overlord | hxxps://cdn[.]discordapp[.]com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769[.]exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&

Analysis

max time kernel
898s
max time network
735s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&
Sample260729-appnhsda95

Score

10^/10

discovery overlord persistence ransomware rat

Malware Config

Extracted

Family

overlord

leasing-editorial-families-automation.trycloudflare.com

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	3436	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297582474726784"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{B8960E32-7707-418F-BA31-B81B4A602160}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 5044	4952	msedge.exe	82
PID 4952 wrote to memory of 3436	4952	msedge.exe	83
PID 4952 wrote to memory of 3828	4952	msedge.exe	84
PID 4952 wrote to memory of 3828	4952	msedge.exe	84
PID 4952 wrote to memory of 3828	4952	msedge.exe	84
PID 4952 wrote to memory of 3088	4952	msedge.exe	85
PID 4952 wrote to memory of 3088	4952	msedge.exe	85
PID 4952 wrote to memory of 1140	4952	msedge.exe	86
PID 4952 wrote to memory of 1588	4952	msedge.exe	87
PID 4952 wrote to memory of 1140	4952	msedge.exe	86
PID 4952 wrote to memory of 1140	4952	msedge.exe	86
PID 4952 wrote to memory of 1588	4952	msedge.exe	87
PID 4952 wrote to memory of 1588	4952	msedge.exe	87
PID 4952 wrote to memory of 4204	4952	msedge.exe	88
PID 4952 wrote to memory of 3396	4952	msedge.exe	89
PID 4952 wrote to memory of 4204	4952	msedge.exe	88
PID 4952 wrote to memory of 4204	4952	msedge.exe	88
PID 4952 wrote to memory of 3396	4952	msedge.exe	89
PID 4952 wrote to memory of 3396	4952	msedge.exe	89
PID 4952 wrote to memory of 3944	4952	msedge.exe	93
PID 4952 wrote to memory of 2912	4952	msedge.exe	94
PID 4952 wrote to memory of 3944	4952	msedge.exe	93
PID 4952 wrote to memory of 2912	4952	msedge.exe	94
PID 4952 wrote to memory of 652	4952	msedge.exe	95
PID 4952 wrote to memory of 3020	4952	msedge.exe	96
PID 4952 wrote to memory of 652	4952	msedge.exe	95
PID 4952 wrote to memory of 3020	4952	msedge.exe	96
PID 4952 wrote to memory of 3020	4952	msedge.exe	96
PID 4952 wrote to memory of 1780	4952	msedge.exe	98
PID 4952 wrote to memory of 3204	4952	msedge.exe	101
PID 4952 wrote to memory of 1780	4952	msedge.exe	104
PID 4952 wrote to memory of 228	4952	msedge.exe	105
PID 4952 wrote to memory of 372	4952	msedge.exe	106
PID 4952 wrote to memory of 1592	4952	msedge.exe	107
PID 4952 wrote to memory of 1592	4952	msedge.exe	107
PID 4952 wrote to memory of 1476	4952	msedge.exe	113
PID 4952 wrote to memory of 1476	4952	msedge.exe	113
PID 4952 wrote to memory of 4292	4952	msedge.exe	116
PID 4952 wrote to memory of 2072	4952	msedge.exe	117
PID 4952 wrote to memory of 2072	4952	msedge.exe	117
PID 4952 wrote to memory of 1780	4952	msedge.exe	118
PID 4952 wrote to memory of 1780	4952	msedge.exe	118
PID 4952 wrote to memory of 3176	4952	msedge.exe	119
PID 4952 wrote to memory of 3176	4952	msedge.exe	119
PID 4952 wrote to memory of 3240	4952	msedge.exe	120
PID 4952 wrote to memory of 3240	4952	msedge.exe	120
PID 4952 wrote to memory of 4608	4952	msedge.exe	121
PID 4952 wrote to memory of 4608	4952	msedge.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaeab4c188,0x7ffaeab4c194,0x7ffaeab4c1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15455154171671519119,14069381389355939747,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9096215562785178050,14017869703306319252,262144 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,2442412958490132303,13183112418795638903,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,8196026274939221261,12310907086745783462,2097152 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,6265059150173388157,13162601489345861468,2097152 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,17705211066943318052,8204902085445265568,2097152 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,17119154346586968946,13317773861755495723,2097152 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4589153053321753117,15121049911186722163,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6748966293053648678,4702393681989675394,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,704456845888366204,10899386196902180184,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5796,i,7397500173274902005,13210830358824633421,2097152 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,15944420834313172331,921056675291912246,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,6354705109965105035,4703798986241095930,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,6354705109965105035,4703798986241095930,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,3667455526874305776,11427482230211048469,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,9015012452323964647,2962054026989229198,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,333876298855435293,2560475942673701155,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7737743937607105914,10141272641101682022,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,13293195340044265118,970092792749299039,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,6150431513202707174,5254942358471670622,262144 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,16126075279329806716,12481404609165186828,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,18250236082477224758,11374720390669340954,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,6083474703193450688,2132290177082405350,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,17904404161939877667,17197343631451130006,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9994147976075225163,6448686276618137127,524288 --field-trial-handle=2224,i,17705949784404079020,4872402599656223448,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce9a45431fb053f46812395470c2ff6c9ccd1803075551fd01e4a51c3c4ecd4b
MD5 c8badd2ef76875dd0b2d479d596fe3d1
SHA1 e23e952ecb4d88e34cbd5328967dec2f0f4c9504
SHA512 049fd794e8c8698f9a3908ef9cdd577b41b7919eab42ac9ba4c6f3c4ba05742d9a6be6ee3b7daed591a94beeef3ba099eaaa2b4dcec22661479634920a672af6
TLSH
T16DD080333B1A7000D7955171D423C715533F446574838611F114C84DEDF51D953C2193
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c0f239c7ed32f1c492df19d463edf2073ad4d721081b4a3b14c372062cca32ba
MD5 c315998145f0e2e943e87f7e58d6d900
SHA1 33d11ba46613900b72e84b37dd01a1855d594067
SHA512 bb251b0b7711a8694b23a7203d473d97a43c26db6edaffb49e2fa8046fe77babe795a833ff93e67f2984697d704d9d6ccd1f8ce0d2024615aa3c0d6e5d7ba75b
TLSH
T114D080333B5A7000DB955171D422C715533F44657483C712F114C84DDDF51D953C2193
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 de4d3c7564c8d7a989110c3545c028cd83dfac71ba86950e4010c9c5a25ad8eb
MD5 37eb249192faa16e265cf3ef344dc9e4
SHA1 0a73e18eecbb0b4b3a6b16f608c578b5b7513e67
SHA512 d43aba3e295518bb7bef901d9813c6e51ec6bbd588d9986cb4944482c54d6a12a23b0d27418c77ee1616731b7895ae964a9235a23af87255ecf34e23bcbfc3cf
TLSH
T138E020C804C5C27DD3006547457C670C7280360B97C469C56B2C89593142064E7D7AE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 bfa46801747b67d73ef0557edd1e42d26d44874ca319e4af04d992ddb772035a
MD5 2f5808553d7c7a288f4fca67e5f2aac8
SHA1 a9b53fe4fa82e59dc4564b78d8409214195a71a2
SHA512 021209f8cff60ef27273d0d08c7815fe5af04176e7d78b21cee99029e4a6c6d931e091a9538fac1ea20f8c236310743a4d8bf3b6a6ec1536d67b778f11412c35
TLSH
T114E0208815CDC25FA11469C78178734F5341374B93CC69551B0C8D5A30454506BD9DF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 614d8a30dcfa64e1f577eee6b5f656a909bb576ca531bc4f2ea3c26f80adab0d
MD5 4a8145110f4810ba9d0052ec5aeac96e
SHA1 3c1b0b1844bd5762e70b84bae0655b945e82a175
SHA512 a06184ce9c012a8acd6ebb447b095f813af035672ca65acc55d88a4560283649b637ba193105955b4f647719db82a2fc04435fee001ddf525e12e695ed35fa1b
TLSH
T1A8E020C904F5C21D9310F48B4578731C61C0370A97C46F471F0CC569354558067D5A60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b007d5ab155232f71ad0f1395b769a29f9b83825cc2244e8cb4efc97257b68f
MD5 41ce7602ca3cd1c5a1deb32ea2da2178
SHA1 04303c88e180f01979450626e00ad0a6fcbb0e56
SHA512 a49c8b1ec4e3f9fdf07a51d2742b17f4a6ed33559da166aaa051b9369eea19a5ef894a8082cf9cc1270becc3adf425d051d999f721425681b189d017e73f806f
TLSH
T190713B1A31C5F8EDD3AFF0F19CE2350D757F83B189362E5A915098B53B25F218A25A48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5877fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5877fa.TMP
Size 3KB
SHA256 a5298ff40ec15f615147634bb4a7cb1a4d6678c2bd4760d281b274b1c010ccfc
MD5 32580999cc33d413d0d7e270ae4abffe
SHA1 8c7d7bd327137452008849966e748ee25d105146
SHA512 9b13c8e07868a1619a6aa018aa8e32cc53e5ce5403d3db94187d56a1175d529dbd925a6627900de021a7852bee0344c6219624cf86b10fb1c2fab301ff1f7014
TLSH
T149713B1A32C5FCEDD3AFF0F19CE2350D757F83B189362E5A915098B53B25F218A25648
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 32e7e340f9a2ebf1816ce416e7a54b3d412ffac7856c45f160cecd262388bc52
MD5 bb7449b0245b93ad22bea2728a69eeb8
SHA1 281b09fded682bf0a67e4474393ae1e35fc788a1
SHA512 2fd88c0e3ed943ed3393b5e84b2c3f473238e1faf40757b8b51e9abf8c0bb1a196fb24157cb2ee003686e8b2e8c3a0f6a574deb5d572fabc8007c4d8d6059108
TLSH
T1C82198F7C3D5866EC94116F0AA24AE2BCE2D051583287C1A89D4EF9BD7E30A2E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c93eee0c5ada79c6bc2d53c6509a3d33e87e97a94c60bd7687da4734ccfe8774
MD5 7be408fb9ab96c6cb22a9b8d7ff7ceee
SHA1 43e98bf12d2b16f377e2941e2c43f31a3c4f93ac
SHA512 a441462448819fd626204177f9f1b823c8ca195e897d802cd1a539c1dfc181f5c4e36c201c66aefc77056596d7a8fcce5a3f2d60411767781acd099cc335b4a0
TLSH
T12D219DF787E1865EC91516F06A14AE2BCE2D0515831C7C2A89D0EF6BD7E3072E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b5e5f236c10d61044d82cf9a9e43a88033567717723779c365495434ac83d694
MD5 19899916645c8360b2f3169022f28e1c
SHA1 d5c3ccf331881b3560e9a3f8a6eb36d3fc6a5c73
SHA512 a11e2ef245e127896e8c3f4e7d8c71f5daabdb3b7b7b8e1ad335b84c0ded6179a61a57564cb446ceee1830b5940dd7f2e1300a70569e1bc24d4d9e0503cefb20
SSDEEP 192:sxZlRGyM/jK1Ml8M9m/fYsjGfXeIdpJHW6+WNGYnsAKLMIgrJ:sxZl81m/fYsjiXPJHbGnM9
TLSH
T10D42D716AA389977CCCBD209BA45BF53D6F95462D2900D44A9FCCA0C04E6AED2307C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2a256f22182529c7955c6bd8ee6df210d5015b38da02acd5be329d9f857a1f3d
MD5 5724376a036a74c86391065e409b7dfe
SHA1 6140e77f6b1f3e2a9e9c5eb23073f0aca171e6e0
SHA512 412e53920495522b5770a74c7e9bab3420e752849783cebeba01176c2e8fbe03e3b7f06ae60c9232f4bec9f4d2ed79e59cab8f1832d140ef49d3b737cd7a155e
SSDEEP 192:sxZlRGyM/jK1Ml8UQL9m/fYsGRGvXeIdpLHW6+WNGYnzfxLMIg5tNJ:sxZl8q5m/fYsc2XPLHbGQM7
TLSH
T10D52D816AA385977CCDBD209BA457F53D6F95472D2900E44A9FCCA0C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d806c738a0902a99b14983f93767f79a3e521d3ebeef9419711a326619bce189
MD5 30b6ff9634725446688a6c84055d47fc
SHA1 2906a6fb6ff8e9047d0df4c64c1e4502548aef3a
SHA512 c06a896e45406e4481826a06c53dfeedd82bd26fd8472018701ff9c224d5fec864defda9df11d61380285e8635e3bfa5d3095cb45c93b791b988e41a52215f1a
SSDEEP 768:nGQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshIro/VxDsN:nGQRMvUWv0sTgu1jakTLROhz/VxIN
TLSH
T195D21C3B284CCB7E4F841E6CEC26AF976DD801CBA7984D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1e15a7570791b8d2156e90fdaa447f6e593e9ca77a4278d9fd2240799e1ea4cb
MD5 cfc46cd699cada03021360179fe84d56
SHA1 abbb0ce5d56a9714abb04ca247f9a4a33a3d3e66
SHA512 311056e4c520cf2ee1a40e95ca5f34f943f0a558dfbce9f055661cd412d32234af67b0fa5a4d26df56b390ba6776229b57f40efed3866f5727bdcbb722535b05
SSDEEP 48:KE2I/Kv687ySzwz9zUzgzaz2zSzkiz2zfzPIfzYzkK8zB0zyzkIzAz0Nz/zazAzR:KE2gKv6SOv+KoY+y20K/a3lmbXdDzF46
TLSH
T14D917852303E42D228BE24099296C7375E833177735CE96F3F6814A64E6AE122CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db63bf7e-2deb-4a37-8554-c7279f659912.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\db63bf7e-2deb-4a37-8554-c7279f659912.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1f7280e495e5e38e2461edf9c496f7c0bf0d92be434264e4be7b3e252112f504
MD5 0d96eda0a580e6148e911424471a032b
SHA1 69ceb50d3af217b8556f66eb922e19d7a451fb55
SHA512 3d0ad659d4f5cac8cc8c5a6a09d8328f9d5eb10d42cf50d00168b5f299ab8c974f4d063f6dddc21888014e9962964e05357090e894c6170aa4b49841ffb19184
SSDEEP 384:XiFiZcIxzsNF8TUNTUlIlkJXKecpIX54atlpNVZhe0Scjmw79:SFQB0wg+Kr6xrpZg01jX9
TLSH
T13CA26E339C68987FAEF6DA56F9463613DEF45163C6C4AB90D6EC9A0C40DB19C030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 964a8ba2656aa4e5acd3a2a85cc02d88fc5fe6c74f14f39007d56358791b6036
MD5 9c512e2703d2b5a301c77c8494a05ae4
SHA1 6b860ac11acc7f25397827f5bcfc8a5a4290b501
SHA512 421191dc8783a042404784bd37ac2ffa1812c43c8722d599a1fcc1bbb700a7a2caaf90e158ecced20b277a55c4dfea6b8b4efdac1211832384c410d3c23fc1a7
SSDEEP 192:CONO6G+bgQmiUyhnDE54aP1lpNXFD8OyxaU6:CONO6HgKDE54atlpNVOIU6
TLSH
T17302D935A8782CB79FF3AE46B5872B135FD5112BE6D16B84DAEC1B1C40DB24C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 788e2d907842d2024da5f293d7adb48a1ea32aeab2a6a65a36f8c1aecb54e811
MD5 244aa0b603118d85825d4bbcef06a040
SHA1 6b58d87f8d3a949bd9ec6f8e9036ec1e70562fbd
SHA512 20b7391f5237dae0575d6314581c8f44bb98ebd29ea45325bea9d1e89178c2e3c1116b6000bf220939301a0d6f5df9aa2ace8c36453cb86e1ddd0e3eb3388150
SSDEEP 384:NZcIhsN7kJXKecpIX54atlpNVZhL0Scjmw79:VhJKr6xrpZN01jX9
TLSH
T1BC927E329C785C6A9EE2D556F8863A139EA89123D7C46B40D9FCAB0C41DF19C030F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ca1b3ca3311a1a48b986e6cf7853741c22b67829d44cdd86126f6e9910af3da9
MD5 e8df77427f983dad7e089e6df2647032
SHA1 b4e5e5422e3912552e09b081ea926ab03cf139e8
SHA512 e35096b646b85c1e3f64ec61e476125fee9111f8be55c78db1a043d1a357fb877f5d52b2ec813847bfde3330308327ae161257f54b2535e64840d2f66cc015ca
SSDEEP 384:gZcIhsN7kgXKecpIX54atlpNVZhL0Scjmw79:ehsKr6xrpZN01jX9
TLSH
T148927E329C786C6A9EE2D556F8873A139EA89163D7C46B40D9FCAB0C41DB19C030F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24c68591043928021fa1d3db9e8b0a9b7fe899709a056088a4144edd95d1ebd2
MD5 e8533e6d8f598b2b0992ad761f772550
SHA1 55790ec3b39f4267a9878e44eaf965d440d72827
SHA512 1d568ba8f1312bd4056007171ab1c753d0238b0338045005c2aca7b1785af32a11bc88b7e144ab96d0affdd95a5297a1cb9bf78348289b1714c5c8e68d2e7ba1
SSDEEP 192:oONG6G+bTQmiUy4n4E54aP1lpNXFZh5eJN8Sh5qbpU6:oONG6HFd4E54atlpNVZh00U6
TLSH
T19B120A36A8786C7B5EE3E896B48739135EA94217E7C5BB50D6EC270C01EF19C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a476d1930df9b1e6ffeec492045f989943caf4d3379b45710ad6974e1ed081b
MD5 e21c8d689724df3b0674bc6fbe0633ca
SHA1 1477665ab7694a7d68bb9e92df019fc615689a2e
SHA512 dfe0063cc9490bc30ef05d4a80fce911eb059190484ca5816799bf85fce663a4aaf7a2ca097894105bc7a297bb73c1fd19b263ba3784b3ce652e043eabc80429
TLSH
T14E412859B6FE2148B3B76E1AABF7982D487BB8772E46D55E10110D4F0A23A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

agent-windows-amd64-ccf9a769.exe.crdownload

Path C:\Users\Admin\Downloads\agent-windows-amd64-ccf9a769.exe.crdownload
Size 11.8MB
SHA256 1d5b35adeb1ab7cba49578101896ab686d084a50f5cab83ec34d963a80fcbdc1
MD5 d12a6035552c836b2e687b0ec306bcfb
SHA1 6c9180460d0ebeab6986c33ddda2ec57b59de24d
SHA512 918d95ebe9cac9ec712b86a5217f0ae7d3bbb3839d087305d71eb7f45f91479fba211365465ba9223833e33bd15037ff4efc7be0b2a1cec74d699847804f6460
SSDEEP 98304:aZiFdOQQXr26aRzcoTosirv1D5uLB9h7EREE:+CgQCQVg1D54n2R9
TLSH
T13BC64907E9A949E8C1ADC530C576A223BB717C894B3127D72B50B6787F76BD0ADB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download