin\AppData\Local\Temp\glitchpcm.wav
Size 21KB
SHA256 51682d617603883c106d3dd435f819d150f7922b0999f60a65248ee983045695
MD5 1a61882b77969dc665281d970b4e29bd
SHA1 1699ef7deabdd4fcc9c877769849ad4a0275009e
SHA512 29308886961db30b8f0f8ac2f887fff1aa1406b7ce45f1221796ef8db044437f5cc4bd31cbfa3ff58407014892ea6f581ea9cc23e8952478e7ad791a280b5480
SSDEEP 384:Zf01HAbjZo2bG+M9t3HLsb1G2xdhddZ9coFbGnlKHJd:J01HpUm3HI1G+rPvcoFCnlan
TLSH
T16BA2BF1A17CD6716EF9816768F07C73207ACAC9C74A419A3B6E01CABBEFD4432C1E154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clutt4.5-safety.exe.crdownload

Path C:\Users\Admin\Downloads\Clutt4.5-safety.exe.crdownload
Size 3.1MB
SHA256 74b17884ac61a6beda8e525232ee581640c9f6d21dd99450162ac7df10b5796e
MD5 074469c21d2a9581ecbd90d7938484ca
SHA1 6cf93280c749cffe98339ce9f7f3ba12c16d4739
SHA512 b074e0b63b24e6e9d7b51680eff0245ba2b0d797421381a42f5ad00e60cbed23d4baf9f88defcaec64b3d1c60ef69b43d0ea92402b95d8cfe22a180732097ee7
SSDEEP 98304:KMK0UsBDvRmvpLICugLPdGf9N+lUDMK0UsBDvRmvpLICugLPdGf9N+5K2:k0UCvNMPcz+eL0UCvNMPcz+Q2
TLSH
T187E53B23F24777C9C8228A3357F5D1E4B686E628EB865A08907ADE3374B2115E5173FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dead Fish-GDIOnly.exe

Path C:\Users\Admin\Downloads\Dead Fish-GDIOnly.exe
Size 127KB
SHA256 415e6d4f552423bb7f28d2a535e9963295562393f470c63d4086fb0faa237752
MD5 c50b7a75006047d5288a3ea5dfc967d7
SHA1 a3fec3dfc2047dc827ae5a991e2d9be7741b7083
SHA512 d121d355be6e4249482aba04ccfe7824551c3e45a7e6d6870e9bc2342e7ce8c323b4958f84d9b1f8758a2f9a4bbc33cb6f4bfb1de83d35f13c0dd57a2cd51883
SSDEEP 768:kTRDMW1Ugkw4Pr1UK3ubIqHTbNu4KQcEA6rFNPjB4VROyKHbgr7a82H8ti8tYcFX:e9s/yTMPYrFXaRSbAls80AmVcl
TLSH
T18FD34AB2B294D152C56800B94C76D7E883F9BE33AC12B7633CC8F7AE6B756564202747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Holzer-safety.exe

Path C:\Users\Admin\Downloads\Holzer-safety.exe
Size 133KB
SHA256 933ff2091575b19eb0a48a7ae9785644aac73a4cd28c5fdd8b36017ab75bb00d
MD5 fbd61725e4140530e3e883d09329944c
SHA1 02d8a39994248e69a37dd5d6bcf98481544f8860
SHA512 2a1f0fd8ef0258c0c00a18082fdf45ec3916f15dbb09ec39b5d3b72144368bb02894a4f04ffb14475eb0c77ac3b7709ede062d87b888b2f83ca0e2aecf2b1090
SSDEEP 3072:yjAQNTa0ln/cg6/6joeCOyuIyDFnTTTTTHvvvvv9A7l:yBNrlU32Bhyl
TLSH
T171D36D50F4D1D873E23349302C74EAA58E5CBDA49F108DBB32D4772E0A791D25A36DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hydroxide.peaceful.exe

Path C:\Users\Admin\Downloads\Hydroxide.peaceful.exe
Size 115KB
SHA256 8f381babb1c97648e2a4aec0fcdd7402d81af63b1b8c5f4fec4c242c26b340ef
MD5 d716710002f94a95a180dcb914464a4a
SHA1 3f85dab492833d636423926baee023a8f9306d14
SHA512 f78aa110e65c767330693d636c8032e9a6103c43bed1c268d50d6885c2a60e85dc2953031555ea918cfe49de58d786e3c0787ce3df18586803839f8db4903071
SSDEEP 3072:JCHkAHc8MeqWbsOtn7xKEqqXNUbbMBNPouxP7V:UTHLMobP6wCnENh
TLSH
T19BC38D00B4C2D472D5B5483558B5EAB64A3EFE310F204EFB37A81A2E4F741D06977A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3168-1075-0x00000000006E0000-0x00000000009F8000-memory.dmp

Download

memory/5376-1088-0x00000000000F0000-0x0000000000116000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads