6152f6c756785bc05b373d1d47fd906d3a21f900704734c71a9f789fabc725dd

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Size 20.0MB
Sample260708-e9sm5abx2m
SHA256 6152f6c756785bc05b373d1d47fd906d3a21f900704734c71a9f789fabc725dd
MD5 51d3841f0b6aecd025c66ae16cd77b9f
SHA1 3ccb6d8349257327cc487ae682277017a1e0289a
SHA512 113946e26ffd1da82b846c182d615965478e1b7f2c7b340313ba7a86aa73799b88f53628171a3fe77044fb5b9678ba9421eaaf3346f25fa0459ad92ef31c4be3
SSDEEP 393216:H0GxLfYIhU8z7zhff4E3npAdyrLcJHwnPp/QgEUc8YVBjDEOnceSbT5LE:Jxj3mE7P3pSyrUQnPt9c8YzEhbT5Q
TLSH
T1C027331233EA9475D1A20571DA79D3AA58BBBD310732D4CBB3D5056E8A35AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	4992	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1825111437\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1162450458\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_1162450458\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_404940043\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4276_404940043\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4992	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279591484590036"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{EE4C2C3B-07A2-4C18-BE3F-03425C96CCA9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4888	msedge.exe
4888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Token: SeRestorePrivilege	1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4276	1596	2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe	88
PID 4276 wrote to memory of 2032	4276	msedge.exe	89
PID 4276 wrote to memory of 2652	4276	msedge.exe	91
PID 4276 wrote to memory of 4992	4276	msedge.exe	92
PID 4276 wrote to memory of 2652	4276	msedge.exe	91
PID 4276 wrote to memory of 2652	4276	msedge.exe	91
PID 4276 wrote to memory of 5280	4276	msedge.exe	93
PID 4276 wrote to memory of 5280	4276	msedge.exe	93
PID 4276 wrote to memory of 2316	4276	msedge.exe	94
PID 4276 wrote to memory of 2316	4276	msedge.exe	94
PID 4276 wrote to memory of 940	4276	msedge.exe	95
PID 4276 wrote to memory of 2316	4276	msedge.exe	94
PID 4276 wrote to memory of 940	4276	msedge.exe	95
PID 4276 wrote to memory of 940	4276	msedge.exe	95
PID 4276 wrote to memory of 4848	4276	msedge.exe	96
PID 4276 wrote to memory of 1152	4276	msedge.exe	97
PID 4276 wrote to memory of 4848	4276	msedge.exe	96
PID 4276 wrote to memory of 4848	4276	msedge.exe	96
PID 4276 wrote to memory of 1152	4276	msedge.exe	97
PID 4276 wrote to memory of 1152	4276	msedge.exe	97
PID 4276 wrote to memory of 5012	4276	msedge.exe	99
PID 4276 wrote to memory of 5012	4276	msedge.exe	99
PID 4276 wrote to memory of 5008	4276	msedge.exe	100
PID 4276 wrote to memory of 3740	4276	msedge.exe	101
PID 4276 wrote to memory of 5008	4276	msedge.exe	100
PID 4276 wrote to memory of 3740	4276	msedge.exe	101
PID 4276 wrote to memory of 2420	4276	msedge.exe	102
PID 4276 wrote to memory of 2468	4276	msedge.exe	103
PID 4276 wrote to memory of 2420	4276	msedge.exe	102
PID 4276 wrote to memory of 2468	4276	msedge.exe	103
PID 4276 wrote to memory of 2468	4276	msedge.exe	103
PID 4276 wrote to memory of 920	4276	msedge.exe	105
PID 4276 wrote to memory of 2720	4276	msedge.exe	106
PID 4276 wrote to memory of 2720	4276	msedge.exe	106
PID 4276 wrote to memory of 5084	4276	msedge.exe	109
PID 4276 wrote to memory of 5084	4276	msedge.exe	109
PID 4276 wrote to memory of 2372	4276	msedge.exe	111
PID 4276 wrote to memory of 4836	4276	msedge.exe	112
PID 4276 wrote to memory of 5564	4276	msedge.exe	113
PID 4276 wrote to memory of 2992	4276	msedge.exe	114
PID 4276 wrote to memory of 2992	4276	msedge.exe	114
PID 4276 wrote to memory of 5300	4276	msedge.exe	118
PID 4276 wrote to memory of 5300	4276	msedge.exe	118
PID 4276 wrote to memory of 1692	4276	msedge.exe	119
PID 4276 wrote to memory of 1692	4276	msedge.exe	119
PID 4276 wrote to memory of 4888	4276	msedge.exe	120
PID 4276 wrote to memory of 3448	4276	msedge.exe	121
PID 4276 wrote to memory of 3448	4276	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_51d3841f0b6aecd025c66ae16cd77b9f_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffdac1dc188,0x7ffdac1dc194,0x7ffdac1dc1a0
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,4833709856522279700,14365970087102838449,262144 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10286227549826343434,7880926528211052999,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,5500394983825146887,4334249883571098379,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5960773585622936803,904178017242088040,2097152 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,2377988739722075262,5070770304493472125,2097152 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12251103284086685206,17545541782879709204,2097152 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11599066356292741584,548903744110544443,2097152 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8421799426728432593,7172749899747562444,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,5999266838061289880,11570107594040565528,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10819350487747079545,5026722164358584562,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11948206026788180742,2014053598720992411,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5980,i,12688048198753558060,7670090187195131073,2097152 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,15509711728097115015,7793590953177665032,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,15509711728097115015,7793590953177665032,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,12278094494911348296,7136855063883350382,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8835400070748499619,5349671139051676452,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,15472712151320211331,13186680255085606196,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,13552388594314731239,868213430716975207,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,10888352253374181451,11066369224182866386,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,9989765635904704965,11645267337467525832,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:14
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,4481058177821211109,13846538812430899903,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,672083943173365167,9514843762619332501,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5352,i,5522964268733730449,8194232631237414194,262144 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,5446660871134211245,13226821934900597070,524288 --field-trial-handle=2364,i,4565511046430121614,14475543004057687181,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6153a1a621ac8c04c1c583c871c1b126c257e1c419a1f7960c63a0c8a5268053
MD5 4b9b1508706f532d8838e260036f47e8
SHA1 0b9816c9598f3c3445daffb8fece64d7892cd9eb
SHA512 155164e7d4dcb462b24f2593ca4360303e0884761582f08edc78795f34f0a2c40d7d2f9397b5c371da07bb4041fa8496a2f6b4989f2ed3c14cd745df2f712edb
TLSH
T130412C50037D17F2C3618D3760E3F28AF6F4D7D9CA8B7E6E5A92B1B41A86788540642F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 298b79456a1df0efec2416f1c90d5f03f2b32d8b0a00a55e0286b5ceed942c7b
MD5 a2efd7945f4b85eae6d8f3438af1d887
SHA1 a34c7f78b892b0bb65f7cf2ec7b15e8a62b32a22
SHA512 3e91787122fde5ed6c3801159b2e50b38fdb2564af6e2040c619059e517f55d370b26ea40af8b51a606f034315f9828a4a394d1cc58ea16e2277a73b2cc835a9
TLSH
T10A41BDF3C3E8867D890196F4BA187F2BCE2D0955432C3D5AC9E4AE1B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 540cca408e1cd0e249f7c3c455368b051edea83d18d6d7f5479ef8a6a3bfc36b
MD5 8e6068171ed52880ffb96e831c50465c
SHA1 ab6267eef5a869d6f8ab2d5f1a12c481a4e61e88
SHA512 41976bd0043406eca252158402f796413d7f4520319566054e08ac9d032dffe6d7609990f8d14771ca08d83d510c503d0d42ec1d538725dc3cc151006e599430
SSDEEP 192:sxRPRViyM/jK1Ml8wTE/fNs889YkZ/1/pczoA8pi/g6+WNIYnOtUGvIgtJ:sxRP7qFE/fNs8EYa/1/Xi/5IXf3
TLSH
T1C152DA156A24A97BCCDBD20DFA557F53D6F81573A2900E44AAFCCA0C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37d96346382153e6cd4dd3b115d0c382141a2ce2e07b1d8a6005f01b5b1c49ae
MD5 43b6e421774289aded64d81f112a7d0f
SHA1 e7e359faa5317af1362eb2e284b54de8a256f593
SHA512 cce450589a716e37d66f6c4da34bc0074b53f58097e853c6e89d9172acc2a5b176d4c9a2d6296cd9ab467cefca62a8c839d5fc76f338e62bade72f96044400f1
SSDEEP 192:sxRERViyM/jK1Ml8wTE/fNsO89YkZ/1/pczoA8pi/g6+WNIYnOtUGvIgDaJ:sxRE7qFE/fNsOEYa/1/Xi/5IXfK
TLSH
T1C552DA166A24A97BCCDBD20DF6457F53D6F81472A2901E44AAFCDA0C01E7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7ff07854a72db4a50b1f91662cbf5c136a7c0fc3f4675f28203c5b51e09567a2
MD5 cda6da76ef2060421503281e74a89315
SHA1 18ca6cd529aff0f92e26d8734d417d24421cf453
SHA512 293eabf41d6aed2c3850c20e888757300a4c1e741eb97021b1dab3aed2453307a1858b12c3a93c5e003caa818b364e2e190bbbee464b30a1b6d033258fe566f7
SSDEEP 192:sxRERViyM/jK1Ml8UQnTE/fNsO8ZYkZ/1/pczoA8pw/g6+WNIYn3tUGvIgD8J:sxRE7qqTE/fNsOQYa/1/Xw/5IafU
TLSH
T1F162D9166A24A97BDCDBD20DF6517F53D6F81472A2900E44AAFCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6cd9047a3c88c4b96f456d369dcf0bce84bccaaee21548f75dff006df252ec9e
MD5 e76426db89245d08bca3507517fd1757
SHA1 dd82404f9a879c8c80f8b1ed73adf8ec974926de
SHA512 5eaf1974bcd4928da91965404564f04cc5b0f96e18f4b57a0481de77618138c305b020d4166659f1fd2221e79f9119cfe471d4d060444b63dee61d652c24b093
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0+3XguXroM7PUU:Jl6hhQE7b2WgqcfHwu1jaz+3QuEM7Pb
TLSH
T10BE2DC3B780CCB7E4F804A9CEC29798A6DE801CF96D8CD5447F9894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 afbe961819e691237d204b9cd2fe4e6add8a07692502e1052e41a4333ef40f80
MD5 0c4d1d7434b9b420138492dec1e9faca
SHA1 4f76fbfed8b8a7a3002a135b0cab6823f78a2fee
SHA512 ad9aa566cf6f9c607a9f82b6c880b49878914e4f002de4fe8dbef01fdbf2c91dbb2c30790d1e4a695b0f0f7c771f82980e544319a842751b3f557f22e140421d
SSDEEP 96:KRQh0gS+yoW2r7gooK4tgaocII7aglHdqjXNn7vWj4mgfvK4+gBvcldQzLPY95PA:CQh0gS+y/2rEostgaHII7aglHdqjXNnh
TLSH
T18C9156C8313702C5787E284C819589A7D6C1B2673605B53B7BA802D75F27E078DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11472235-a58e-4dfa-9023-0d9510cad5c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\11472235-a58e-4dfa-9023-0d9510cad5c2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ecb5d9c7b25b534931997d32745d0cfd4d0d36fa0ccdecab1a7cbe73d18ed733
MD5 ac1b92b2d00364ee4be8ce1fcd46c50a
SHA1 3bd089cabbe5bf05058937fee9ab9ac4de19edd5
SHA512 a2c4aec62d9e76e92d660eb90b3dde2358f1b51e458ebea9dc5ad54193eb6b8ce2c29ccc931e561921dc72c34a96d8c3add0d0daf76ca79b9f816623250e0dd1
SSDEEP 768:BF1j+9w3cwgpBVfHfZtGxX7DGFzoqPcNMCNFIMjo:A9w3kfHfqx3WkqPauj
TLSH
T10F039EB6DCA1DA6B9CE3C7C9B7163687DFE001A385885AD4D9D86E4D01CB1ED030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cc5250059b4bb69587746ff7d2e22dd2904786394a6f1965e71a621f5f49be23
MD5 a1f9956640f2b19c958934fd2a9cd254
SHA1 16b7508d99b225fec72fa0ad97eaf36393658826
SHA512 daa1b7a1b64c76405dc8b9c15c30a0215e4c3cfcded692590b347fdfca391eb56e74156f2acd884cbb2b607ef33148de57daa8ba0f20f2fd1f95b659ea09732f
SSDEEP 768:Vrv+4UNbda3f6YreNSLfHfZtCX7DGFzoqPcNMCNZ4eVH1SkM:Vbsb43ppfHfG3WkqPaOEH1Y
TLSH
T1E603BFB6A8A455374CF3C6C9B75B36076FF0056746440B94D8EE2F0E839F5AD130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 83ebdf96b3f21e4388ab0474f1b3d6ee09d2d363c89f696f0b6bc6bc17b9ca66
MD5 0cee1761e21553b36ef8714a1d91d337
SHA1 d0dc1f63e6912d37f3dab72388eaf124e2ba5fcd
SHA512 5fc17516f4da77ade39d0eb5427179d947b8e7b61663def88653e27c94d6f3512351f2ab877f301c931e022de9e712ecbe3fedf1f16758780e7237ff73e5daeb
SSDEEP 768:erv+4UNbdQ3aeYreNSLfHfZtGdX7DGFzoqPcNMCNFIMjs:ebsbG3KpfHfqd3WkqPauj
TLSH
T13B13C0B1AC6499778CF7C289B71B3687EFB015A344840B54D8E96F4E428F5ED130BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1cd6c50a5c26ec8837c6901d0d94431ba9aeed5f3e108808737778b73c449d46
MD5 41d0edf0c1f96ab4a9b565f9dd704356
SHA1 289b8821c90fb79d1c7c4f5ea45c8b934202a1a6
SHA512 f71aeba8c7b2166212fcacea9d3ac1192e3cb5929cb31169352dd0feb25047504cdeefc9b8b9215a094bdc55f61c5848c266994ec736bedc3664d364f1e3e933
SSDEEP 768:Dj+9K33eYreNSLfHfZtGdX7DGFzoqPcNMCNFIMjo:G9K31pfHfqd3WkqPauj
TLSH
T109F2AFB5AC61596B4CE7C2C9B71B3B97DFA015A344841F48D8E9AF0E42CB2BD130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

49d82dc2-ac81-4330-8605-587d7e99b31b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49d82dc2-ac81-4330-8605-587d7e99b31b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4276_554067395\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-0-0x0000000004790000-0x0000000004791000-memory.dmp

Download