hxxps://cdn[.]discordapp[.]com/attachments/1456017239034826792/1456041112799154268/VxV_Public[.]dll?ex=6a4ccb35&is=6a4b79b5&hm=c65d62ae2c2d62e353c6397fb285f63c80df6e4dc6a73292e95b29eecc1f9331&

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
35s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1456017239034826792/1456041112799154268/VxV_Public.dll?ex=6a4ccb35&is=6a4b79b5&hm=c65d62ae2c2d62e353c6397fb285f63c80df6e4dc6a73292e95b29eecc1f9331&
Sample260706-v9bmlset4l

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	752	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
752	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278332643782906"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6C327421-9AE6-4C4A-A426-4C216D71FB0A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 5096	3620	msedge.exe	83
PID 3620 wrote to memory of 752	3620	msedge.exe	85
PID 3620 wrote to memory of 1528	3620	msedge.exe	86
PID 3620 wrote to memory of 1528	3620	msedge.exe	86
PID 3620 wrote to memory of 1528	3620	msedge.exe	86
PID 3620 wrote to memory of 2356	3620	msedge.exe	87
PID 3620 wrote to memory of 2356	3620	msedge.exe	87
PID 3620 wrote to memory of 2396	3620	msedge.exe	88
PID 3620 wrote to memory of 2396	3620	msedge.exe	88
PID 3620 wrote to memory of 2396	3620	msedge.exe	88
PID 3620 wrote to memory of 4784	3620	msedge.exe	89
PID 3620 wrote to memory of 4784	3620	msedge.exe	89
PID 3620 wrote to memory of 4784	3620	msedge.exe	89
PID 3620 wrote to memory of 4080	3620	msedge.exe	90
PID 3620 wrote to memory of 3312	3620	msedge.exe	91
PID 3620 wrote to memory of 4080	3620	msedge.exe	90
PID 3620 wrote to memory of 4080	3620	msedge.exe	90
PID 3620 wrote to memory of 3312	3620	msedge.exe	91
PID 3620 wrote to memory of 3312	3620	msedge.exe	91
PID 3620 wrote to memory of 4416	3620	msedge.exe	94
PID 3620 wrote to memory of 4416	3620	msedge.exe	94
PID 3620 wrote to memory of 1772	3620	msedge.exe	96
PID 3620 wrote to memory of 1848	3620	msedge.exe	97
PID 3620 wrote to memory of 1772	3620	msedge.exe	96
PID 3620 wrote to memory of 1848	3620	msedge.exe	97
PID 3620 wrote to memory of 2272	3620	msedge.exe	98
PID 3620 wrote to memory of 2272	3620	msedge.exe	98
PID 3620 wrote to memory of 2272	3620	msedge.exe	98
PID 3620 wrote to memory of 3944	3620	msedge.exe	101
PID 3620 wrote to memory of 4296	3620	msedge.exe	102
PID 3620 wrote to memory of 4848	3620	msedge.exe	105
PID 3620 wrote to memory of 4848	3620	msedge.exe	105
PID 3620 wrote to memory of 4848	3620	msedge.exe	105
PID 3620 wrote to memory of 3884	3620	msedge.exe	112
PID 3620 wrote to memory of 3884	3620	msedge.exe	112
PID 3620 wrote to memory of 5556	3620	msedge.exe	114
PID 3620 wrote to memory of 5556	3620	msedge.exe	114
PID 3620 wrote to memory of 5556	3620	msedge.exe	114
PID 3620 wrote to memory of 5384	3620	msedge.exe	117
PID 3620 wrote to memory of 5384	3620	msedge.exe	117
PID 3620 wrote to memory of 5384	3620	msedge.exe	117
PID 3620 wrote to memory of 5480	3620	msedge.exe	118
PID 3620 wrote to memory of 5480	3620	msedge.exe	118
PID 3620 wrote to memory of 5480	3620	msedge.exe	118
PID 3620 wrote to memory of 4624	3620	msedge.exe	120
PID 3620 wrote to memory of 4624	3620	msedge.exe	120
PID 3620 wrote to memory of 4624	3620	msedge.exe	120
PID 3620 wrote to memory of 5464	3620	msedge.exe	123
PID 3620 wrote to memory of 5464	3620	msedge.exe	123
PID 3620 wrote to memory of 5464	3620	msedge.exe	123
PID 3620 wrote to memory of 5332	3620	msedge.exe	128
PID 3620 wrote to memory of 5204	3620	msedge.exe	129
PID 3620 wrote to memory of 5148	3620	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1456017239034826792/1456041112799154268/VxV_Public.dll?ex=6a4ccb35&is=6a4b79b5&hm=c65d62ae2c2d62e353c6397fb285f63c80df6e4dc6a73292e95b29eecc1f9331&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,10346090013341706550,17731099261659979748,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,1733098910784227377,10657542180678627211,262144 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,2145504983436195244,13980720604655323116,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1116378601114842556,2653762968442455384,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,8102709548720221560,13654750227963191841,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,6232828828490335490,5301573247039552389,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8573310092080370567,8259284379007181353,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,11280012536524772792,13789166935893325677,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,10242550814161122731,16699493968011176830,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8640015129087465231,6144547180508307971,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5872,i,2214249072739051965,17424348672411360787,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,13501056037318087904,2512824604151430075,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,13501056037318087904,2512824604151430075,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13595442941425487822,8185272607733876529,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6840,i,10858317380128818243,11288697865914676320,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,3358621548859676294,18375491341851956777,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7008,i,6122952049981391349,4331816584304234525,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6496,i,11332054549161975823,12000996590942778588,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7400,i,9018746847601457449,7758731392296992956,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7624,i,12986323684445488921,13130278165707979313,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7428,i,3632508466624602216,9518488845447793488,2097152 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,6827346272184945144,1799015898649148772,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,12864102311635014354,15591891742422611878,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,16074354367129277062,9059278749937573732,524288 --field-trial-handle=2564,i,8590330913031512412,173858336482280774,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:8
  2⤵
  PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 399KB
SHA256 ca90f5425ad2896bdd5f0bf6cab8374a1cb3ed9bfa27db890118f8764537fad4
MD5 df51b2098cd19bbddd102c1534f92215
SHA1 ebdf98fae5ed80d941ede777bf5f118ab097c0fa
SHA512 cdd55de0231f27e0a1bfa11d1dfe606f98c68938dc10432a58eceb92662c4f4874df3c9db6dad646342599628cb351961a63ad881443ae7d59afc03ca01474bc
SSDEEP 6144:blJaJ72aJQM7FTF5VvwPeanEmgINC1O3iyoaOthRoBOA9YLXz1vmCqN:KaI7FTXBw2anESNPSyoaOthRWOA9a
TLSH
T14A94F12553F95D26FAFF3B7B58F161406BB0B517E533C60E0AD270ED0D12A814B2A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 19KB
SHA256 b9e910102d058a696ccfcc1af565d3844c952c7e2127915ee2953f66839a9555
MD5 9f98b25682d26512e43c53b3ab379849
SHA1 241687b6aba85f978728113da6a9831378bd6320
SHA512 9cdd2d1b0d782879d8e089292d6b7e44efc176ae733e0cd223a1815636eb7776afdfef1d46a63121a1cddf261aa1af5741138e5026d8abaa1586f32507068e80
SSDEEP 384:720rn9jqnI9cpR2kDPi+Ck9Zl+jog912SHX6Xr6V3FFBH/nRLQ5wDhxCmH4I1:nrclta+Ck9DoogP36XmZXBZPDbBH4Y
TLSH
T16892C0A09992C88ECD36F4271E5EE9C3595CE4917E3A0BBB07D26D5B084164A7CB21CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 59KB
SHA256 2a43b4cfc47238c170257b2345f451828a25270327bba55db5db07398e1199e8
MD5 3df2a75a9ddc950ce672b11962b8d017
SHA1 aea2d21e8d4076f6abc88225e5182c0f5c6a83e2
SHA512 627c2c8d6a6709f714e16e9094e1e8b33ef228195f220b5be738ef09805897785ac1e02c3f48dbfaa66fea1524a1be3ce6a36f94172c82439e72cbc1c83866af
SSDEEP 1536:yG7MtNK2UY9XlJdEISDLz+9BxP8xTGxMYAWwd05TIbGTdNDVsFy:yGCNKjY9VJdWLzHxsMp4IbeVqy
TLSH
T1605312B8D9571FAE9722CE3C6B4A0168B7714A9A52DDF04D12D8080BFD816D25E2A4FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 66KB
SHA256 00ce90dde97890a2e635db407bae7d8472661a8128a0433f1223a9b65b7a949f
MD5 e7b2854b0616c6543ef8bb43345f8336
SHA1 843610042043fecf78546e6d4d220477fcd74e0a
SHA512 4ad6a0156cecdeae2bce5e6b666a8fdcabd73f195c81f64e2755c5bac0913acb5a42be9fb0a5b99f55639f0eb0fcd703a3cc8faef89b40961da1f82164f65a85
SSDEEP 1536:9rsaj5OZV6+QIKLEzoZ0Qj2gRxbku9aCbQ9335Vm/iP1NODlYS:94OO2+QIKYA0QipuE333yiPyDh
TLSH
T1486302D45721CA71AB3CD814572C104B6852E54B14E74F23A5EA6DFFF16E4706C7F206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000da

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000da
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 334a7ed89e84a011eed03fe958e1c5c4cf2772e5bf272785e7ef3d02a15415db
MD5 149623dd0cfdc52ace03f216b69ef3c8
SHA1 dfd06609e4d7e49347cc926c38009fd5a9ab7b75
SHA512 23de54a76f23e7f002a22d304b27b534ff492721d369d849446d0ced3f9af02e17f4f589bfbefcc3687b59818616844b245a8a44a03148c0d8c521caeb7deb6f
TLSH
T1D6D023535311B07695BC3E858465EC4FC72661111841EDD430D09D5D053155C4557181
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe587b26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe587b26.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 896f5e512c512b88802e98198b23515b824d867c81fd7a4119e701f6db758772
MD5 4cc45b707883372ffd5c7ac15b10d7d6
SHA1 56ca70e6c7339fdd984302d9ef16efc9243439d3
SHA512 74eb73356199c9aaae4d6e1cee119e625d4d9b134abe435cef447509ffc2860a819efc302e368e10a7c17b78fac668101523ca6fe75712653bc2bb4a9812b60f
SSDEEP 192:sxZBRyyM/jK1Ml8MWPb/fPsmUeIrBb7nNPdpmqHW6+WNBES/YIcaCCIgrJ:sxZB4uPb/fPsmF8BFNHbv/V9
TLSH
T1C652D7126A34593BCCDBD21DF905BB53D6F95462A3940E44A9FCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 54b9a269f19a5ca56d668b0f2828ad510a3fb986a6e6ca37598d2c96ed4b5cc5
MD5 ddac17d777add84e93f01bd74210b383
SHA1 f95b8eb1ac492efb84e29870fccd0341071c3ad0
SHA512 6b3647df2df7175f8bbd7f919bc40b7cd11f6291f1f742334f2e52f6b2bf18e86b7220a8c729774310733ad627e21362f0284e4df8bd8b1304f22401233a2023
SSDEEP 192:sxZBRyyM/jK1Ml8M0cB4b/fPsYUeYKeb7nNNddpmAK2hHW6+WNHnESHJH/YAdMCP:sxZBYsm4b/fPsYFx4R5HbFZ/QS/D
TLSH
T1FC72E81266244977CCDBD209FD25BF57D6F94863DB904E4CA9FCCA0C04EAAED221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 486a289a83a9de602fe90635bbd50e980f27d538919cbdc3d4f78b7a512621d2
MD5 5ecb85173746d66ffce4271d7b6473f1
SHA1 5d380f030a74457c10199fed417f496d3e7787b6
SHA512 a26a4ff23d537f3cd43b8531f8e03b3193a2b0806de05528d6489eacb05bdbb0db977665be4cad9dba43a9a5d4ad6224b47b7e5fcfb6c9827f952e8cbc29f894
SSDEEP 768:sOsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9rrohEc:sOsqxXlWvJD6Tu1ja54LAs9YhB
TLSH
T1C5D21B3B694CC77E4F840E5CEC26AED76ED801CB67988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 cb3ee5f1097ea18116033ab34f57c08ba238c649153c3f7948c915a70aca2158
MD5 1e34ec8d2725ea45a4bd34e160f95bc0
SHA1 b14bc94d9cf46355d970c75379a1878f94e9f91b
SHA512 8e7f19e58d81f9ec25119ad3b69bd55dff20d639c214894bf807a77685bc829edd6540ef90966479043a6f461951a4327244ce63a3ac0abe780ca30f9ac8d158
TLSH
T1E731F0CD8E51599FE9A489F31076B1B473B089CC2B15A3134D7D62773C2639A2A4B1D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583738.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe583738.TMP
Size 1KB
SHA256 66af7289e3720fa9af2455f828d4c887e591dbd54645f5e2ade4cd0a80d7b991
MD5 70d58c1c1d23aff039f7fc23bcde9c71
SHA1 84ba1ae956d9c72a602660c8faf7c611a2cb3540
SHA512 c3fcde4b1db130d4e1a6be655d10237ce0dd0afa79f0fdab6ff3c50f4da4d46bc13fe3e0692f0b403efc065c02270e50cba019f92b6a024a8155cb12fa4e1d28
TLSH
T1B131218E8A925A0FE8D080B60557B4B83375C9406322B393947D633A6C75B9E6E9F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d0fa3892dd78f4238a09cf543a6a39dbf628fee6a2ec7478458674d42dace32
MD5 d771e84e0ce6a27646131bee7c2c4c85
SHA1 36ce621b15850829f0b6bcdb40b920612b1117f3
SHA512 5db1978aa1b153ec309ff8ffb7f53dec1d2109e79bcf04f7cb3f20b675a23d899df7bb2bd1f881baeffc0f746f9d00c06203a5765da7281df426f40984466c40
SSDEEP 384:RtNn/s3n9SfsNeDTZbIdZ/2VRN3OKZ9Q7DnDhamDqbO:Rj+9Uq/UH3Om9cDn4RbO
TLSH
T1D3927B3669345C670AE69548F14F3603AFF890A797C92F8495ED6F0C05CBAEC2316D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 930713ba1eb90fb314327dc33c913ec21a2490979be0671bbb27b8a4909d2f76
MD5 9677ba7c6d2db2f55c61b0f67cd2351c
SHA1 e0afe389c6014ab221fc06f0ccdec95c98a21fde
SHA512 5fcebe73fe71967af6d38abd9989224164988e47ec4ccf0373c80c287afe687d53dfad8f24bc6e625c3870397771f548ca2851cfa310c46c6658442fcb37b104
SSDEEP 384:mtNn/s3n9SPsNe3TZbIdzSVRN3OKZ9Q7DnDhamDqbO:mj+9g0gH3Om9cDn4RbO
TLSH
T11A927B3669345C6709E69548F14F3603AFF890A797C92F8495ED6F0C05CBAEC2316D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5faa24016bb39e625fdcee3e7ad30d7b02728376046395279a3f27b9d976ea81
MD5 790f60e95ac13dc9ee4b796c284456d0
SHA1 98e4171317f10fbb0fec31c601df837623f241e7
SHA512 2138a112fb1908fd08b2736fa2db119f0b908312402dd10aed7f954cb5d3b3662cf38f981d458f138550425d7376fae21e77bb82f31c7be14550cf79278334d4
SSDEEP 384:2tNn/s3n9SPsNe+TZbqzSVRN3OKZ9QeDnDhamDqbO:2j+9g/gH3Om95Dn4RbO
TLSH
T1D4927B3668345C6709F69548F14F3603AFF890A797C92F8495ED6F0D01CBAEC2306D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 26dab53407978348845a58c2fa243df6210d3c87af7a4bba640f896cb3d4247c
MD5 e372677440834f5ba1e4a1abd9e04598
SHA1 74d118249ec4a4c171898398bb4ee889585d6032
SHA512 90cdfa1416b5b9757e6a71fb236fa0fdc1b890f26a3e9eaf334645317eb82f11a143a99bf40b68a6b1e5d4e65517236638dbdb5cf3dc2a5d66ed70853684a963
SSDEEP 192:tONK6JkRtQmiUyvFW+RN3OmNOmFHh3DhROFU6:tONK6UrCW+RN3OKBpDuU6
TLSH
T1B602FB35BD381C778EF2AD09F58B27175FA8206BE9952F84DAD81B0C01D769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e30e2b69741c1cb8db0a3c4d0821f891c9de641d5c8447988f13e2df36be488d
MD5 9b14c09d67028c7668508c39860aca17
SHA1 bba5f9da77782b6e57b3818daceef9677f212d2f
SHA512 c2b20a8ceb765cd47a4e3a5543032be257de014247c1486d518aee5a54ea1b1c608d3942d66d35a642ad19a84da9af9f8311e7f91dba5c1161ad2f2c0c97c2b4
SSDEEP 192:2ONn6JkRzQmiUyMFa+RN3OmNOmSC9QjM0VcDKqC+U6:2ONn6Ul/a+RN3OKZ9Q4DnU6
TLSH
T1A9122A3279385C774EE2A845F58B32175FA85127EB896F80D5DC2F0C02DFA9C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d016348bb8b3b93d7382caf58b0662e746d3af6fc83a5ad6135a2196d83540ee
MD5 b0dcf6237d67b7d0bd4c3f077d5acd14
SHA1 3853508ebf5af40f40ea2ca1d4f33a6642cacf45
SHA512 c55867aea2e0d416d2881889c7fb8a8f127b95737b02e1c2a147276efbcf5c23d086ac99a72dc60cd94dee9274ee7e2e62f0632b8086c8c0a689d74d8d4e6740
TLSH
T157E00217570000BEC43C033100436EB026D7813051F542054E31156C5C627402F30EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588c5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588c5d.TMP
Size 392B
SHA256 8f096ef245905159f4e892b4ff6059151e3f3a30b15c6c13e938ba1a8a4f7a92
MD5 cb119d1493e982aba8e254e0474a15db
SHA1 014ca62592e32333983371e60ed446c22e554b4a
SHA512 c2f683ac55f0c8052f2203da6fea3fd518bcef4b4c286c57f290cf72e04e2d8219cb4163b8d78688f7e7e3828afbda241031f0463609f1fc7cb531bdd94fa586
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16e9e13f4352645e1b762e3c55dacbc856f8234cab9fa75f781ba7f3d88bc575
MD5 291ef49c26b26e32cc86191213c2e8c9
SHA1 670f1f536d2b31c1af4fc1f8233ea753af82c0c6
SHA512 025d30217620ce2a5c726fd383d0445326e6637e41cb78c09b19381c3ece526dc5190f9a40d1bfbdec21c352c1fccba1d28796711ef1cf1634d9f067442043e4
TLSH
T18E412489A6FD1148B3B37F5A9BF7A86E547FBD732F0A845E00110D4E0A26B41C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads