hxxps://ads[.]luarmor[.]net/get_key?for=Legacy_Freemium-dQsguOsXTKuO

Resubmissions

18/07/2026, 19:48

260718-yjd7labs6k8

18/07/2026, 19:47

260718-yhqh8sev215

Analysis

user interaction
yes
max time kernel
32s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/07/2026, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ads.luarmor.net/get_key?for=Legacy_Freemium-dQsguOsXTKuO
Sample260718-yhqh8sev21

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	13	https://ads.luarmor.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1d3ffb828a448be	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5972	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288776565706621"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{31FFF54D-51DF-4C70-88AB-90B57C8EDD34}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{D981C3C9-5AA1-4842-95F1-5A824E5677EC}	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3096	4680	msedge.exe	80
PID 4680 wrote to memory of 5972	4680	msedge.exe	81
PID 4680 wrote to memory of 3352	4680	msedge.exe	84
PID 4680 wrote to memory of 3352	4680	msedge.exe	84
PID 4680 wrote to memory of 3284	4680	msedge.exe	82
PID 4680 wrote to memory of 3284	4680	msedge.exe	82
PID 4680 wrote to memory of 3284	4680	msedge.exe	82
PID 4680 wrote to memory of 3800	4680	msedge.exe	85
PID 4680 wrote to memory of 3800	4680	msedge.exe	85
PID 4680 wrote to memory of 3800	4680	msedge.exe	85
PID 4680 wrote to memory of 4092	4680	msedge.exe	86
PID 4680 wrote to memory of 4092	4680	msedge.exe	86
PID 4680 wrote to memory of 4092	4680	msedge.exe	86
PID 4680 wrote to memory of 3028	4680	msedge.exe	88
PID 4680 wrote to memory of 3028	4680	msedge.exe	88
PID 4680 wrote to memory of 3028	4680	msedge.exe	88
PID 4680 wrote to memory of 6124	4680	msedge.exe	89
PID 4680 wrote to memory of 6124	4680	msedge.exe	89
PID 4680 wrote to memory of 6124	4680	msedge.exe	89
PID 4680 wrote to memory of 5460	4680	msedge.exe	90
PID 4680 wrote to memory of 5460	4680	msedge.exe	90
PID 4680 wrote to memory of 5460	4680	msedge.exe	90
PID 4680 wrote to memory of 6100	4680	msedge.exe	91
PID 4680 wrote to memory of 6100	4680	msedge.exe	91
PID 4680 wrote to memory of 3896	4680	msedge.exe	92
PID 4680 wrote to memory of 3896	4680	msedge.exe	92
PID 4680 wrote to memory of 4568	4680	msedge.exe	94
PID 4680 wrote to memory of 5740	4680	msedge.exe	95
PID 5740 wrote to memory of 4228	5740	msedge.exe	96
PID 4680 wrote to memory of 3568	4680	msedge.exe	99
PID 4680 wrote to memory of 3568	4680	msedge.exe	99
PID 4680 wrote to memory of 3568	4680	msedge.exe	99
PID 4680 wrote to memory of 2292	4680	msedge.exe	100
PID 4680 wrote to memory of 2292	4680	msedge.exe	100
PID 4680 wrote to memory of 2292	4680	msedge.exe	100
PID 4680 wrote to memory of 4828	4680	msedge.exe	101
PID 4680 wrote to memory of 4828	4680	msedge.exe	101
PID 4680 wrote to memory of 4828	4680	msedge.exe	101
PID 4680 wrote to memory of 1428	4680	msedge.exe	102
PID 4680 wrote to memory of 1428	4680	msedge.exe	102
PID 4680 wrote to memory of 1428	4680	msedge.exe	102
PID 4680 wrote to memory of 5496	4680	msedge.exe	103
PID 4680 wrote to memory of 3228	4680	msedge.exe	104
PID 4680 wrote to memory of 3228	4680	msedge.exe	104
PID 4680 wrote to memory of 5800	4680	msedge.exe	105
PID 4680 wrote to memory of 5800	4680	msedge.exe	105
PID 4680 wrote to memory of 5800	4680	msedge.exe	105
PID 4680 wrote to memory of 1380	4680	msedge.exe	106
PID 4680 wrote to memory of 1380	4680	msedge.exe	106
PID 4680 wrote to memory of 1380	4680	msedge.exe	106
PID 4680 wrote to memory of 5296	4680	msedge.exe	107
PID 4680 wrote to memory of 5296	4680	msedge.exe	107
PID 4680 wrote to memory of 5296	4680	msedge.exe	107
PID 4680 wrote to memory of 540	4680	msedge.exe	108
PID 4680 wrote to memory of 1496	4680	msedge.exe	109
PID 4680 wrote to memory of 924	4680	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ads.luarmor.net/get_key?for=Legacy_Freemium-dQsguOsXTKuO
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7fffe740c188,0x7fffe740c194,0x7fffe740c1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,10819725771396006860,13307009874055339789,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,16794068985353942176,13475394092289495226,262144 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,12796608673304522157,15424447826450475120,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,3206965985308804358,13398961791160846526,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,17548189645028226854,16137845059816571759,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,3625105187178277494,9927470215725178124,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3932,i,1801949005132362395,2864875064460464087,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4932,i,6981329505037451172,7894887045607167173,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,3718573452015823389,8731411473367518281,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,622662998629120096,3573811864223064056,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,14047446109486062305,18155853921118594241,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,14047446109486062305,18155853921118594241,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11279175376146898298,3645450763094490562,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6736,i,16365212480204644597,1403630058032738755,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5216,i,10375229193270250717,9151224175233870528,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3936,i,8713860002326888514,17434608773201370448,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3900,i,17029657885615425208,3015965510101204526,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,16885799076520072516,3735798780252044146,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,5861923762287503082,6766769715138266830,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:12
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7280,i,17982603254533150132,15771815532675695579,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6828,i,17042139052115671396,11147126033033576457,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5000,i,10083322157319306343,561476782934779555,2097152 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,2399299493329355789,10317416022198146466,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,7704698363989572569,7474954441600903421,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,10795530779034778313,12926968409947061625,524288 --field-trial-handle=2024,i,9303214165282622794,6400985274512402471,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:14
  2⤵
  PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cfac6bda1dee2a7b58b76500c898660886746f756333ed8bc916fd2e3d9ec467
MD5 9a37ed5a0fc773de6684359c2ac9a119
SHA1 4697311e9deda8cf93c4459a4a24aaf12ab27710
SHA512 40be0f1d6adf1d4b7671ef4f2255f3392cc1faf56aaa54f0eb9ac7975a21eda2ef94c2e218f1210e24da005d398da76bee0f228a2ab0df2520553c05b596bd2d
TLSH
T19CE02BAACC71A83B08FD2B1954645746EB4513576F41490F3F7DC1088FF063B464586C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 29KB
SHA256 30883e41ba0bcafe5b08329ce1f9fe509774b184f27be461770b3ceb4c95c455
MD5 a4aff72aace4c7b38aee30d5c0f17ad5
SHA1 c05d47d5d0dc4db837b56a17ad92224b21852685
SHA512 007516cbc72a4d7d0ce2850774f51ad6f43d8d30782130b86277ca499f7843ea975d343079d7bfd30c502b75c85bd7cfa04605893c56a38a77501af622ed2c10
SSDEEP 768:HPiQIBrGWsXWCc8MCbEp2ANdxrt3KfXiZ:HPi7tGBpUCw1NHMfXiZ
TLSH
T1BDD2E149A53B76EF5B6D894C33270C279306668880C3585B05FF9218D2AFFCF4E650D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 213KB
SHA256 eaad6891a77ecec70a70851201cff0f90ed4e2a9c32063472b7eceb379868259
MD5 6042fdb1f6f4e442995ccabd3c389779
SHA1 bfb703f6ab52b5773145f4238d6c9e9228011859
SHA512 deb073c1ef8f9ceba6755562c613b4f9cbf502185f7f0c783cc3dc21b56e0971b6be1101409ca3e0d59a6f20817f66ab224ad53e8d08401933f01290911283b9
SSDEEP 6144:VUA1pY0lmVsdb+3EIp72zNbcxEms3/qhtWTtbHiAIr:VUUp3lC0Ip6ZQems3ihcbCtr
TLSH
T1042413B15869BE74C21D9520B4230B196BE14DDE18CED7F6532103DBE71B7C8EAA0E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 178KB
SHA256 161036a7e230b3fe25f15e456a3d981c5095ce64938a9c5faeb1a64dc55a3e30
MD5 f4c02ac1fb77bdd049c0fd268c57355b
SHA1 e89f3a641bb6ee0bdfb8ea040d221fcea8da3330
SHA512 58063a1e4ac191b091e8c8d658e797dcd1bd73f13d9c31242ba97325cbc13bc29f985429593e1bf497a710a90d04b435a80c18a04cdbf364f7dc46be6deb914e
SSDEEP 3072:i/xMEbf2BSJVDblip/Pnr2NbIXZne5dagiCg0mrTY5GVo2HkwU5pgygMOs:i5MKkZPruGngLg0prwkFvKMv
TLSH
T1EF04128DF0DBA9A382C9953B28C6B17FFBC63A98D879634D21D47F68EC349034561212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 34KB
SHA256 fcc27adf1ecbaaef14a53f2495e86d17e5464a85173b954198a644265d2107a2
MD5 bcebe954fad7b485b35ef60a09537b81
SHA1 f93fc783f37d587a91e4a3aa7b32e75f47ea156c
SHA512 0e517b51e588449537140382a675e9fd0835e16bab24bd8ef6983620d1d85393a36cef822cb1c86e6112c94fd5fd2df53b686c07bec826dc7ce6451ade583542
SSDEEP 768:DUuyvn3YW6dUpuwD9q/UfCMV3yEPqDh2VMrAy973U5MXaEvoPpysYms:gtvn3YW8UpuwDHdV37VMrHU+0Ud
TLSH
T133F2F1A9435F3512B7C87B222512898F107F67C6E59092F7D0CA927983E78C6143EA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c4319bd6260019d7843067d7597994d8eed0eb64ecf994fda4df07073197a131
MD5 b82a5460b56a2537b0d1ff2f4c751fd9
SHA1 b85c170e1f169a4d01d9dbdad1497edad9972d29
SHA512 82cdd41986e6c16b66b49edbd1a8730d9bbf8e4ba9eff340308bd43aa2c4d0cfd739d509f99681d840491dabbba89b44afc0a3c022497a4a467ac1c7c06588c5
SSDEEP 192:sxZERJyMqZjK1Ml8MFY/fLsyKPqRKTG7wezodp3t2/W6+WN7vc/Y0hi7OGIgj+EJ:sxZEWdY/fLsyKPqRUjw/bw/5yj+I
TLSH
T19F62E9466A349937CCD7D309F545BF53D6F5156392504E44AAFCCB0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 19c7e716cb0009962ae437fff947c8aed437f3beaf899fa59e721e19988d77d9
MD5 debf8c89ca73e7e9cd2582842403230d
SHA1 2ef3083db752ca30644cd60aa24cc67a2701b0e8
SHA512 708593427446f5716ee1ae4797c759678e48152eb01ecc8e012c77e093fb52c2a605062f219d25166c3ef6d8bd88fbdb75ffc7d293b9dbbfcb8c1c01fafd7a78
SSDEEP 768:wQAKq8y028bWRmj1QIT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroS7:wQAKq8y028bWRmj1QITu1jaKL4LpfiE/
TLSH
T1E1E21B3B280CCB7E4FC44E9DED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 d1c5f415cbfd896d4cd3a8926bc2159e0545fb83589b2ba316572b27b674e812
MD5 5a5333c98ce9052acbd3017d4b7a7088
SHA1 2b553da044275b8e288b89f8978bb3f4c48f8fd2
SHA512 5d03d50e3e58e2760bf40e5132ffc74a0f1d9a67fc8cc500e86c2e0ed3cf2f512f9e0f8397e1c6699679554390cc6fab86709b9efeecbafd4c80f859245fe50e
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5k:GZLVDJjEDPV0/ZdsLb
TLSH
T1A3A2480232BA02423C7D290C93979B674A42F1633469AD7F7BB900B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 fae8a8b3d550a8922856d6ffa2be72b0f0e4740e3f6891c154f65b1cf3f8f911
MD5 5ad16f1ece5ac21636cdf4dbec7517e7
SHA1 f0c2798a3b4d92e4148503cc2c619004f3f7a48c
SHA512 ba93cf9729aa79ce3b1d566717ff308407ca1698dc4fe2c6422dfff876315de93145ec27c35d4f62a0471f1aae98e98caf277a5da408ecc6a1d7478f116a1fa7
TLSH
T110B002BF104355C31E6234EB014932DDC52673CCACD1DAAC95722074335056E2442D34
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 6f0bbbe158e8d69f9cf821a6b72c5a7b2452732df89b88b847fff1a58f421804
MD5 d77687b6650be6adf5f9cba3f2091413
SHA1 0ae635118dd0b806137b22898dee928b9b7acf6f
SHA512 a0021a66bb75e8a9bfb99202f537ef234ec6e225b9ef779428a9574f3baa67ac1c83870104605b0cf970e6d2003bd6c8d94e2ecef03fa7f22512c6fd5efd4df6
TLSH
T17BC0807F504251D33E1734EE031672F4C97A7FDC9CD1955C4461302873708161501934
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 49cb45e3941d7446cfdc04ec5fd7d52d396b1e4560cde0371773e135a2ded342
MD5 bd2aabdf81e531c9d48a6a277550ca80
SHA1 79decf7753df7ff0d68844a1dabbb33eb67e2d2b
SHA512 c37347a1b012ade159943af54408f82554815d763d4f593cf1aa946bc816b433320e3d1a8b3a2fe6ceeeb0ad0799b9a5ff9915fcf7f9daa3b49e45b7c0e78643
TLSH
T148C0127B1042D5C22E5134EF918533D9C97A7FC85CC0959C4963301562348151511A20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589cb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe589cb8.TMP
Size 178B
SHA256 0a5e7e3db2b9532e590539135fd3609ddffdde1a2ab04193fd8e982389c8e664
MD5 06a3c09ef4180f519668758e31d6ab2a
SHA1 3e1d6e69897a987bf8bf7baea9a188ad247a3ca1
SHA512 5f033833c7b7a9b2f88ec5fc6d7e2ee1ab88cc44018e9a9d5534c479b4c53d98f00372fc410db0df0d7d627f24dde05161b813a16d97905bbf416898f33d4277
TLSH
T1D6C0127B50C282C36A5124EB421972C8C5357FD85DC0D66C8A2231982230C5D5501A34
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 89ed4f377156688032c3a4f1471232903affd28b4b4578865484f0c88381c5b3
MD5 7697ea6022170007e4e816d2ee4af8bb
SHA1 425d2c3b064d75b747b596bcd4437e3f17d2edd9
SHA512 54f4f45e46a71c914c3693ae8e3052c6622ad80a1c0b673f722279ea7152fc556fdcbf07b5601974681f80f0ae1e6744f88cfec68f07e916ea8ac4c1eb2ee5fd
SSDEEP 384:nDriF1tNn/s3n9SX8NL8TUNTUlIRaPm3ek32nn9ns024Jfb8GgFRLCaGBIS4cOO1:KF1j+9ocwg8KekmC0mGyRLesc29MF
TLSH
T126D25B31E854CABBECE68ED9B74E3A42EEE04163868C5AD8D6DD5E0C04D71ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a6d50725fec9d586dd26268a3f358cb1694eef8c9a8df32e9dcce59d8dbed1f7
MD5 c121da32cae230eed3d9eb507a3135db
SHA1 f40bf463103c7c3017b822191d13a79a488ddf6f
SHA512 a81f303462b01adb54af449e4c8901d402cf59f5c292ad88f4e04ee20727498a339eb79274fb608957864b6a6950e1432e1be2a71ccd71a019b7e02100a73874
SSDEEP 384:nDriF9CcmyWCF38NL8TUNTUlIRaPm3ek32nn9F1T4Jfb8GgFRLCaGBISVcALVtyB:KFccpF3cwg8Kekm15GyRLepcCY
TLSH
T161B23931E864CABBECEA4F99B70E7643EEE04163968C5AD8DADD1D1C009B1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0b85009439c4907ae2a4a656adbcf4d1badbb182dfa3e436c9c293cf8521c654
MD5 0f0422ed495d81bf841a0c6796f2b1cf
SHA1 4b077ebb7717f452c4ed9e80c2fd97496c4a0dd1
SHA512 15552717fcf5d38ffb9410ae7bbd182c5f739ca4d412aaaaaf320a9f30fa43d2b23eb9bdb72a5dae537f6c9205c8a7a92d6af9c1d54dd9d97d8f578c98b6c780
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BEQMs4Jfb8GgFRLCaGByyUe4KV8P:VFccps39wgPKekms/wGyRLeQ3I8p0yt
TLSH
T187B26C31EC68CABBECEA4F99B70E7A02DEE05163858C59E8DADC5D0C109719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ad559cb99256d4756d50a304212cf1ae524ff1e37c9f4cd0b938215ffda620e2
MD5 8620e4ca9a7b2262cf68a030721e8b53
SHA1 a9125f5007ac80daaaa35191e2185582699c5468
SHA512 0a06b2f22112b8874de5ad451df2db1f48a157820d4b2f7d06527e3786679934f3152577c138cebe673c471d6deb423b392f12e2dd876dae99632220179b7eac
SSDEEP 384:nKiF9CcmyWCs38N/8TUNTUlIxBPm3ek32nn9iIg4Jfb8GgFRLCaGBISVce4KV8pB:BFccps3swgPKekm9MGyRLepcI8p0yt
TLSH
T17CC25C31E854CABBECE64F99B74E7603DEE04263968C99E4DADD1D0C109B1DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1da4254f89b10b80bbee274e97beecebf0a397818399ee59d637bb8bc9da9bbe
MD5 17c3c4df147f5724f78e6c824cbbfe03
SHA1 b45a9f2adb26be3880d3616b1598eeb57f2c2e9a
SHA512 af640a5ceb4c6b77959e61fa5ced370c9e076d6be144522a8442983eec88736bf832639acc7ba62c752a6c5248d053dd04f222ea3420479c0399cb30e6106973
TLSH
T119E00213930000FEC02C433104C7652036F7D07006F343495D5041B41C233101E30B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58b7d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b7d2.TMP
Size 392B
SHA256 2fc170bf2536d07e9982c3b3e2331361ed94ca382dc8b24f6b2278437dfca7e9
MD5 43028406f4f2ec84fac2d713f2e3f88c
SHA1 36fe44c9d77f2f744e0789984f1bb1ff3a8001e9
SHA512 0196c8474f968d6561b0a337d7586c2b8cb91e64cf6c9dca4cdae4d53364bbe463cf6db436bda9cb92e5a143cbccbef96d10cb41f264b9cf92289f9bc98896ff
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads