hxxps://github[.]com/pankoza2-pl/MalwareDatabase-6

Analysis

user interaction
yes
max time kernel
305s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/pankoza2-pl/MalwareDatabase-6
Sample260706-bdpptacx2m

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
147	4392	msedge.exe
147	4392	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
5004	PankozaWeb.exe
2008	Beryllium.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
39	camo.githubusercontent.com
107	raw.githubusercontent.com
108	raw.githubusercontent.com
146	raw.githubusercontent.com
147	raw.githubusercontent.com
40	camo.githubusercontent.com
41	camo.githubusercontent.com
42	camo.githubusercontent.com
43	camo.githubusercontent.com
44	camo.githubusercontent.com
105	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Beryllium.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PankozaWeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277733271375350"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{0C5B1BDB-9F91-443A-90F6-28A0FFDF118F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2008	Beryllium.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5004	PankozaWeb.exe
5004	PankozaWeb.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2244	4800	msedge.exe	86
PID 4800 wrote to memory of 4412	4800	msedge.exe	87
PID 4800 wrote to memory of 4392	4800	msedge.exe	88
PID 4800 wrote to memory of 4412	4800	msedge.exe	87
PID 4800 wrote to memory of 4412	4800	msedge.exe	87
PID 4800 wrote to memory of 836	4800	msedge.exe	89
PID 4800 wrote to memory of 836	4800	msedge.exe	89
PID 4800 wrote to memory of 732	4800	msedge.exe	91
PID 4800 wrote to memory of 732	4800	msedge.exe	91
PID 4800 wrote to memory of 4488	4800	msedge.exe	92
PID 4800 wrote to memory of 732	4800	msedge.exe	91
PID 4800 wrote to memory of 4488	4800	msedge.exe	92
PID 4800 wrote to memory of 4488	4800	msedge.exe	92
PID 4800 wrote to memory of 2476	4800	msedge.exe	93
PID 4800 wrote to memory of 2476	4800	msedge.exe	93
PID 4800 wrote to memory of 1500	4800	msedge.exe	94
PID 4800 wrote to memory of 2476	4800	msedge.exe	93
PID 4800 wrote to memory of 1500	4800	msedge.exe	94
PID 4800 wrote to memory of 1500	4800	msedge.exe	94
PID 4800 wrote to memory of 4996	4800	msedge.exe	98
PID 4800 wrote to memory of 764	4800	msedge.exe	99
PID 4800 wrote to memory of 4996	4800	msedge.exe	98
PID 4800 wrote to memory of 764	4800	msedge.exe	99
PID 4800 wrote to memory of 3204	4800	msedge.exe	101
PID 4800 wrote to memory of 2024	4800	msedge.exe	114
PID 4800 wrote to memory of 832	4800	msedge.exe	115
PID 4800 wrote to memory of 4168	4800	msedge.exe	116
PID 4800 wrote to memory of 636	4800	msedge.exe	117
PID 4800 wrote to memory of 636	4800	msedge.exe	117
PID 4800 wrote to memory of 636	4800	msedge.exe	117
PID 4800 wrote to memory of 2196	4800	msedge.exe	118
PID 4800 wrote to memory of 4552	4800	msedge.exe	119
PID 4800 wrote to memory of 2196	4800	msedge.exe	118
PID 4800 wrote to memory of 2196	4800	msedge.exe	118
PID 4800 wrote to memory of 4552	4800	msedge.exe	119
PID 4800 wrote to memory of 4672	4800	msedge.exe	120
PID 4800 wrote to memory of 3784	4800	msedge.exe	123
PID 4800 wrote to memory of 3784	4800	msedge.exe	123
PID 4800 wrote to memory of 4808	4800	msedge.exe	126
PID 4800 wrote to memory of 4808	4800	msedge.exe	126
PID 4800 wrote to memory of 4808	4800	msedge.exe	126
PID 4800 wrote to memory of 4348	4800	msedge.exe	127
PID 4800 wrote to memory of 4280	4800	msedge.exe	128
PID 4800 wrote to memory of 4280	4800	msedge.exe	128
PID 4800 wrote to memory of 5004	4800	msedge.exe	129
PID 4800 wrote to memory of 2628	4800	msedge.exe	132
PID 4800 wrote to memory of 4688	4800	msedge.exe	133
PID 4800 wrote to memory of 4688	4800	msedge.exe	133
PID 4800 wrote to memory of 4688	4800	msedge.exe	133
PID 4800 wrote to memory of 4848	4800	msedge.exe	134
PID 4800 wrote to memory of 4436	4800	msedge.exe	135
PID 4800 wrote to memory of 4436	4800	msedge.exe	135
PID 4800 wrote to memory of 2008	4800	msedge.exe	136
PID 4800 wrote to memory of 1032	4800	msedge.exe	139
PID 4800 wrote to memory of 1500	4800	msedge.exe	138
PID 4800 wrote to memory of 1032	4800	msedge.exe	139
PID 4800 wrote to memory of 1500	4800	msedge.exe	138
PID 4800 wrote to memory of 3888	4800	msedge.exe	140
PID 4800 wrote to memory of 3888	4800	msedge.exe	140
PID 4800 wrote to memory of 3132	4800	msedge.exe	141
PID 4800 wrote to memory of 3132	4800	msedge.exe	141
PID 4800 wrote to memory of 3804	4800	msedge.exe	142
PID 4800 wrote to memory of 3804	4800	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/MalwareDatabase-6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffef85fc188,0x7ffef85fc194,0x7ffef85fc1a0
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6122116525460391711,3138571911488945939,262144 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,10743250918501699324,13330050725276520187,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,18171440504778225675,11301743733762514000,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12272937527065533651,14494166535163173991,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5281089195429381525,11551866417973442616,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,3414907814732249759,4180293490392458063,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,4751813719107610663,137227386922083388,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7236176072973511667,12296957117540467354,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13516926248240385521,4851631463820643150,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,9826539968461092382,877011765096233940,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,9826539968461092382,877011765096233940,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,16863947881657582303,2158834825666088839,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,517862232337248484,6114384648530727810,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,16170593383265940241,13040856510426917641,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2980,i,12873912209723259317,15108638951900797460,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4340,i,1550945908794357992,16018204700224011513,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,10199845742188206025,2334387705621118471,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,1943816417906347303,15990419344494941909,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,17228999516820238551,13241857123345398884,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5584,i,771542935603303617,2018438834067856707,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,5248124790398867975,14541884240937362162,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,4155313145934937401,14956643054993725498,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4280
- C:\Users\Admin\Downloads\PankozaWeb.exe
  "C:\Users\Admin\Downloads\PankozaWeb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,7548428223480529612,8540247187000006316,262144 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3432,i,10966753454293401910,13368215865822916160,2097152 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,6871981523011705491,15334153638847690829,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,10515856899623792274,3272576582596531254,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:4436
- C:\Users\Admin\Downloads\Beryllium.exe
  "C:\Users\Admin\Downloads\Beryllium.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5988330695891688626,4964093658668113411,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,395207395100774899,11309930405479715071,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,16266684566330558467,8633031331159001752,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,10619676685749335125,15515935954579209046,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,11021887514065143061,2592213186135395392,524288 --field-trial-handle=2236,i,17520116732755214125,12924294731807694145,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2296

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x33c
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84c6c38a-03a6-42a2-a32d-81970e8b26de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84c6c38a-03a6-42a2-a32d-81970e8b26de.tmp
Size 392B
SHA256 ab1da36397d18872e12d216123beb72571fc1c81fb8c2321df8f4938b0d9db47
MD5 a07592d67eae041cb28b62b830b3c68c
SHA1 851da0bd38705313c2c11896dbe6b58ade5fe7f2
SHA512 478ecb3c0de8dd346f713169de559688d1f5b548fbf8ab372d09fec94a99d81fff328495cc21b195376eef52e41041aa743bcb6e52f5e9fdf7dee73cc7fc37d4
TLSH
T161E00903E75001BED4790B3821932F322EA2C02406A2120B4B30026C7C323A83F24AD0
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 5def5ab730ae009dcfa1e83a57334c39729025501819f439da714348fb895130
MD5 84012e18de6054de1453b97703fd2f5d
SHA1 3d146e8f573cf13cad2cd19206eb1b6f032c616e
SHA512 35c07bbafb8b47d9c9e1254c1978003193d422ca4cd9aa3223878ceca57e0c0fb9db8f947fb5d554beaf290232292d69042dc0aca8176d68da90ec283b6d5484
TLSH
T176E0D8B91394C1E4A10AA487C0DC631559D6F13BDB4C849FBACC789D64610006F486EC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 36e7038bddf2f009c6bbe7b8c2e9e40d6cff245fe8fac5ffbd7932f1d15a8337
MD5 6f777a1db1f2821dab5dbfc1b377ec31
SHA1 40afcb216a764d55b5d4cd8fbf944d9002f66ec6
SHA512 70b00fd75d8a63a70ccf216bf9f8a91bea33731aa1a9fcc0ebd610b4bcc9a7a9023d15fcae2b7e4b59e935b520093c34b5e616c929ac6571fe223ac497e2f1f4
SSDEEP 96:eW/PcZaHl9lTv11KMCaulhUNtOzmafsMQz:Dc4Hl98MjM2ezzfsT
TLSH
T1F6D118F58F0A84E7E7A0423360F2C427743C89DBF003EEF741A0AA76C7A5312C299842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 9b5314b445f6a356e3d869c7492f8a711c88da7ede71d2a82171b81adc223238
MD5 c694c1aacc2f108c6e84a3a28b4ef861
SHA1 5f56857c4e4811c956ceecf91e8a38a4ed9ec4da
SHA512 d3d8437051fc7f2d8de7a11100622dfd99e6c476013a5e05e4e50393a611b628c09af8e0b5f954c36db43c573d9350b373f4fe8bf1b2db72bbb7e89b1f805770
SSDEEP 96:bRQtVs5CxahPaPmvAGv7zbKspaDl2o5yeiO2gxqB30AhbAxr7z+:bw6CQhPaPUKF5vy7qAh+r+
TLSH
T177F1A7BE9A1A44A3D790423351F2D213793C8DDBF003EDB741F07A769B95F1281AD952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 edccc200f507df1a2f19fb65884b8b492b0827a3216d1d7fbc3569c3b6949f8c
MD5 ecc6c5c196b7d2771cca9b2dbb5bf15f
SHA1 84b4bd8308e544b1a59a6591d1bd3508e12f2a55
SHA512 71c684c2c4108a1e46b7212ad48255e8a8fc4a6851ae5f55fad0fb751c905e47dc56fde046207aae547d05eca6fc510589af1ce2254a73ec32ac8792e12d8b9d
SSDEEP 96:aCQtEs5CxaBaKmvAGvjzbKspaxluo5yeiOu5+qqfkhbAxr7f4:axDCQBaKMKFXnyRqkh+rD4
TLSH
T170F1A5BE9A0A44A3D790523351F2E623753C49CBF003EEB701F0B6729F95F1281AD952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 129b7f75506c0724ae07f316013545b51c61e0da34490200c1cc2b7ee745d407
MD5 a2df133cd2514b427d461784cfd2d678
SHA1 4021acc548f790c0b2ee600fe04981596cb3834d
SHA512 c706d51ea944a740b3f78a1b0e374a4bf19a4f5d75b4f2fb82228bdc2ed40fc041f1bf65242d0c443f0e5b9b2613166a971672ac1d67ddb6b41bcb1c9cf19c88
SSDEEP 96:lAQtEs5CxaBa4mvAGvjzbKspayluo5yeiO25+qqfkhbAxr734:lzDCQBa4MKFYnyJqkh+rr4
TLSH
T12CF1A6BE9A0A44A3D790523351F2E623753C49CBF003EEB701F0B6729F95F1281AD952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d731.TMP
Size 3KB
SHA256 47dfb537bc58f7cb297b0519d768e05da708843fbcaec4eb97716d4f225df36e
MD5 91644f47b59fa06c8f1c5d99faa4e2b0
SHA1 87c1ee9fabf6e9d9113d80435617548c033b6e52
SHA512 c30af21a7e29677c941da3de5bfd7d0c31239f572431b274b06f6ba86a80a7a07898c94a561ad9ee4b056a3d2c163933512747258fe2396dd9ded6cad4617209
TLSH
T17E713A39C50E48A5E7D1133291E10157B83D82CBF803FE8552A0BBB717E4713868EC87
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 143KB
SHA256 07a4204873224210239264ea7004e07c6385345b841410ea75ab0ca204ddd9aa
MD5 75ae23b5f65baa8934dab30470a2ef04
SHA1 8517eeae01333ab4205a231b3cf62933b38a84f0
SHA512 2cabee249f2727251bd2e2271820c6d6fab082d5f02059607f80d0debdf995f815dcf38721990357446afd81bbbd29a6dd61f1dae60fcb3e6fad28c5c9f0dd34
SSDEEP 384:+pCMM1qdumP7uAyLfxbnTAVscToaqHgqAbhnumRK0EiXuVF2vER/GM7sLzEHX8Sb:vRaocmR/gjanrJfUSlzquf
TLSH
T1E9E34F5C76F81C178FBF595F3CF63E18C826F102E5845C582112AF2A52A6EB2B14FA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 84107080b4159d666d63aff7790c47e71c5cc8d0f3db59705df2530d5372bff9
MD5 e6d91c8b76e057052ea121e17b409341
SHA1 29d49cc8459453c5137124e636549ae02bfb0126
SHA512 e79d2bba7056d7815784dae0d6186b5215442ccec9d7ff3cc4297bbfb1b347b32b6d83832d61188e2b4b1f0ca6b3e0ca7a04dfb2c3998130f3d7642a37f4268c
TLSH
T147E0D8BC85C9C15B6614649685AC7B0A96A3650BD7886D8D8F99CC24F482044AAAF2D2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 852c0949bc575a9429d82161b8d536db82fd416e0cba313001513e3e8c255943
MD5 8720f7c286e8d63687e540fdd638a1b0
SHA1 5c218f85039bb184248fd1b54e1d6c144d617b6b
SHA512 fb0ea1afe3c3ccb09550ce1317a898052107ac36bc9fb39dc550b283fdfb73d01d303cbea5298da76b52c91a2f798cd85e8d93177d221efde31cff1c39ce3ef1
TLSH
T1144138F787E2956E9E1259F0AA18EE1BCE2C0611831C786985E0BE57D3E3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f29ed900b5ffdcff1e5244d64faf34d0d03d1543682fdd5195f0ed60ebdd1303
MD5 499570ba832708cd7fbf905bac5b13bd
SHA1 69deb36776059c5fb081ce7b8b836f81943f0511
SHA512 9cb9be791250a01a309e80b6501fa7cd9209a6ba3c89e5b4f5b3890b4441efbe44723f81da44bcd2b7dd6593c849a26edb0959193f858b872f9c1b855cff2cea
TLSH
T1715138F747E2956D9B1259F0AA18EE1BCE2C0511831C786985E0BE57D3E3872E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 edcf7d2d4a860ff0fc5ff22f9557a6c2f08194c652f3a821aec4aa0787b40ce6
MD5 bdfc7cec85c2b94bef82aeaa8c8d4329
SHA1 00568dd2dbfd38b1fa3435821ca60629ff19dae2
SHA512 235ae114cc67d591fdbdfeafa9bf32ee95804951bfd618e4d57e8bd4d98a6cbeab2ead58d10dfdd1b48b4618f5f66055807f43f0374f392f52e7b2df64846c0f
TLSH
T1A75138F747E2956D9B1299F0AA18EE1BCE2C0511831C786985E0BE57D3E3871E102B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a0e5f04b7afa88301b847a42efbd9239085fe5e89059b6f49005565489b07d5f
MD5 12e03a1c48ede2352be268fadce51253
SHA1 a21f4eacf858b9407cb42738d796a804a87ede6e
SHA512 302ae85487c0130cde2ef6d03031787d83cfd40dbc1fb8ebf65ef3da4d6ed5ae2f7e6570df462e0594510f8f7cce5d6b112d4d544a2c9f2f4aa5fb1d1f7dc275
SSDEEP 192:sxZuRLyM/jK1Ml8MkG/f4sxkwKvIdp96VHW6+WNYKx/YzCG9PIgrJ:sxZu9MG/f4sxnNoHbz/o9
TLSH
T14B52DA526A38997BCCDBD309FA55BB53D6F50472D2940D48AAFC8A0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 79b3f4f152f6b163d84451bff150f36825d06ed4ddc54050e635c196bb1ab27c
MD5 3b4a80c0b03664e2bc1603a11a61fc62
SHA1 1fc3cabde6b70cc98449626231d6924eff0a86c5
SHA512 8bce4b29dce82bb43840caeba0031c196b8136a6ca21b40ce411f85bee04e2d74223c0917056590e118d62ddeb62cef1cc261784d1435bb3d64c8eae1f02b94a
SSDEEP 192:sxZuRLyM/jK1Ml8UQz9G/f4s1k/YEvIdpv6GHW6+WNYgnXYzgf9PIg5xJ:sxZu9qBG/f4s1QYjFHbjXnN
TLSH
T1E062EB526A34997BCCDBD20DFA55BF53D6F5146293900E48AAFC8A0C01E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f203290f68121eb9149aafc59c5fe553ae2706881b7ca6862a51d3ccf08b00ec
MD5 4d8849fadfefd248646fe3ba780409ff
SHA1 6d4dc2f042af93aa1ff523720421ebb955b449a0
SHA512 692281ec086eb2fee9eeba748f1295e06297106852648db9ce4d707e0498f78f4d64fce9c33bf2f8c76c6ccdb3d2ecbc21931edf2d30cd6bc23d4de617486b57
SSDEEP 192:sxZuRLyM/jK1Ml8M9G/f4s1k/KvIdp96VHW6+WNYS5ZYzuf9PIg5xJ:sxZu91G/f4s1QNoHbvZ1N
TLSH
T15552D9526E38597BCCDBD20DFA55BB53D6F5146292900E48AAFC8A1C01E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b5af80931fb7325caf2be2ab15a2d95f2ce592dd3098d65b228321361427546e
MD5 74d647129f5c8483572acdd9568a5cb3
SHA1 1af0ac8fdff566141affe3773fb4539c3520fafb
SHA512 a0ce60d1b48986fd2307b9bd5766f718799b645b96c7bc1d0d4eabdfa2c2ba744d2d87cb56570638b20a569222612f6f2364c7e46a694a390df2fd88a12d4501
SSDEEP 192:sxZuRLyM/jK1Ml8UQzjG/f4s1k/VvIdpv6iHW6+WNYgnXYzgm9PIg5xJ:sxZu9qXG/f4s1QidHbjX+N
TLSH
T1C962EA526A34997BDCDBD20DFA51BB53D6F5146293900E48AAFC8A0C01E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 04e107d797e1147ceb0850609790d93d01c79cd5a95b16824ad50e33b77fa8e2
MD5 fda46ce2ee26ea17d82a58c728eecd1b
SHA1 167a9e0349dd69ad463b18059d53585a9010a4c0
SHA512 9ebafc873a89aeb6de7c7fd331c7ba9424c7d51dca6a0f21238a9706c94c4bc892fbd433ef67c5aa19a955d02008c27803cd069e7cdaf24e39e4917297432abe
SSDEEP 768:1gW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjuroI+i1YI:1gW7kf0Wvqidau1jaa5LA3jlzI
TLSH
T143D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 37940f3ee51913e88039ac1edf7cd5532f69d8d68dade2a93cc4f2045b4bd8fd
MD5 b3046a6764fd2853a56745131ac80f0d
SHA1 4c1ba5134356ddc29b01333dc89cfd6b4572c915
SHA512 5d5b414432c5ff3875c69f535a9fe2fc08da3ba9d29c00c5b857afe20c85c32e976daecb3599f7788fdc7f7ef8db4ebbfc11b648b6813ad47be85ef2304aa82b
TLSH
T11531818A8E80D56FEAA488F114B760E433B0C5CD032262938C3C363A3C2736A1E4B18C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf564.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cf564.TMP
Size 1KB
SHA256 baa626524c4207353ee683e6ecd5e9f0826d5ad33d96b2654a7a05f99cce7e84
MD5 571cb21af153496616e4e4d47b8e44c3
SHA1 e773f165b1c50cc35e2200eefaa0aff1d25ce7b9
SHA512 16e5eca32a2aa4206211ec38e89f224b0983b81ab7541f3c7694b4e850f61a240539d6c41e60dccabbca6696c404d23734fa515dceac04d6fb5589cdb43a1e83
TLSH
T13731938B8A418A0FE8D401720993A4B83379C9405322B78798BC663DBC757BD1E5F1D8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 41faf5ad85f2b2a03ecfd6b98a3b6dfebd4c27889a8ab1d0e8c56b05323cec8c
MD5 45ba5e9324cb9b7cf25a453745257293
SHA1 4d439934d637adffda3c050d15c8a0c3fb65cec5
SHA512 b149986348038fb340f9d048ee7a2c9f9fa05213efe6f29eef5ad057e12ee4634b67056aeaa89a4faa1d701f7c4c0caada5c889ee44b978f6ddfb7b1ec53b90a
SSDEEP 96:KIbCKcWVce7KKcE2WBiKC4SS3eyEkUyW8pBgiyKJ:sWVc5BVBS3eyEkUN8piif
TLSH
T15491521EB23A1201387D6C98B1AF86675F437293311464AF3FB854A70E66E114EFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594155.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594155.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4b0cacbc8e7dac6c492e931fddf9afff994798f698c7da8115109638f5a45179
MD5 e90ed6162453ec9125d38f54dd387cc7
SHA1 04edd2c85431817cc27c9bc99b15ebae090f0fc3
SHA512 08e3514ca7980aef003784c9d81cc494c1556f46ee507801c4f9c0fc99111ef601b321e977a1904ea668efda8075773e507ebed28acbfc7d078817eb40014f06
SSDEEP 384:ZtNn/s3n9SfsNb60bbarzd5L+2YFFO6AV5XMlfK:Zj+9UKqnrlYFFTAV5XwK
TLSH
T13B928D312C399D6A4DA2A555F54A3B078FF485ABA3C11F48EAFCAF0D02DF7AC1316905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ce3e71c6e8984a5dcb13d041d780250ccc5c37c2a3565005fa72869da0c6f7cf
MD5 43f5715847bb70287ba3da1e5dc95889
SHA1 36afb7f70c3d54310e2a6960294c3b3bba8be2d6
SHA512 e628a9d4bdce9bddd85033534d769951929e267fb7020cc220ee5d4f4e42d945c9b6ee053fa89338bebcf0f6362ca3d7c708f3e74dff503d9406708f1bd313b5
SSDEEP 384:biFetNn/s3n9SscsNG8TUNTUlIln0bywrzd5L+2zFFO6AV5XMlfK:2Fej+9cNwgy/nrlzFFTAV5XwK
TLSH
T1DAC22AF218D78936D99E5B47F77D2E028EBCC197B6815A54B7989A0CCD872BFC306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f60aa9d74e22d576fe068e2c4e3e94d3d5450c3fb86563b0f61ea2f9f8173010
MD5 3ffb017c2328795345d9719764274026
SHA1 fa867ea739eecd4f9a631242839c233064f40c8e
SHA512 d1a948fa75a23339ae8c9dc140fa2abaa286802d58fd3f04e47a954e5e451093aa0b83f9a0fa516aa24d2486ea69572ff368de26136caa29f24f95b5bde9b895
SSDEEP 384:biFKtNn/s3n9SsCsNl8TUNTUlIln0b6wrzd5L+2ZFFO6AV5XMlfK:2FKj+9CIwgy/nrlZFFTAV5XwK
TLSH
T165C22AF218D7893AD99E5B47F77D2E028EBCC157B6815A44B7989A0CCD872BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bd9a21496b5fed9dfea0e8414564907abbf0a3f44ae2729bf93f8b3aea7d1d78
MD5 de23b9abde96cece0d792692b1e5cf0d
SHA1 f458d9491b89d5c6da196efddb645a40661f30b9
SHA512 d5cca47abb38c0023fa8e982402b758bfa23d60b9e523633f8e572d0aa177a6ad1b222cc6b9b6a1d09b675d76c72075165f004c62a718f0ca3ba03e495136eaf
SSDEEP 384:htNn/s3n9S4csNbn0bJarzd5L+2YFFO6AV5XMlfK:hj+9UTEnrlYFFTAV5XwK
TLSH
T162929D312C3A9D664DA2A549F54A3B078FF4859BA3C11F48E6FCAF0D02DF7AC1316905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e2c59a6131a5cd2b76e5423b2beaf1e5b2d5dc2696340fda48113a5b92996588
MD5 a515c88cc8518b35098e9a03466b811c
SHA1 d38ead5e7597de17ef3ab85eb781594f045d202e
SHA512 ce6e53c990b3fde64b939746c20e1ddbd6023c65ac0d23c3a4a4a5f58baf19272765e44bba69f129449b12c2acfe2a54e1f268b93714657ae21d90988d645dca
SSDEEP 384:ItNn/s3n9SusNbn0b6arzd5L+2CFFO6AV5XMlfK:Ij+9tTZnrlCFFTAV5XwK
TLSH
T1B9929D312C3A9D6649A2A555F54A3B078FF485ABA3C51F48EAFCAF0D02CB7AC1316905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae10f57e4bdda08ec7de95d798a55addc47aca4e464e0a45d9c372e32baa9168
MD5 7c79dcb423de115ddae8470bfbaf760b
SHA1 7bee7a7a77830b4c36b916b9a94f9b326105389d
SHA512 19b4b22c998162f04f765a8a9c2e9fb8e705381769ad4a116e8a1b15d16686a489a954947bbaa61cb6721f1919da53afdb19406b0456f92dfccbe395957051fa
SSDEEP 192:MONT64BAQmiUyF1EW5GBPKRV+FdGy5LaDQvPSU6:MONT6eAa+Wcd56MSU6
TLSH
T1AA0209396C786C6B9EB2AE45F58637175FA8107BE6905B44EAE86B0C00D764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 978e6c95a45fc5e6c71908cd8230259312a4a4aa44dff49ca98c904f30779018
MD5 30ec917d442b0a97caac4e1f6bd4ce59
SHA1 b47555dd7585bcf9f63ab9335aef7626a1b9a2fd
SHA512 092bd186fdffe44ad3f151faf0ce6c3786d24c5292f12f1de760545ef544319a3f9c55f96b8898db7173926e87bfa4d9312fbc0a94810e26f11b2c4534c25b66
SSDEEP 192:AON+64BDQmiUydEp5GBPKRV+FdGy5gk+2QWwWq5U6:AON+6e1zpcd5L+22FU6
TLSH
T138122B369C78AC2B5EA2B545F48736135FA9422BEBC46B44F6EC6B0C01DF6AC2306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2e8589fd6c9810ced069f498f9b7bbf109017b55742d12e2bd94f048da00540e
MD5 c4abf4ea12b627d707622184d9f06535
SHA1 4d3af385e5f2d21f8d5b99b0f194f98e6fe81ae4
SHA512 e8259831b6c01180c47cbbc75dcac0915b2b394ff1ffbed0ede55b61ee97f3738ad585351f0fedee6a106a87245bc19c8ee62b1fc272cd1afa3caed9fb61b156
SSDEEP 384:biF+tNn/s3n9Ss9sNG8TUNTUlIln0bBwrzd5L+26FFO6AV5XMlfK:2F+j+99Nwgy+nrl6FFTAV5XwK
TLSH
T16AC22AF218E78936D99E5B47F77D2E028EBCC197B6815A44B7985A0CCD872BFC306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a7d04339b4a3b84367de75ca0ad7208c4fe64a46ecd0bc33233c9f64a9772160
MD5 f039ef88aac67a0d747cde01263488c7
SHA1 9a81425ae10c354a4327ea2650fd48aefc631f9b
SHA512 ddba1a1719a6908f24a2888f9ef656df164260e52a3987dbcb98b3cc425a1045eb74f3d1d70dd8e74d6087bdbc10cb86c149c6eed405972a6fb2992892de36ae
TLSH
T171E00103E750017AD4390A3811831B322A91801406A2120A472001587C223642B24AD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f54e283a28449207ccd577f8afec1fda39a9849bb278de19dfcf754a46d4693
MD5 431e78bd1b0317fb553a45f2028521e0
SHA1 9c5cb0b1540d8fae501829f7d6f04b7d724e9bd9
SHA512 4ee87744eebeb737edd6ba98dbd6437fe53a2373c3ee18d2ab7a226033989cd605b01f8255a77b3d2ebde3532f2fb56c17003a38103a02535c2e2b6b8ee21663
TLSH
T1ACE00203A7500179D43D0A3411831B313BD1801406E2030A472001587C223603B34ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5baa47687cb2af987d468d3d0a2f417e1b938cad69f37a7f06836681224fc20f
MD5 e626dc57c19b9578dfee4f08071312ef
SHA1 d3e4c3ebff2e129b6a287226e3bc4f9559a5cfd5
SHA512 974f44d5d1440d505ac5d2bd1f24b281e99ae7be385c3aecf399f1e32ae3cc8a0e5708006056f3bd69f346a66fb33931fd011a8f67375956eead350c59ab39a5
TLSH
T111E00813A75005AAD469273451971F322EA6912447A212474B30416C7C363953F25AD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c50c90714bdc451f1168d3d99beecd6d79a19cd74b3b3e2f627f37d5e7d234f9
MD5 f5e88f5f7472648f6ca27bab178ad4e6
SHA1 ea3b559270e62a1976280d4444f78c7240b11f8e
SHA512 74f536a2666486211254bec93f997daf2e186061e3cf09437ec5bdce4b6c5e7a92da59438f556693c2f6270cc7ba7a784edf0abbf2f55a68674f9bbefed49db6
TLSH
T1F9E00913E75001BED4B92B3861A32F322EA6C03407A313478B30026C7C323993F26AD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 468d978797fa2829dd19e9a990c352cd9de7fec106bcac9faa95e7bb889f1fa8
MD5 3ddfd5954820f91d1f396f840a90289d
SHA1 716d8153424a02e008c327c19098a61e52b3c138
SHA512 54d8ab6e4092ba994a34177779631e6bcb503a4764e9ad7fe8c7e454c7efb229493de022dda26f7852b3362d0d22976c213518a974d5560131f34813faefa381
TLSH
T1ABE0040377100174D43D05341143173133C3C03505F1030F4D1001447C031301734FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b7f25c7becce1af386aac8f24838d4357f79cf2d6b428770cd4f61c332ea9a18
MD5 35dd656fa51a7ba0040ead7b81b379e8
SHA1 8a6ae499c36bf8d81cd88a48a4eaf1d8a394b8fd
SHA512 fb650749120002d2cb27f5b11b88b09c08d293a8a09dfb86456ed59514db5635a2de13031f52490e0d0a5379676e30a6b99cd9b7d76acda54df32715d3cb5f09
TLSH
T10CE00103E75001BED43D0A3821832F322A92802406E2120A4B30015C7C223643F34ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58ab6e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ab6e.TMP
Size 392B
SHA256 c00277d7b28a7b337560f7fec9974940dad311d6bdf02ee8fb3f2b08a7685fd3
MD5 ab715a4a2f33705213706345029aa0ff
SHA1 d8c22cca761f8f7ce35e3b9475599b99ab713567
SHA512 175468e043c256ce879f9f1c8837256bff74447b8cf58016d53e2d90c4c085587c4d50a027742ddb953eb7dbf7cae98dc52c63a1574797f1c542bbdafa7a9555
MD5 SHA1 SHA512

Submit Download

bccec541-953b-4cb9-879b-a7ad5dd14809.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bccec541-953b-4cb9-879b-a7ad5dd14809.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b0787dcaf1e3f3778ac53f2a1f9fa2b0de7f353b3889f083aea2bbefc14aa87f
MD5 86751e3ea189a05592e834f71f3a2f66
SHA1 2f748998681528b865290cb73779c1739a2007b9
SHA512 8de6fcf31ea10d2e09baf34240d45256b9255cf9c978868bfc9a53259b116e2caa350279765c77cbe87039efb844b8131affcdb5a5dcbf8c90b91eccd7f7ca0c
TLSH
T12F413859BAFA1148B3736E1A9BF6A86D487BB9333F06D46D00110D4E4A23E00DDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

3154a3ac-416e-4cc7-9714-b02d4f79a0d9.tmp

Path C:\Users\Admin\Downloads\3154a3ac-416e-4cc7-9714-b02d4f79a0d9.tmp
Size 476KB
SHA256 7242883553fdc0cf30b3c404610025d28e282ddf3141cb74fc2ccbd4ece767ca
MD5 a8df4c1ade68300e1eb3af71b42d7ef2
SHA1 b2296e949113ee8211d0f342ee9cf0c2b5a0134d
SHA512 537a3f866c84270f1e6664a0039cdb5a380fcbcda2311a6a5287c33055e77b06459436a2b958db402532122100d7425e948d7065a1af899d1571ffa2504041e6
SSDEEP 12288:qOC2e8sbNyddvfeo9HIurWZa2qC+ebMjDu:Ff8Ad3p9HTWZtaeYP
TLSH
T125A47D72B2F04873C1731A7D9C1B57AC983ABE513E28A9467BF91C4C5F39681342A2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Beryllium.exe

Path C:\Users\Admin\Downloads\Beryllium.exe
Size 25KB
SHA256 ab7bdf5086158a66c9c4fd8e15e5cfea73f161f62c7765c3ce61c6b9e43893a3
MD5 27487dfe347bbdf5cbf751b4d75207c2
SHA1 b2f7c4df52586b25291612d303c3dbdf84c2768a
SHA512 0cba8688745b97a51351e2d0e6920ace031194aadb2b8049dc520df98c38d4087c15d9cc10477c91de2100b883a15811de77f825903f6e2e87edd72f40b03b2b
SSDEEP 384:M2E4lwv9lwAg++zRhOO+sWnf3exqh13sKEDp+:MBoYflg++zRhAmo3wDU
TLSH
T159C2C606DB5364F3D8BE89F145EF953D8DA3BC82C8314C19D2E09B8EA933D56A459238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Virus_Destructive.zip

Path C:\Users\Admin\Downloads\Virus_Destructive.zip
Size 160KB
SHA256 5d3037dea18a0fc0d71f75e2b0bfe6298c3637ffb64a083cfae55126c7a8a9af
MD5 61f8d6116e44004e9e5a2ffdfa741163
SHA1 171169698b27dd7a56f8e35359392bdafd786c03
SHA512 8361e1d8b047a8c4cdaf6f1eb82e5588f964d693515c10201db4b274973b5fcc585b7e3354a912bf225ded8579c61675946276b776035e546d4a40356a664941
SSDEEP 3072:yTjFbNMWM/ZnsiplnMdTaiQz8fAwhVVfQMeyYEC4bIUxJN:yTBbNVMxnlk/QCVhVCMeH7Uxr
TLSH
T181F313DD050EF2C59CD9E28B64B77B9129DD87A4C2C9DE382E58D3C501DB52B2E101AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-1085-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1073-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1075-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1072-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1084-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1071-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1086-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2008-1036-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5004-813-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/5004-840-0x0000000000400000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads