hxxp://prestigeclient[.]vip

Analysis

user interaction
yes
max time kernel
213s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://prestigeclient.vip
Sample260712-seqf6sb18r

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2800	javaw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283421723075997"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{2E4F5DFF-DE47-4820-8AC9-7AEE68D1D731}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	javaw.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	javaw.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2088	3864	msedge.exe	86
PID 3864 wrote to memory of 1804	3864	msedge.exe	87
PID 3864 wrote to memory of 4020	3864	msedge.exe	88
PID 3864 wrote to memory of 4020	3864	msedge.exe	88
PID 3864 wrote to memory of 4020	3864	msedge.exe	88
PID 3864 wrote to memory of 4328	3864	msedge.exe	89
PID 3864 wrote to memory of 4328	3864	msedge.exe	89
PID 3864 wrote to memory of 1740	3864	msedge.exe	92
PID 3864 wrote to memory of 1740	3864	msedge.exe	92
PID 3864 wrote to memory of 1740	3864	msedge.exe	92
PID 3864 wrote to memory of 2080	3864	msedge.exe	91
PID 3864 wrote to memory of 2080	3864	msedge.exe	91
PID 3864 wrote to memory of 2080	3864	msedge.exe	91
PID 3864 wrote to memory of 2464	3864	msedge.exe	93
PID 3864 wrote to memory of 2464	3864	msedge.exe	93
PID 3864 wrote to memory of 2464	3864	msedge.exe	93
PID 3864 wrote to memory of 3332	3864	msedge.exe	94
PID 3864 wrote to memory of 3332	3864	msedge.exe	94
PID 3864 wrote to memory of 3332	3864	msedge.exe	94
PID 3864 wrote to memory of 3388	3864	msedge.exe	97
PID 3864 wrote to memory of 3388	3864	msedge.exe	97
PID 3864 wrote to memory of 3388	3864	msedge.exe	97
PID 3864 wrote to memory of 1584	3864	msedge.exe	99
PID 3864 wrote to memory of 1584	3864	msedge.exe	99
PID 3864 wrote to memory of 1584	3864	msedge.exe	99
PID 3864 wrote to memory of 2868	3864	msedge.exe	100
PID 3864 wrote to memory of 2868	3864	msedge.exe	100
PID 3864 wrote to memory of 2868	3864	msedge.exe	100
PID 3864 wrote to memory of 4824	3864	msedge.exe	104
PID 3864 wrote to memory of 4824	3864	msedge.exe	104
PID 3864 wrote to memory of 4260	3864	msedge.exe	103
PID 3864 wrote to memory of 4260	3864	msedge.exe	103
PID 3864 wrote to memory of 928	3864	msedge.exe	106
PID 3864 wrote to memory of 2488	3864	msedge.exe	114
PID 3864 wrote to memory of 1080	3864	msedge.exe	115
PID 3864 wrote to memory of 3260	3864	msedge.exe	116
PID 3864 wrote to memory of 3584	3864	msedge.exe	118
PID 3864 wrote to memory of 3584	3864	msedge.exe	118
PID 3864 wrote to memory of 3584	3864	msedge.exe	118
PID 3864 wrote to memory of 1988	3864	msedge.exe	119
PID 3864 wrote to memory of 1988	3864	msedge.exe	119
PID 3864 wrote to memory of 1084	3864	msedge.exe	120
PID 3864 wrote to memory of 1084	3864	msedge.exe	120
PID 3864 wrote to memory of 1084	3864	msedge.exe	120
PID 3864 wrote to memory of 560	3864	msedge.exe	121
PID 3864 wrote to memory of 560	3864	msedge.exe	121
PID 3864 wrote to memory of 2880	3864	msedge.exe	122
PID 3864 wrote to memory of 2880	3864	msedge.exe	122
PID 3864 wrote to memory of 3588	3864	msedge.exe	123
PID 3864 wrote to memory of 3588	3864	msedge.exe	123
PID 3864 wrote to memory of 3588	3864	msedge.exe	123
PID 3864 wrote to memory of 3720	3864	msedge.exe	124
PID 3864 wrote to memory of 2712	3864	msedge.exe	125
PID 3864 wrote to memory of 2800	3864	msedge.exe	126
PID 3864 wrote to memory of 3400	3864	msedge.exe	130
PID 3864 wrote to memory of 3400	3864	msedge.exe	130
PID 3864 wrote to memory of 3404	3864	msedge.exe	129
PID 3864 wrote to memory of 3404	3864	msedge.exe	129
PID 3864 wrote to memory of 960	3864	msedge.exe	131
PID 3864 wrote to memory of 960	3864	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://prestigeclient.vip
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdc880c188,0x7ffdc880c194,0x7ffdc880c1a0
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,7347899924891340483,13676612879374787894,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,8834156140006198646,1239101412632477045,262144 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,2650060296834350864,10189933342644120282,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,14566883309774990678,13991936253549708982,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4693885627242984668,7439881841217463979,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,8954456601778419129,16189999044589450748,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,4526170634577600703,16885062864109188681,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3904,i,16005703865410016244,1302826586957788602,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5240,i,5847996126999311891,4185426589951189885,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5192,i,1428217197459118117,2639638219740392911,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,12782635176593574664,7031753263063227753,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,7058013749939066398,13281053306376115046,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11502203936006020642,7538090742203072097,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11502203936006020642,7538090742203072097,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,2089963881543632115,6215439212872493418,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,13044995692220295799,12220959749313214786,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,2624804328154191633,16636939191450945539,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5524,i,15927221518794097375,2111731599846033663,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,588554726207036857,15087674222396916189,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5312,i,10861997379969931015,11521916454869885758,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,2128456147180005471,7890355497717496720,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,2586455549880979527,9304364080643010664,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2700,i,13254710605394594068,15154101484422968780,2097152 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,6600019640803855503,5778477241773544717,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7364,i,10031510887000311428,17064256472285556488,262144 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Prestige-Injector.jar"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,4284581462154749987,655442016843445181,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,5037618521395342324,7838356946783860375,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,9773738693076626145,2400071476884222808,524288 --field-trial-handle=2264,i,16929040601753193240,4952832213887399811,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:8
  2⤵
  PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 48KB
SHA256 50145bcdfc506b8a9a08ef44ba07c0bff8ea8f62f59ce2032b900b66ec0506d0
MD5 863e8ab459b105d601a4213dba72793e
SHA1 4a3a0815c6f95d9470adbb44cc92952447666973
SHA512 bfa80baae5c6e16fab84a3f2b85b90eadbe6d8c418e5accb89861c116e0eab8836532e66198e37344a334b47e084c20ea662c638fec6c52aed043b588ffae082
SSDEEP 1536:RQjEsPYDWfw8+TYMFI7/j829AhzcmnpVzBUkw/B4jVf:6E6Yaf0xKrAhzcm571
TLSH
T18223F1A871E0D390D2705B3DCC3A4DF26C9199A6700967D5E6BBC7CC330D2A9B09E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 865f4fc172c17717ac6decb3aa2c231b4ab1376f0e762bf43dd29c58f17f7040
MD5 15d8042c7f86515a23975fdc1bc36011
SHA1 41400fc80ae7ff49bc9025cc08533e8c3fb5267b
SHA512 0818a51e6b038160da2f598f44cd835513abe3f0d19664522246b5e60f9b601502fcb3fd55db3bf4cc88ed608203df5cddf68154ae8146e041207641a8b2de35
TLSH
T19F614A850BA2F46AEBEB31B5F0DA03073D31909A06734ED6028C8D7D690DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 378fbeac6467cbdbd913d1cc700d6d43b9ed02caad5f7a39ee099d82cd622c14
MD5 f207ed4f20b80762e8bfbd5b946bd3d2
SHA1 f8e0a7abf7afe43ec58440a8be1e66c39c5e9248
SHA512 838e38d2a4014da237eb945a30e11106580368dbf2c2ed51b51bae34faac00da44f3d3958ecba1b3d14e4a545bad7d61f198cd9324381e20c972ad7536ad76b7
TLSH
T1CA81A2911B62F52AEBAF30B0F8DA17077E3080AB06B34F96018C8D7D280E361FC65754
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e4bd261125adb1c6e4da64857d7e9fb503ea230c9ef4364561e70d158864876e
MD5 4f6277806836645253d6d0dd17ab6ed9
SHA1 56f4b44aed9af3401c30395e29d0b70718746766
SHA512 a8e9d5715cc64a9129f72fb350eb6215899cf4acf3debe94be07f9919ba552198bde8cc7431181490e445bf60d036b7bee66fde3e14c969fbcf9753bad0ef12d
TLSH
T12C8191951B62F52AEBAF30B0F8DA57037E3084AA06B34F96018C8D7D250E3A1FC65758
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bddc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bddc.TMP
Size 3KB
SHA256 a35014deafc687595edb82328bf80f3553e9b83fd3c292143b1f2e70ff2f3bf3
MD5 498e27c28a7d1f127b61a1d2158c4fc9
SHA1 fc4517a8f3be3d8ef61c4ffcfa09139edf314628
SHA512 43aee8e5e209f1496b86686c7173660cb62f7e5dd4914d263bdd606dad138a83531ec40883a04f33bf3f1646c3b4d11a26a67e738ac83d7a9240b1bcf3e3b3f9
TLSH
T146613A850B62F46AEBEB31B0F0DA03076D31809A06775ED6028C8D7D590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 3f000f7dc2008a41ee2fb201ffe6704a9be14fba3bd623c6e7bb4a07f98c6fef
MD5 3aab6ce86150bf7766047dc61e74ea18
SHA1 f8d8af3046e29a5b1a6247796574b731b4019fd6
SHA512 4c8c46155901514b8b86b5e50188506df0f611968ff46aa96df44d3ef01c9908a928638dee649d5493ca0cc25910e6c92176cc197988a65a054cb1e8ff0b1807
SSDEEP 192:DcM/K033lN5enJmIoEPU9UwJddErGYUAJGXXTQF/l+Rt60Yclg07x:DcM/K033lN5enJmIoEPU9UwJddErGYUH
TLSH
T17422AEA3D3E8866D881156F9A61C2D16DE181694536C3CEDCBE9FF4F63F1434E202A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 016daf2b083119f3f4e8bbbdee4a1462d924685c0ce6b760bc1eb4c428d0d333
MD5 1d9ac91fb5f3acb6bcabe319a13a387b
SHA1 51f3221efaa4cde1536043f423b74a269cbd518b
SHA512 c2e8c22d2f34862a652732a19cdb79ce80874664ef8c04e27ec7596ed049d3fbf968334e9dda0c25e11b91decdc93475e5f483025c0a5b17a96663bead3f0e64
SSDEEP 192:DcM/K033lN5enJmIoEPAwJjr3tyErGYUAJ5CFqWY7akTMRqjhs:DcM/K033lN5enJmIoEPAwJjr3tyErGY0
TLSH
T12412BDA3D3E8866D881156F9A61C2D16DE181694536C3CEDCAE9FF4E63F1434E202A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 edc16078709e0d3718bedfe46b8027191e5d7f8562411dbc164f7b39d1524a82
MD5 505e29e966ca183715f54d9105a986e2
SHA1 5d536bd838240482d0b7c87c2b41e2b871cff190
SHA512 9156ca1545a4ed48a3978f2abf38b1a1d17ca2fc2dac8a26b933a2c6a970335320c1b6b53350966ff5770d79b01024671eefc699c51bcb1e6cc076cb42a0184b
SSDEEP 192:sxZYRMyM/jK1Ml8MkT/fasmVE6NIdpozJHW6+WN3GE/YwOW5hIgrJ:sxZYaMT/fas8E6uiJHbJ/z9
TLSH
T1F6520A126A34997BCCCBD209F941BF93D6F90572A2901D44AAFCDB0C05E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 61cc77991a0824c62b03637b99078785ebe30bfc6edee739d5dfe82775f7562b
MD5 ba6e90b29422a0672d9cdf42b134f1de
SHA1 c69fa12116e2c6450f46aecd4fa6f803f9ee984b
SHA512 ae519e0f3f9c09b4831092f79c41337aae5b35072f73aeb46c0ea43f18fa780d55120b61000c82bf40a5504c0ec57ce1bb988d35b7ea316de4809bb663a52870
SSDEEP 192:sxZtRMyMojK1Ml8MkT/fasOVEGcIIdpuGHW6+WN3tGqxYwMcjjhIg5jJ:sxZtZMT/fas0EGENHbdvxmCX
TLSH
T12D52E7126A34597BCCDBD20DB941BF93D6F50462A2901E44AAFCDB0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c5bc148ce51619a6bad8549b4818556878efbd33c27b2a3ca8b21f01402bf53a
MD5 5bcddabc8a23ff0697926b420cd4a71d
SHA1 a264ba232fb5682c49150941f6056abda1b79d4f
SHA512 c5e58cb7acbda115b2043c838488b79f1e48172dce02d8c88de03dc5998eb329d1cabcf2abc32e33d53369fecb3978cbb0606e59a473aadf7a3126c57cc6f535
SSDEEP 192:sxZgRMyMojK1Ml8UQE9T/fasOVEGqIdpu8HW6+WN3zwnYwKjjhIg5jJ:sxZgZqiT/fas0EGjLHb8nWX
TLSH
T11162E812AA349977CCDBD20DB941BF93D6F50462A3901E44AAFCDB0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a87849e0e61e2117899d1e302e5aef83f0a59e184f22b16a3eee2f03c3e81642
MD5 faf5bd673d84fe5d551d189dfcb3e474
SHA1 d21aa9401a5c0d98af87e1676febbdb6eec06782
SHA512 ea6dd283843ab69a8bc8b35ce17fddbc64116c54ba72c4bedd74852c7543bc3c5a9438d4a0f93c93b8288fb20ff07db6851c9b7eaa38e4234f26e6c5db5045aa
SSDEEP 192:sxZgRMyMojK1Ml8MkT/fasOVEGqIdpu8HW6+WN3UKXYwNjjhIg5jJ:sxZgZMT/fas0EGjLHbdXBX
TLSH
T1D752E7126A34997B8CDBD20DB941BF93D6F51462A3901E44AAFCDB0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2b46a8a4f712c01e78b961717f1901e7e904ae9dd0c6b4eabe6b82d65b341843
MD5 b30c2bfc86bca3221ba4fe67369074e0
SHA1 369fe1b95d3e19d4f92730a1b3a857672ea5531f
SHA512 2129cc62bcb9de5828ed9877cf6d7f4f4e3220e64ff911298524f848413cc2473820842520e884fe6af98790739cdb77c8f9bff69ebc717113b6b7a925093691
SSDEEP 768:if4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d9rohMAaGn:if4jeXmWvmKxEu1jacPLZQd2nn
TLSH
T11BE20A3B240CCB7E4F844E5DED26AE972ED801CB6A584D5447FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c0f7f5a271095f67a89409dd46cb7de8fc7e9816ccce831bb802b00d336413b1
MD5 620238a242ae4f2eaa95bb79e582370b
SHA1 da971d240aaf19a7702471a7745b1d85f16d3cc8
SHA512 e5ceb9fc461d88fc05373d2d4b08dacda774be8e2877f7c1e427b7290891a6a4420c68eb9c0dd7d71329dcc680f14a41ec5db06998cdc330c370aada755b2461
SSDEEP 48:KMiNMA60EFT4P4IGYFKB0ZKFFCVgn4k+ydbIlKEcAie7gEm0wLjg96IAcLKByZCN:KQpqKikaubaKEcXjyKs02o
TLSH
T18D91D312727F02026D7E290D9754CA1B668671A33129F52B37EC40660FA7F258EFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 158B
SHA256 ba821b042acb050f86258480080d81ba9a1e1ea4b7ad55ad42a41e035eda2e04
MD5 12b70eb7cd348f10b705ccce5e1fbf7e
SHA1 aa11507e7057b34328b014ed0a419e5e60ae185b
SHA512 57705b0c0b6df1ad9139d8dfee3851aac6c1776e71de36aa9abf49c99c33dc538a35f7d1397c6a1ee394a4ab6ea596496f4c8404e752ad85753a04f18967ed1d
TLSH
T11CC08CF7240085CA0B719AC8A010FB0CE82B464CC8D1CEFC8C1861062938A238803939
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59386b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59386b.TMP
Size 165B
SHA256 9704fc402d4591c6cb2be199fb56c38bb34ed963304403852da1adcfcc1ff206
MD5 720665367a020a194ccf7803c3b134f4
SHA1 4314f555ed8bd3857dd7ad763e398af450e6d0f5
SHA512 cae4e1d267286b57edb6d4593f87912d98b7a2956de4dda531a1ab99b23fb9ad14322342dd4c107ab99946530c05eee430c951ea5845f85b1bb1509c0a393742
TLSH
T184C08CF3202085CA0B7256C8A020F74CE82B4D5CCCC1CEFC8C1931062938A238807939
MD5 SHA1 SHA512 TLSH

Submit Download

cced1fd5-e657-4081-9562-c7b8cae51d48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cced1fd5-e657-4081-9562-c7b8cae51d48.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b1efafe878027f994aaf95eec3ea5db49f3f221366a22eafb7ceecb35f389afd
MD5 11942a5ea8fa1e9598059fa8bb18cc0a
SHA1 39235150065f7b3ab62458fe37745108c75305aa
SHA512 9205685697ecb1351ac36e04d9fadc1aea67b37226dc7115c584572e02250abfdd0541e9f727d2e43f1a64d40ff20c030fdaadb536901238cba7df669abedee9
SSDEEP 384:htNn/s3n9SfsNtiI9aV41f++OWYXN+2OF6OObjI9G6w7XSi:hj+9UQl1HOVNlA629MP
TLSH
T1E7928D32A8289D334DE29AA5F48B36578FF9416B96C52FC8D6DCBF0C05DB6BC0316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1c6ef39289d9e18e00f44d1d71c67db7831a1a8fcfc9501c9d7431cf5fa9e912
MD5 d40ef1abd7c373ee08d3483d34387e4d
SHA1 1d1243cf520c6abfa13f352e3f8b5959c97ddd92
SHA512 7ff16535355da5075417fcfbb8d607f61d9cf78fc9f948632ff88f82dae355655695fbd9398d210545079624e337b999c491c36d458665906c3c882f448cbc18
SSDEEP 384:uiFptNn/s3n9Sc/sN88TUNTUlIlfI9ab+1f++OWYXN+2K4F6OObjI9G6w7XSi:FFpj+9LPwgqV1HOVNlKm629MP
TLSH
T120C219F258D78936D99E4B57F77E2D528EBDC167B5816A84B3885B0CCC861BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4edcd0487c9abfd8b4a602606e63ea9093f73d3efddaef408c0eb6a007596885
MD5 da624b9ac73a3bcebdc646c1510d1d5b
SHA1 eb520f24f8b30a6a043c91609efd38a78e323c7f
SHA512 eb2844abb008a6a258d3d8c32e5ae9509a1e5f2424faf7a95813efe8fe70c231d04939bfdef3c6333015828192720f2fa086b8b1dd752a6a0ed444840843fb07
SSDEEP 384:uiF1tNn/s3n9SczsN38TUNTUlIl7I9aV+1f++OWYXN+2cF6OObjI9G6w7XSi:FF1j+9/Cwg631HOVNla629MP
TLSH
T190C219F258D78936D99E4B57F77E2D528EBDC167B5816A84B3885B0CCC861BFC305810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1329232ba5f0685a8de7a1815ebc594f3994e963ac39d4cb3fa9475ad826ee18
MD5 3e782384be9cdb5dedae8cf655f3ff9a
SHA1 40b380e8d9be7110f795ed6c3794c88ca45408ef
SHA512 d0e813cfce2a9059eb3025c90bc4bc3d58460ab0d3999d44194595ce51eb14b8c7afac5f809bf227ca7b4df235fa2efb54adec0c054d674e6bf27586aaa565ee
SSDEEP 384:uiFItNn/s3n9Sc9sNZ8TUNTUlIRfZ9a9+1f++OWYXN+2KGF6OObjI9G6w7XSi:FFIj+9hQwgtf1HOVNlK4629MP
TLSH
T1B8D219F258D78936D9AE4B57F77E2D528EBDC167B5806A84B3885B0CCC961BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87dbd8abadec0c22abc6cb0ee014356318083cc656f51d181396940267612837
MD5 e8a1b21a171a315501ea0b6b5ce6ec70
SHA1 12f5dad4b1133cb9bf22aae86bdf36e025940ba4
SHA512 7661b506332c4941cba8ff7e404c6527bae3e45445cdfa249e256eabb837d0f0652d8a5c03201abf3d6519bb31d0ac4f81a187a2f491a35d8ddf1f8f128366ab
SSDEEP 192:EON06hZ0QmiUyOwpc/+jV4O1cYa5wOZbpU6:EON06oSpu++OWYh2NU6
TLSH
T13902EA3568686C778EE2AE45F48B77135FD8112BE9956FC4D6E81B1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 657dbb19509ee18b1376db600c5999d04ba5b4d712649abe9c6d53d9f4f0a32b
MD5 9a5c852ba9f94d2e174873ae74dee4ad
SHA1 e5cbdcedec1c2e42af385555e58ba8be293f7ba4
SHA512 c1fd937107539cdba308f2b4f8674e62c4360ee768f1b3ecf58e8552d1c33db8a352bdb33130e5f0511e99c5831bb2c96c170e56d04db411f88e74339a9d514d
SSDEEP 192:nONY6hZqQmiUyDwHc/+jV4O1cYXN+2F5cOqyqKU6:nONY665Hu++OWYXN+2g96U6
TLSH
T1E6120B326868AC375DE2A651F48736538EE95127EAC57FC8D6DC3F1C04DB6AC230A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 809ddb8d0b95bb4c36a2d93ae2b7c82c69349cdf3bde1e1f52b825527cc29a2b
MD5 5245cb400f152a55ec1a53ef4014a436
SHA1 8e6035d07d9cd951c29b08668ba6a63ab3ab031b
SHA512 d95854ecd093363b13b35a4e15d263eca2a192e0e580453a061b9b5235647a3d2c927e2076bdae737e3efb2bc03ef6de577f1b59769cb306d25a5d19b899b2e3
SSDEEP 384:KtNn/s3n9SfsNt7I9aV41f++OWYXN+2OF6OObjI9G6w7XSi:Kj+9UVl1HOVNlA629MP
TLSH
T1E2928D32A8289D334DE29AA5F48B36578FF9416B96C52FC8D6DCBF0D05DB6BC0316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f221eadcfcbfbb56667b60b8aa199332678a84feae240ebe3cd44f2e46f23394
MD5 afd53fd7ad1cee74b8a727c35a657351
SHA1 8bc84e7cec3bb3ecf3c235398d5018da10dadc96
SHA512 c5ad66d8efb14915954b417a96b87204a5bff89c82db7a6919d5b578e5667a67b65c9324d05e9ecf5e55d1a1b404ea9512f667417d32fac39ee6575c60c3c4eb
SSDEEP 384:uiFKtNn/s3n9Sc/sN88TUNTUlIlfI9a9+1f++OWYXN+2KGF6OObjI9G6w7XSi:FFKj+9LPwgqf1HOVNlK4629MP
TLSH
T181C219F258D78936D9AE4B57F77E2D528EBDC167B5816A84B3885B0CCC861BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba6a6753-d105-4b29-9c81-bb6b84c9fdf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba6a6753-d105-4b29-9c81-bb6b84c9fdf1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f63612b9a0989921e9bb410cd1abb998c144f849206324e758af93f06cbfd45
MD5 34f3ef0429b0d6282b941f5686c7a4d0
SHA1 95092d681be9215c93baeebd48d7e0d8b12336e5
SHA512 201d808d8bc43bb1ab670c234162f69756f63e4f483512b9863aa6c0745e79dd995dac94b3e8ad5fa47cc54ef257080a1e7672ac1adcac046340b313acf797dc
TLSH
T1F741EC58B6FA0145B3B36F569BF2A86D487FBC732E0BD59D10010E4E4667A40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

6e0a7404-fd28-4466-a56e-54416ae1e3405470687303228105078.tmp

Path C:\Users\Admin\AppData\Local\Temp\6e0a7404-fd28-4466-a56e-54416ae1e3405470687303228105078.tmp
Size 4.6MB
SHA256 5ea4944b9227fd003be67c59b41beeb50a51a2f7ba770c720c2d6fe5720cd627
MD5 79667d1731ee4f94ef0173328c623cbf
SHA1 097aa63e106325089c0634421168bfdbf07a9b56
SHA512 580af136b1c482b2ec8e624339c2812bc3903a919f88d8b4b5bded436e308905967c5d23e1c3e4e35add0bb37d7948bdf3e45c8d1a619aa4bbe562ce57c552d6
SSDEEP 98304:pkW7M2q4bJobLHbmy07mbyII8UVxQTJeTO/xc:pDM2heLHbmy07mbyIEATJf
TLSH
T129269DD330E451E8C477D1BA8A07B62FD66F74290B399ACB169826054F23ED07F3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Prestige-Injector.jar

Path C:\Users\Admin\Downloads\Prestige-Injector.jar
Size 111KB
SHA256 a465d6648049c33c6357cf12a6dc0c12f70366806abba49a08c713dbd37414b3
MD5 e774115a6768289eda82aede48b45422
SHA1 837988ca5b0bca14ef7ff22f0e08f0af66d72f3b
SHA512 286e1df2e8504174b56d9d703b2b9e035ce3cecbacb99986c89a98323c15ec663c348116ce3d5cdcac02ea5f29ac11875cc985b2f363eb9a6c2d549121da3790
SSDEEP 3072:OjTG/kGynmc4AwyGgmSpBJ8JieRKaqxHm7:OGcLgxp3SLj+6e
TLSH
T169B3F11E38C60478F96730717B61A041B83C5A6CE94DE01E9BEAF58FD0168853B67DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-196-0x0000020C710F0000-0x0000020C71239000-memory.dmp

Download

memory/928-197-0x0000020C710F0000-0x0000020C71239000-memory.dmp

Download

memory/2800-499-0x000001EC1DB30000-0x000001EC1DB31000-memory.dmp

Download

memory/2800-500-0x000001EC1DB30000-0x000001EC1DB31000-memory.dmp

Download

memory/2800-546-0x000001EC1DB30000-0x000001EC1DB31000-memory.dmp

Download

memory/2800-552-0x000001EC1DB30000-0x000001EC1DB31000-memory.dmp

Download

memory/2800-611-0x000001EC1DB30000-0x000001EC1DB31000-memory.dmp

Download