overlord | hxxps://cdn[.]discordapp[.]com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769[.]exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&

Analysis

max time kernel
899s
max time network
757s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&
Sample260729-appnhsda95

Score

10^/10

discovery overlord rat

Malware Config

Extracted

Family

overlord

leasing-editorial-families-automation.trycloudflare.com

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	3748	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3748	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297582349131304"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{3CFCE57B-2CBD-4B8A-AA7A-E0410DA89AD4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1952	4908	msedge.exe	86
PID 4908 wrote to memory of 3620	4908	msedge.exe	87
PID 4908 wrote to memory of 3748	4908	msedge.exe	88
PID 4908 wrote to memory of 3620	4908	msedge.exe	87
PID 4908 wrote to memory of 3620	4908	msedge.exe	87
PID 4908 wrote to memory of 4628	4908	msedge.exe	89
PID 4908 wrote to memory of 4628	4908	msedge.exe	89
PID 4908 wrote to memory of 2148	4908	msedge.exe	90
PID 4908 wrote to memory of 2148	4908	msedge.exe	90
PID 4908 wrote to memory of 2148	4908	msedge.exe	90
PID 4908 wrote to memory of 1408	4908	msedge.exe	91
PID 4908 wrote to memory of 1408	4908	msedge.exe	91
PID 4908 wrote to memory of 1408	4908	msedge.exe	91
PID 4908 wrote to memory of 3644	4908	msedge.exe	93
PID 4908 wrote to memory of 212	4908	msedge.exe	94
PID 4908 wrote to memory of 3644	4908	msedge.exe	93
PID 4908 wrote to memory of 3644	4908	msedge.exe	93
PID 4908 wrote to memory of 212	4908	msedge.exe	94
PID 4908 wrote to memory of 212	4908	msedge.exe	94
PID 4908 wrote to memory of 4716	4908	msedge.exe	99
PID 4908 wrote to memory of 4716	4908	msedge.exe	99
PID 4908 wrote to memory of 3848	4908	msedge.exe	100
PID 4908 wrote to memory of 3848	4908	msedge.exe	100
PID 4908 wrote to memory of 4416	4908	msedge.exe	101
PID 4908 wrote to memory of 5064	4908	msedge.exe	102
PID 4908 wrote to memory of 4416	4908	msedge.exe	101
PID 4908 wrote to memory of 5064	4908	msedge.exe	102
PID 4908 wrote to memory of 5064	4908	msedge.exe	102
PID 4908 wrote to memory of 4412	4908	msedge.exe	104
PID 4908 wrote to memory of 2684	4908	msedge.exe	105
PID 4908 wrote to memory of 1200	4908	msedge.exe	117
PID 4908 wrote to memory of 4484	4908	msedge.exe	118
PID 4908 wrote to memory of 556	4908	msedge.exe	119
PID 4908 wrote to memory of 2348	4908	msedge.exe	121
PID 4908 wrote to memory of 2348	4908	msedge.exe	121
PID 4908 wrote to memory of 220	4908	msedge.exe	122
PID 4908 wrote to memory of 220	4908	msedge.exe	122
PID 4908 wrote to memory of 2256	4908	msedge.exe	124
PID 4908 wrote to memory of 420	4908	msedge.exe	125
PID 4908 wrote to memory of 1256	4908	msedge.exe	126
PID 4908 wrote to memory of 420	4908	msedge.exe	125
PID 4908 wrote to memory of 1256	4908	msedge.exe	126
PID 4908 wrote to memory of 2700	4908	msedge.exe	127
PID 4908 wrote to memory of 2700	4908	msedge.exe	127
PID 4908 wrote to memory of 2736	4908	msedge.exe	128
PID 4908 wrote to memory of 2736	4908	msedge.exe	128
PID 4908 wrote to memory of 1492	4908	msedge.exe	131
PID 4908 wrote to memory of 1492	4908	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffdbabec188,0x7ffdbabec194,0x7ffdbabec1a0
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6759922342700660925,1041832927847669125,262144 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,16883119773947349126,3886217610362955305,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,16426589561765119187,2563706119869129649,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7573323864047531442,4900517948138326022,2097152 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2469414763686361896,3069777298469902379,2097152 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9524735859285992031,14292237635044688633,2097152 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,17266485661295335320,3587628146194165335,2097152 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5474324266952188814,9005248187135968144,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,2107083163141883589,7461746111712978288,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7681790040548963018,2956629645264970556,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5724,i,1084277428010872824,11453771876611666384,2097152 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1371378644060238905,12135570328506155939,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1371378644060238905,12135570328506155939,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,8582334935253760607,7610556016356495883,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,3956865085083715289,2538004153221581858,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,13504291785633816736,16510345505236250377,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6230426662645294546,11304353571763449998,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,17817359660463526176,14081395892742479636,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,16319262278440563909,16583460927768087371,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,5079697301419572617,10738567338322337352,262144 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,2627489372651430063,11890697755906947203,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,2960315563134855223,16065532015104823713,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3260,i,8103661923112930873,526274276239057312,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,11636097120060133552,4303222244291463671,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,10138705827484722875,16923267689619431584,524288 --field-trial-handle=2404,i,7428546187158206980,3409044933099845246,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 72774ca3f3430da5e093d2d144621900d20a0e3a5e683a1a1dc16fb57e062503
MD5 2e42872f09f2a2cf8290911dc822d164
SHA1 88928c30e454cd7f7cf04a94eef29e65b5ec5d1c
SHA512 3594cba6eb1ef19897ef4e4414b58feb458faf0b04460d99b1bd85acf1a9f86f1a76840ef5087800b6d1f3c970f4968f9dc1ab8f10c592051d2d429ede2080b2
TLSH
T1E2E07DC844CAC22EA3196487416C770CF280371AD2C86D8A7F1C95C97241091F3E7BA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ef48cb8eb85c24cd7b498faf7a1441f11131c95281ce2d7360afb136b281dd9f
MD5 74b0d15c6ababe82d2005cc29eab61fa
SHA1 8a00bf8e8c4d09c0a01234012070ffb95fb616e0
SHA512 044ababcd9df486d1f8b145b4e86f26cbffd5a6f5e312d30f52fea8db45a570bcda6faa4b231acb00b55e21784eb3730934ff8983e41f5025cd8612f49c23f99
TLSH
T15DE07DA8F8CAC22EA31074474B6C738C9280370AD2C8698A5F0C85A9B6010C2B7E66A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b6f9af3d96e48b8cd5c56d29abe7d409044d30aacc3555a289bbb8d604460780
MD5 e82594dd0f9b0ba0480fd3055eaac129
SHA1 2c047f85db8ff16da81249249046db6d95a0712f
SHA512 2ea225fc1990e9ed36e6e3b6935ee32bb51ec2946fbf94c0235f19c61ec73911448046c8ede48666e5a184783f2951800260ab758b101728ebfcaba6a59436d9
TLSH
T1D0E078CD04CDC21D7201A44B45D9775C91C1364BD3C479551F0CCE5D70414C973D5660
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a014201fdae2e4917961d8939f2975fde7d99814c1520ec16bb315a082951e88
MD5 d558ca5f0c37c1b0231684792e03990f
SHA1 d668df09628fd889bbbd6848940634ed92c6eb90
SHA512 5830484a2b09e001792f4cb7f3d4270d8df94f7808cb9102b76cf717d5dcd5be5888006fc516702907ff5161e7236d7b4093d299741894e40be7c8ea79d9f354
TLSH
T1D0715E3820474FB9EB22A17388CE209D7B3082F4F5125ECD5CA4E67565E1329CEC6749
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e039.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e039.TMP
Size 3KB
SHA256 054c0e4a5490455ae85b31e4d0ebd1633db92f52e478b299e93fd0698679e9cd
MD5 04ac185accf9e67342bb2191fb380321
SHA1 2c215e1670a7009a3ab7008cd1290bbd55107528
SHA512 9b740ebe25cb4ab085e49c6824ef8a551e51ec969ab5023af222ae47c697c8356e6d6faa697b856e8a654b33eb6295fb0da909bc60c8f26d454a835738fbaece
TLSH
T1A5715F3820474FB9EB22A1B388DE209D7B3082F5F4225ECD5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 147f10b2db8b6bbac5626578bede31eb4b5acc585e4f76485623a95efeccb69a
MD5 4397794bc867f7ee5609145feccdb0b4
SHA1 85c3a22daa92d315ea2be7b34b35e44b43cef0c1
SHA512 b31a21abc751f37ad6ffff7a9d1d77361bbcfad330cb48a05e05b5796cfb16a18da5a0a4963b9bba68f2ddc696f2ce9abaf982d648922e1108066bef5f71f146
TLSH
T16821C8F3C3D5866EC81107F06A146E2BCE2C091583287C1A89E4EF6BD7E3472E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 493703a75513d2e41df2ced771ff5ad8b9360499e6e632d2dab6539cc30b3189
MD5 e23c0a68d507f8a187a8f94b939a388b
SHA1 2f37b9d62bca2bb5a8b0a6cd223b521f0ef91109
SHA512 ba0e364df55be047e686e34fe9ed4bb35625289bdaf41be87731e9fc09d0010d2428e2d812e5f7039628fb0ea5ca0e246340e17fe2661fcf373777e6bee1b226
TLSH
T12221DFF387E1C65EC90516F06A14AE2BCE2D0515432C7C2A89D0EF6BD7E3072F042A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 782dc047c39b36e3990eb98779cdeda75da594d280918134f3633decb1a1fcd8
MD5 b59b7ff5aba2dd6454f00de34d5354a7
SHA1 99b14c649f76ae2ede91ee2b353d6d070dc1952b
SHA512 9dd6aad2b91d10d41d5e3e34dcfe50b94eff258a36819800f275818d0749ea4e9b3642c188b376255c046bc231c8311de679a7f056f408dd9027c789a293bc7c
SSDEEP 192:sxZ9Rg9w/fcsEqXVIdpJHW6+WNGYzc2fcIgrJ:sxZ9Yw/fcsEq2JHbGn9
TLSH
T19C22A7526E28A97B8CC7D209BB257F53E6F9503291941E58F6FC961C05E6ACD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 06ca38d74c521b5d977847c57db0619ef68470b03a2ae54b88fd40abc654bd10
MD5 11f683a14d6e969977d8c391f412b5b8
SHA1 38d10590be4df1c264868af9b5244c9c99657304
SHA512 b58da6ccb50f07ff4125f0930de6bc19fc3fbae2304e7ec38b835b34b89d6a93a0910701c350b32d8246d88693cf8cd76d14b14dcd1ca4c22233961c3e771873
SSDEEP 192:sxZ9Rg9w/fcsOqXVIdpJHW6+WNGYzc2fcIg5lJ:sxZ9Yw/fcsOq2JHbGnB
TLSH
T18522A6566E28A97B8CC7D209BB257F53D6F95032D1941E48F6FC960C05E6ACD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 92615cbcdf3d4fb2200c0fc4e63b0b846453946e5e6e12778d468ee2332a6c56
MD5 87a4567f75cd7ab25e45f85eadb0d905
SHA1 65e4ed24c0f2f0c8f6a014b883705168c564b395
SHA512 fa95e6b68d1fbdca59a9a0a8a94dc81f0473d23467044a49d52cb0b64a79926aa6cbcc5e1b4f846495de9214e14c2773de9f42013c1dec5289fe68c430ff56ea
SSDEEP 192:sxZ9Rg9w/fcsOBXVIdpJHW6+WNGYztSfcIg5PJ:sxZ9Yw/fcsOB2JHbGCn
TLSH
T13B22A7566E28A97B8CCBE209BB157F53E6F95432D1941E48B6FC970C05E6ACD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b34f348fea5dbfe748b16c1c9a1f0422554680e6bc8ea1fd14457864803da0fd
MD5 3ab639882a583caf6682457e9320acad
SHA1 851a114d8e11988dde13558af4fc02268b0ff53e
SHA512 0dbb7fb1302ec9d94881fe3c76b0a0648e84b6e97b3db5f8ae17c433e551483df4420ace6d2876cf821d688d2d651156adc449aedae8328d8511bf16ecbf9138
SSDEEP 768:aok7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBVroyAYyn:aok7u70WvqiEau1jai5LA3Bu+y
TLSH
T1E7C2E93B744CCB7E4FC01E9DAC566F973E9802C7A6988D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5e9b077a55090ae915637da163c1d74583c6f91909da043f238a1ba6b889e7f2
MD5 68dcfd55e695d5a4d7be82ce278c7038
SHA1 59f7e4c0c52b2f551a1c789053a76073f713fc5e
SHA512 48084ee2b58e0a23a6f74a21b43e6beb1d914e0d3b71311114a309e2b6a6705f42696139205988f49b9d6f376f4ebbf882eccaf6fb0d016f08de72fdcff2d5cf
SSDEEP 96:KIbCKcfJiKiQamvGKYIAFGPT9j/L+Po6EbLK8yEJL4FNg3/4aQgKNSI:sSJFnFGPT9j/6PoTb1yEJ8FNg3/4Xz
TLSH
T116C18851337B1601387E290CA3EA99678EC331637458A5AF3BB801654F27E522EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597c6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597c6a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bdb26c023b0874768c672e99357c5c76e966ef9ae539a763d7a266abe080f327
MD5 be8ee66a8fc27894d68372efb8e61549
SHA1 24e522614cc19862f7faa22766d67d5cb3391e80
SHA512 1a55111203eee8e90386c4821c2a88c1035d3447a3b0535df835de179e9512cc0745c799aa72cdff7408fc4b7efcbf9b5751d016ce0b0d4c40f5640b39b57c19
SSDEEP 384:DGiFiZcIUzsNp8TUNTUlIlpFMbIOqOdWGimDXScjmwf:5FQoYwgZMHRoGiAX1j7
TLSH
T125A26D735CA8D97FAEF6A645F48536038EB45173CAC4AB94E7ED9A0C01EA2AC1307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8551e33a4a7a7cfe0b3e53b96aefd02c630e4dbb512926698bb8561310044a0a
MD5 0aa19e90b58d898aaa6c6dd0871e12bd
SHA1 69a9cb2c473cfac48346b2245eedefbe521d0d33
SHA512 f477f317f94400513f236b30e763ab38cdca856d8fb0d4fd997dd9c1f3113ad0571a33e1c4a26ff127ac80f95cfd2869a4cb75819c4b92c49311f74d31c7f6c8
SSDEEP 192:MON364BAQmiUy41FW5GBPKmx+FdG+Po5Z4aDiZ6U6:MON36eAT7WldWFs6U6
TLSH
T1E102D835AC796C7B9EB2AE45F48637175FD8113BE6C12B44EAE85B0C019735C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0c2f02d5bef206d15709a239fa37471e9dd8a0c90b70304c8a0115d03600eac5
MD5 d2d63ff3e2f9e76c386fc023068c9815
SHA1 e183787f6f6300f2114d186e76272b90127516af
SHA512 c8ea9ccd5bd6adc59c7a98a1b094a6aaa377578f26db74d7aff818a5cf62d768d88efab31730f613254c53daefdd7616a82dfdc90f31c36e6cf401daaf27f9a0
SSDEEP 192:uaUm+xasuheOwQxMGsNXkQeTtuh5BbqhQmiU1Hw14aGBPKmx+FdG+Po5Z7pEimM7:N3ZcIhsNXkFMbIOqOdWGimAXScjmwf
TLSH
T1F1928F726C79AC2B59F6A145F4863A038FB89173DBC45B84E6FDAB0C01ED6BC1317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6f8c29396e8caaf800b29e564c88754529b90e4fb01b74243d65f9a793617ab5
MD5 3152a54f7f8cb2043f685ab8aafd4391
SHA1 80545d39125e2fcf3ab5069fe74fdece01bc7088
SHA512 bb888af007187b485cd600a81507c8b0da6f08e4c8e2cb14bedd44c7d8b455499459bdd3d4afcdfddfe4e2307f27d1e7ba7ea197368535d0d4ea6f93d12c8969
SSDEEP 192:u8Um+xasuheOwQxMGsNXpQeTtuh5BbqhQmiU1Hw14aGBPKmx+FdG+Po5Z7pEimM7:r3ZcIhsNXpFMbIOqOdWGimAXScjmwf
TLSH
T19E928F726C79AC2B59F6A145F4863A038FB89177DBC41F84E6FDAB0C01E96BC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6cd1405141097fc781754dc382a310ff66b759da080da35eeaa9a89001bc147a
MD5 0035cb816675698770177cb18adb57f1
SHA1 d97611c002a3223462100768139a2729ab5a0a08
SHA512 878aebe9cfd9ee121057e2f7ca4e439dd22e82f74c6b55a84b253ff5ffdb6ac6dfff88efce1daea613227e7444ad97d3bc371f7d57816c1e8b7cfa943a2a978a
SSDEEP 192:DON664BwQmiUyMF25GBPKmx+FdG+Po5Z7pEimMGWwkrqJU6:DON66ewr2ldWGimvXU6
TLSH
T18512F9366C78AC6B5ED26545F48636035EA8522BEB856F44E6EC6B0C01EF7AC2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1d627a1-f60b-4d16-bb70-27d69bbc0644.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f1d627a1-f60b-4d16-bb70-27d69bbc0644.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d7a348ec8d14720cf9587ceaeb0132349180042908775a20247fe61337e44a7
MD5 b1fb8c8f01135a4d634430e13dd83bcf
SHA1 3ffe88cb8e8acfcf0a5afe29bbb134fdd787829e
SHA512 7134c484b84019be9351db73a4021ca2b9ba00a4574911d74c591065684526e8341c71742969157203045b33f39bb0b8e8cb895c871786ee0eeda2823e08b6f8
TLSH
T1CD413658B7F91108B3B37F569BF2A4AD487FB9772E06D04E00010E4F0666B40C961733
MD5 SHA1 SHA512 TLSH

Submit Download

agent-windows-amd64-ccf9a769.exe.crdownload

Path C:\Users\Admin\Downloads\agent-windows-amd64-ccf9a769.exe.crdownload
Size 11.8MB
SHA256 1d5b35adeb1ab7cba49578101896ab686d084a50f5cab83ec34d963a80fcbdc1
MD5 d12a6035552c836b2e687b0ec306bcfb
SHA1 6c9180460d0ebeab6986c33ddda2ec57b59de24d
SHA512 918d95ebe9cac9ec712b86a5217f0ae7d3bbb3839d087305d71eb7f45f91479fba211365465ba9223833e33bd15037ff4efc7be0b2a1cec74d699847804f6460
SSDEEP 98304:aZiFdOQQXr26aRzcoTosirv1D5uLB9h7EREE:+CgQCQVg1D54n2R9
TLSH
T13BC64907E9A949E8C1ADC530C576A223BB717C894B3127D72B50B6787F76BD0ADB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download