90ba593a72aad7879b22e82a86b3cdc89b2b2e242840a39c1118386c6252a2e0

Analysis

user interaction
yes
max time kernel
54s
max time network
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 26KB
Sample260729-w2srlassav
SHA256 90ba593a72aad7879b22e82a86b3cdc89b2b2e242840a39c1118386c6252a2e0
MD5 64ce179e121dadadefbb6383cc6d5868
SHA1 a81061649639fd70b93052e8f9f688eee08f3d17
SHA512 b555c63b89f621f4bbeabf3b200378338b39e4a90873fa4ba645ee9ce97d08092a9ad649565de1382f59537c3fff2d4c9c7ecf6f8264832aff92d1edf5668936
SSDEEP 768:RZBsjBjrAyhtbgt4MiIO/5/9SLtl8mVW/8mVWJQZ:DMMZldmdym
TLSH
T1D6C2B36542F21425495320359FBF6F04B6B54B23658CFC08BD8C9580AFAEA778DB7BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5644	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298231377539956"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{8C960D94-1895-49AE-8006-82028DA45996}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 5096	4252	msedge.exe	89
PID 4252 wrote to memory of 5952	4252	msedge.exe	90
PID 4252 wrote to memory of 5644	4252	msedge.exe	91
PID 4252 wrote to memory of 5952	4252	msedge.exe	90
PID 4252 wrote to memory of 5952	4252	msedge.exe	90
PID 4252 wrote to memory of 2620	4252	msedge.exe	92
PID 4252 wrote to memory of 2620	4252	msedge.exe	92
PID 4252 wrote to memory of 3952	4252	msedge.exe	94
PID 4252 wrote to memory of 3952	4252	msedge.exe	94
PID 4252 wrote to memory of 3952	4252	msedge.exe	94
PID 4252 wrote to memory of 4104	4252	msedge.exe	95
PID 4252 wrote to memory of 4104	4252	msedge.exe	95
PID 4252 wrote to memory of 4104	4252	msedge.exe	95
PID 4252 wrote to memory of 2856	4252	msedge.exe	96
PID 4252 wrote to memory of 2856	4252	msedge.exe	96
PID 4252 wrote to memory of 2856	4252	msedge.exe	96
PID 4252 wrote to memory of 3024	4252	msedge.exe	97
PID 4252 wrote to memory of 3024	4252	msedge.exe	97
PID 4252 wrote to memory of 3024	4252	msedge.exe	97
PID 4252 wrote to memory of 1332	4252	msedge.exe	98
PID 4252 wrote to memory of 1332	4252	msedge.exe	98
PID 4252 wrote to memory of 1332	4252	msedge.exe	98
PID 4252 wrote to memory of 2492	4252	msedge.exe	100
PID 4252 wrote to memory of 2492	4252	msedge.exe	100
PID 4252 wrote to memory of 2836	4252	msedge.exe	101
PID 4252 wrote to memory of 2836	4252	msedge.exe	101
PID 4252 wrote to memory of 5344	4252	msedge.exe	103
PID 4252 wrote to memory of 4624	4252	msedge.exe	106
PID 4252 wrote to memory of 4624	4252	msedge.exe	106
PID 4252 wrote to memory of 4624	4252	msedge.exe	106
PID 4252 wrote to memory of 5380	4252	msedge.exe	107
PID 4252 wrote to memory of 5380	4252	msedge.exe	107
PID 4252 wrote to memory of 704	4252	msedge.exe	108
PID 4252 wrote to memory of 704	4252	msedge.exe	108
PID 4252 wrote to memory of 704	4252	msedge.exe	108
PID 4252 wrote to memory of 2936	4252	msedge.exe	109
PID 4252 wrote to memory of 2936	4252	msedge.exe	109
PID 4252 wrote to memory of 2936	4252	msedge.exe	109
PID 4252 wrote to memory of 5732	4252	msedge.exe	110
PID 4252 wrote to memory of 5732	4252	msedge.exe	110
PID 4252 wrote to memory of 5732	4252	msedge.exe	110
PID 4252 wrote to memory of 4148	4252	msedge.exe	111
PID 4252 wrote to memory of 4148	4252	msedge.exe	111
PID 4252 wrote to memory of 4148	4252	msedge.exe	111
PID 4252 wrote to memory of 6124	4252	msedge.exe	112
PID 4252 wrote to memory of 6124	4252	msedge.exe	112
PID 4252 wrote to memory of 6124	4252	msedge.exe	112
PID 4252 wrote to memory of 5224	4252	msedge.exe	113
PID 4252 wrote to memory of 5224	4252	msedge.exe	113
PID 4252 wrote to memory of 5224	4252	msedge.exe	113
PID 4252 wrote to memory of 1888	4252	msedge.exe	115
PID 4252 wrote to memory of 5412	4252	msedge.exe	116
PID 4252 wrote to memory of 1072	4252	msedge.exe	117
PID 4252 wrote to memory of 2724	4252	msedge.exe	118
PID 4252 wrote to memory of 2724	4252	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff9bdf0c188,0x7ff9bdf0c194,0x7ff9bdf0c1a0
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,526229892031918366,3019555725873617233,262144 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,1131372630467642524,13221762451045456540,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,10305436760912366893,1398979350131042729,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,908015200103377987,2728211511341392242,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,14974972107288660412,10060110535667105404,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,6400485395200411256,4194088061744343206,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,17233691514537879775,8356172739977665925,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3732,i,3864086150397019469,13919783488793673594,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,8049415832552714792,14137528154284223476,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7791592707228564029,13566483218915102611,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17371689207781802728,14818399013510929320,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17371689207781802728,14818399013510929320,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6732,i,2912936731507882141,15856336547791786726,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,12646589415359152721,467791895223104577,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5096,i,3756939945600891087,17620581138202602775,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5060,i,11130015768525250256,11573272239245859907,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5436,i,9620564501642665778,13353295535543159001,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7356,i,17292331663216193167,15009126444419991943,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2184,i,17982728231905732279,5761911847338474833,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7568,i,7072474152714500278,12650094418438607176,2097152 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,5879592357766134948,858265257169397698,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,13241594074005941115,17675237187104439805,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,3583683244438942769,9829837615119103466,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7716,i,829946911558446790,7207723434952345205,524288 --field-trial-handle=2552,i,3380420828813615567,15400051360566615535,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:12
  2⤵
  PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 60KB
SHA256 09942f492f93e5748a18748a9d5703c1d9fb2371e88bc2a01fa7779650dc40dc
MD5 bdb48354eacf1843569fdf0898e71667
SHA1 c0090b0822e5bf07180d4366700316f8de682397
SHA512 49eef2ef2dbce4b0af131555846b2f3e5180e25f1b4fd2f8cfea9d103811e6b954d1209b70ce85fcbf88eabb48399e6240a1db02544d056ae55a22b10a5f0bd4
SSDEEP 1536:l6QKCA9YwCpxAMmNB56jI+BCDMv7FoRRQOYLG/:l6QcYjaFN+8uCIDFw2K/
TLSH
T104530213EE0C472D26E597594723CF026AFD0456AF0AF40D6F8BDEF0A2686C5A35E834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 17KB
SHA256 7746a62f08647eb7fa1ba5eead45a5cff72125e9e76077afc89f5fdc12a5dec8
MD5 1f91bacf9ea781067ec6d4e4fbd5099c
SHA1 acc2e7c6b82fa32f1d9d829be8c27bc3152b896d
SHA512 ab3f1c9515e7eded2d49adfe27b5e6258fdb7e67d3c866b13b32c9c456614be1ab2c8064534a18e2366b8552a10e01640df56906548459a986b5459e7aa7ce55
SSDEEP 384:dIHvhkCZLnQB4Cb8psZSAHLGmpUb8UV2qYnasz1yaRtqKAo:duvhNZLni4Cbv5pUhVWHz8aRQa
TLSH
T1FC82D10409945B6F9EFB617E46AF01B799CB9C68040BD714E42BC20E01A9BFD6DCA377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 23KB
SHA256 6dedde7e29e3afae231f7206628de4a4a9dcfb218a18293b752c0815e7aff6ea
MD5 8846d090d83ec2d86fda6e86dc841640
SHA1 8fb32adb875e38b51c184098412fa300f2ec1191
SHA512 aebff563c015badd2544c4f3784e0a28c0ba50fbdd790fe4c26763b43754b81e29d813927652edb0151fae8cfb27e9872b6f6ec997f2c865f589e3f2d264beee
SSDEEP 384:uT13lYUT4c19e2Wkqyo90t/4q41FzxYqVDRBVjU0Lfbny1kiWR3alLUaJ2G:EZiUTD9KZ90tAR5RBVgSnya5alQux
TLSH
T17AB2E12FDA36A060212D73DA72B757E4C1408C58C7D102369FCD52B49A0B36F7DBE42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 af2c09d3461bd7bd75e0363128f32559d129a6d073f6623d608f4a52b4729992
MD5 02f15d9f7a83f74e0a777d585d9030b3
SHA1 4f5a1b9f43d82c24d570c1f83c60bd89819ccd8b
SHA512 e06ea3a60ea53f663660f3435462afef632b1e830a659a589d4c4785f16bb826586b578938bdf0b81b71a2e401449a48f4bb53e83414a1ae526409316bc8b94f
SSDEEP 96:4ha82zrO3MO2av8tMLnTBFVZaGXSUyVnjeIskO:4kzO392m76VUylM
TLSH
T165C1C85013B45552DF1D2A7226D0DD0FE6E84A481407DF4B28D1ED3AE88BEEC63D549B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0b6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0b6b.TMP
Size 3KB
SHA256 d2f3978195310d2025338c6936cd10acc97cbee9808eff289e0e354e23efbe05
MD5 cc8b70e94dbbaad031a63126a16276bc
SHA1 65ac14abdbfbbf76c7e4a842bbab0047d5dc066d
SHA512 c542cbdd2b169956abeed55ac5063fb9e7c4c0a82720ab88d753eadff3c2e4aa68764e0aa3b406e727854e49da5147095e1ac9eeeca96c5e54b55f9fdbd2f1e4
TLSH
T19661921433258AD2DF2C5EB117E0A02836FC8E582507AE1968C2ED39EC82F7873D011B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ae1824b52ac549f4fcc1a128fd054b14fab5e85e89a639eb1357ba7b5712b570
MD5 fbe9dcecbecf60859f4b5c31ddd0e38a
SHA1 06147c5a127a88873987d6926d38b8466e060287
SHA512 4fc1f2af9dedddfbde0c3574ac4a05ffd01513a51be1b2185182f4cbff0621b4efe9453af4dfe00d4ae81d2c727831450bcce258c11fa1ed5f0e60e7b7109db4
SSDEEP 192:sxRYrbU/fhscuKCA94/azoA8p4p/g6+WNIYD986SIGXnIgIJ:sxRYPU/fhscuZ8Co/5ISSrs
TLSH
T1CB32BA165A28A93B9CCBE25DBB257F53D6F95033A1D01E58B7FC960C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 efa2d4d9fa7077c476f5dbb66d103c241569ab61a82465177538607356c813a7
MD5 8abb94bb1f333c6300ad49c37cec9f82
SHA1 14e4e6053d09c223164867c4132cf5927fb3a69a
SHA512 46b48d49777e912b4c24f61417944e27124456f61a8b644bd3e56ac76c1bff81b02836224862add225ede09807eb7e36f1c06cc084027dd036a8415774229d33
SSDEEP 192:sxRgrbU/fhshuKCA94/sjbOeVoA8pJiwm/g6+WNRY3F0aY/YD9t6SIGXnIgDgjm1:sxRgPU/fhshuZ8zejq/5Ia/DSrCm1
TLSH
T1FE72D6179A24C87B8CC7D659BE35BF52E6F910239D911E5CA7FCCA0C04EA6ED2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0670d81e3ccfcebba3d80a88ec5a77a78db6f0dac1613322da795ef2dc5dd149
MD5 d02d76ded3868c424f05b91498cd5e07
SHA1 9ea140ba1e772a202ba4c7e6761178e081ba0eaf
SHA512 e8ed11e86996674515b903dd7605666aab88f95110296ab728b5702ec9f49840e56bdfaaeddd4c640cf57649c98deb838f0bcf83465a046f315b3e73633caaad
SSDEEP 192:sxRgrbU/fhshTeKCA94/ejbOeVoA8pJiwm/g6+WNRY3F08LXYD9O6SIGXnIgDCji:sxRgPU/fhshTeZ87ejq/5IzXUSrIm1
TLSH
T18172D6179A24C87B9CC7D559BE36BF52E6F910239D911E4CA7FCCA0C04EA6ED2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3c30a5d3ca6771aff67a2599a23393d7e90a5836b52a09f7342ac0bc3f4a633c
MD5 ba5bf4bfb1fd7580df72d9d74499a2a6
SHA1 3351d13c7002c3c467b577ddfa60fc9df354eb7d
SHA512 bdb0b28f7898e1e8632abe8a22e9a333466482714dcbcddb2d1f77af5261a12f56d4b2221f8b53ad8406e256c586a655f65ed657762aa743bcb895aa09580921
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcpropD6:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vb
TLSH
T173B2FA2F200CCB7E5F800AADAD196FD77D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3644b96-560f-4f96-bfa7-1ff29f7d02ef\index-dir\temp-index
Size 2KB
SHA256 d2b7c1eefedb4c6cb93443fbf288716671f7810c0e46e4bd68893c54dcd06bea
MD5 c0cbd49394cd7a95f46c5d262d6f3f19
SHA1 7652d4c4cc6153d4aff255cd506f05a22cdb2303
SHA512 34bd6c3291c0a3d736c5b6fb16629f466f7e1d0a48d8608b5cd27956ea1f0485a792407383ae0fb46813a8c32dd1eedb9f63ab50f0acef20fee85f96f91e41df
TLSH
T1B651D70E4C4A6F67DD6D24B324B60983333578FE5A848F07559CA63478C33281D69969
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3644b96-560f-4f96-bfa7-1ff29f7d02ef\index-dir\the-real-index
Size 528B
SHA256 61b03fe08db2acfcc768cb2cadccc532774121bad1c01d78dd85f3a964fcc17e
MD5 97489f670703b86f09d630f979f83051
SHA1 7c9497fe2ff5fef6737ecc42445aa03f859fd860
SHA512 929fd9fbebbc7c9a149e5d4624c245924315913a8f582d38c17cdca5e313a6e978c9a9481812f2de424524e1afb4a2fb2601000cb17dbd456d528ad29b3a0c39
TLSH
T111F0F1D78CAAB447D52ABCB712362556333A01FE32019E8A106C3039A93193C4281206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5974b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3644b96-560f-4f96-bfa7-1ff29f7d02ef\index-dir\the-real-index~RFe5974b9.TMP
Size 528B
SHA256 cd47364df29167129f848a7a28ecfe0faba2507a10ea8e51c0148598df2b3d30
MD5 0ba8facee5d4baa1614d452441ae8c05
SHA1 3b7e6385d255afbd47be8a0cbe0ff2975d6a456b
SHA512 8f2debc9f5830ca8335631231113e7560c0a4c1d1066303b9f0d5dec13ada84bc0cc7b6a0b3706aef4f532e15cff245210d0ccd6d31a848e86e733c4362d0fa1
TLSH
T1A4F0C0EB40A5FD52DD2AA8F56106A01A733F0C353635D69F709F342E59327B88682E46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 72B
SHA256 2aa35aaaf86866ebdc12a93a8869a98b8bfdd2936e647278cc1757ed9f1881b1
MD5 5dad1ba7c7d7f1d4dd9b43e44e01abf8
SHA1 a3b2a7e17425831ca4af8e696c2f288599b43cc3
SHA512 42b3932aecd4c687c841e58adf613dbc0a6ef3727356c4c49fa1a9dc285b3c18e98fb0b5b65add115dcecd43b65d2be55f85d71a96bdf203cdc371d59ffed69d
TLSH
T156A0029007C08205D45A21B16563D34533C0CC501155930E64D10085CD558C15A8104D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 72B
SHA256 76406f1a5342743eef2bde536a90a8225e7c1c44b441f4504d687c600bcb2ccf
MD5 c7f8a0349dcc4d781c1c81521cb4c03e
SHA1 d268bda9f15317c31a2515052a7b17514d2b5475
SHA512 8be7def17432e0f3551aae8c456e6ddc1d464319032f78448a03e842d429669841d86aaef6b18b1ac51494c79bca6a69f1c96977f92700dfc7176eec3b5062d9
TLSH
T1E1A0021403813105C41712B266D792B5229459900203A32A41D1419ECDD0B5D8D4142C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e62c821ae379175a8a7beaea753024d1c40601595786441ef09e51debc3fce55
MD5 edcb1f4bb93a671e9ae7b3de8a96b38a
SHA1 bac118e255232d695a62a7e6f8c713e2d4e7d266
SHA512 e62c881d49b7df698ae310725aa7e48362749e7d9289f20d2a0d53ee5aadbb1639d0a3cbd0f7fda986eae76c9dc48294cd37c05de9e9277ea4681773d4e17eb2
TLSH
T1CBE068733AA71850ECBF83E1247158B50201B814C485FD4F206A9987D0A13042506C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e8dd9557c44b0ea4105f82da6b44be9b9ea5deda328008891b16e2084e3a45c4
MD5 12c51c33bc679a774ada99b733cb0f97
SHA1 a5be83965e96e1e6284f013760f0ab5d014dc579
SHA512 a3e6df887ac4b05dc4dcecd7a84ef959bfad650f635204ac9514713873f98e6803d5270ab2949997c3c2b160394e33b5ee6745b3995e8ad2d9deebdc10b20fd8
TLSH
T180A00261C9558042C4040274DA6399AD6AA18CB84685632142BC5458CC6819546D3104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cdf5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59cdf5.TMP
Size 48B
SHA256 a30c9e4c2e67c44f1c7c48198d23b8a04a99f8805badbcc1553cadaa22e13db1
MD5 1b11cbf3f2cf74ee5a5730c459418a83
SHA1 49482783489e15c86e92d9efa3df3aadd73556d3
SHA512 32e09f80ddf5b1c30ebc43a2f1730da907f35b044d35eb5340d38a7b462cf34d1228592555531d0f43c6623f408b27f393b4b126dabad1595fe5437d53f16f83
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c2fe3e3ef59b1ef0fdec52abb9a4aa7c9d296793a364c1e179653e697a62a273
MD5 13d50e3f2324c4c5222ba6bf9af99514
SHA1 d6e80300db26bc01df02ccb00a424ad9e4f5e1e3
SHA512 055efe772f21371c08be4129ed6c245c53f91aca13a132d0afa4ccec10677879d764e2965ebf5d7837355081c46cab28f8cfe239db485dd4fc0cf3712dacfe3d
SSDEEP 384:kZcIX38NcGT2Uujml722WZlf8hyEGhWVFeWnzbGky2rEoajo4cdR8eHhVODjYPN2:CX3Y2Hi0tZoKgrEnjN3Gac1FniMjM
TLSH
T1FAF2BF726DA4CDB38CEED286B5437602AEE04663C6C40B949ADDBB0C15D75EC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bc00222eb49255baab4df90477c8ca7694ef4c85212089dc1391cbfe88815db8
MD5 6c6327feaf94a080b58f24134d2d12a9
SHA1 eb15ae200d0c74a432bf8e51d4e97f37a7c2f873
SHA512 f6a704edca2b993f4b513c9226add389536898a47dd1fef0f56fb9bb842bf252b30abcf7d72d2ba1f456fb295deb5d805a2992b3dc4bf3832b1d6db479c760b0
SSDEEP 768:Grv+4UNbdQ3p6i0tZosgrEnjN3Gac1FnieVH1SCx:Gbsby3eEsgQnjMayiEH1X
TLSH
T18413BF3269B89E738CEBD385B147B6037FB4565786C40BA4C9C96B0D069B5EC130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 62f38ab3bb55566cad78aaba83e7fb9f7b49067aa332786c1a4be90be785ae5f
MD5 21fab4e4d249c9f031cfee875a32fd4f
SHA1 ed171ad03df56fdc7fc4e0ca85f198faa109f632
SHA512 2fa7ce2e923c72850aa721fcf49fe8e5b1d4697dc2be3f1f592027cc3a899e83426fb3cde1bf5e3118da08eb02be4753477722fd1de8dee0f71ec6a01324d26e
SSDEEP 768:rrv+4UNbdS39mi0tLrEnjN3Gac1ZdeVH1SCz:rbsbg3K9QnjMamEH1V
TLSH
T14603CF3669B88EB38CEBA385718776037EF4525385940BE4CACD6B0D06975EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 42698aef311a2cad724a721cc23e53a149be3576517142d910488a099a955e41
MD5 1bae0138c9475cd0a4dfada93da7f27a
SHA1 7fcbbabe22865473cb9f2d8d606890d375a331c8
SHA512 5d1df6402cd0327706214d4950968dcfe173d86c94f99f959418e6918e660f4f79f36319b32dfe5e407d3dade3da9ee79267285ca256e9ef7df1eac8071b7a08
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59a61a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59a61a.TMP
Size 392B
SHA256 fdf720329ca741f87647cd77853fbd6ddd637f7fcccb421f89d8662d1602d400
MD5 cf24afb06e85b7fa0836f146eb925425
SHA1 e69fd9c093ffb8cf33d92b91bf219c55a8d1d5db
SHA512 dd7e42feeaac494ff2f0097de3986a7cc3ee7ecdaf608d4b5218f4e3cc99ebd08d5503908271b0d1cd1dfd4d596f6744f74eebc75dbcb2a7856e29cfe17192b5
MD5 SHA1 SHA512

Submit Download

ffa30a05-7ff3-43e8-bb9a-6b4ac581b19e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ffa30a05-7ff3-43e8-bb9a-6b4ac581b19e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads