hxxp://mityaalim[.]co[.]il

Analysis

user interaction
yes
max time kernel
115s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mityaalim.co.il
Sample260802-a77baabb74

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
139	1428	powershell.exe
140	1428	powershell.exe
141	1428	powershell.exe
142	1428	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
142	1428	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3128	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301055598118322"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B234CF54-4CA1-4D84-BBFF-50742DCA288E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1804	3660	msedge.exe	88
PID 3660 wrote to memory of 3128	3660	msedge.exe	89
PID 3660 wrote to memory of 2128	3660	msedge.exe	90
PID 3660 wrote to memory of 2128	3660	msedge.exe	90
PID 3660 wrote to memory of 2128	3660	msedge.exe	90
PID 3660 wrote to memory of 4424	3660	msedge.exe	91
PID 3660 wrote to memory of 4424	3660	msedge.exe	91
PID 3660 wrote to memory of 4168	3660	msedge.exe	93
PID 3660 wrote to memory of 4168	3660	msedge.exe	93
PID 3660 wrote to memory of 4168	3660	msedge.exe	93
PID 3660 wrote to memory of 656	3660	msedge.exe	94
PID 3660 wrote to memory of 656	3660	msedge.exe	94
PID 3660 wrote to memory of 656	3660	msedge.exe	94
PID 3660 wrote to memory of 3248	3660	msedge.exe	95
PID 3660 wrote to memory of 1468	3660	msedge.exe	96
PID 3660 wrote to memory of 3248	3660	msedge.exe	95
PID 3660 wrote to memory of 3248	3660	msedge.exe	95
PID 3660 wrote to memory of 1468	3660	msedge.exe	96
PID 3660 wrote to memory of 1468	3660	msedge.exe	96
PID 3660 wrote to memory of 544	3660	msedge.exe	98
PID 3660 wrote to memory of 544	3660	msedge.exe	98
PID 3660 wrote to memory of 544	3660	msedge.exe	98
PID 3660 wrote to memory of 3532	3660	msedge.exe	100
PID 3660 wrote to memory of 3532	3660	msedge.exe	100
PID 3660 wrote to memory of 3752	3660	msedge.exe	101
PID 3660 wrote to memory of 3752	3660	msedge.exe	101
PID 3660 wrote to memory of 1204	3660	msedge.exe	103
PID 3660 wrote to memory of 2276	3660	msedge.exe	106
PID 3660 wrote to memory of 2276	3660	msedge.exe	106
PID 3660 wrote to memory of 2276	3660	msedge.exe	106
PID 3660 wrote to memory of 2244	3660	msedge.exe	114
PID 3660 wrote to memory of 2040	3660	msedge.exe	115
PID 3660 wrote to memory of 1660	3660	msedge.exe	116
PID 1428 wrote to memory of 208	1428	powershell.exe	118
PID 208 wrote to memory of 3252	208	csc.exe	119
PID 1428 wrote to memory of 2356	1428	powershell.exe	52
PID 3660 wrote to memory of 4572	3660	msedge.exe	121
PID 3660 wrote to memory of 4572	3660	msedge.exe	121
PID 3660 wrote to memory of 4572	3660	msedge.exe	121
PID 3660 wrote to memory of 2928	3660	msedge.exe	125
PID 3660 wrote to memory of 2928	3660	msedge.exe	125

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mityaalim.co.il
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffbd12cc188,0x7ffbd12cc194,0x7ffbd12cc1a0
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,6527162720572793230,12734774787824087897,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,8378288512278695942,1361411535775593192,262144 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,15881141540948271032,17645804380747012370,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13268183679640044437,3078257582910178367,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2278898854717104132,2777997423537811759,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,2473094443983901697,7035020678551617317,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,10327047452204933670,11276507395806705152,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3128,i,835774437731624273,5515858842261365130,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,4704993948137568588,14804465917603642806,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,1919687590092533172,2802029375379580268,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13130886774501460683,3442239571760952442,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13130886774501460683,3442239571760952442,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6244,i,11569414656805675095,17704901360959288624,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,9045621000415813581,9813672848380188151,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,974520849918402097,5024390029735331420,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,3713834821275339368,9153448438935792855,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4212,i,16346760594831971857,10149723337295299125,2097152 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,1926592283482702016,9240107234293776286,524288 --field-trial-handle=2284,i,5559007346595395393,6343468755757460798,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c1csfnv3\c1csfnv3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF4A.tmp" "c:\Users\Admin\AppData\Local\Temp\c1csfnv3\CSC3A0DDBEADDB3469BBAF8912A9819EBD4.TMP"
    3⤵
    PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 23KB
SHA256 a9565ad32c5fa71a176dc391f8f3973e0dc04d8b14ccb3f18699a19d30c71a8d
MD5 c72938152134ad61e3fc100ed25ddd30
SHA1 d1a7f2d94bf945a728d6f2462d9abc11093a0332
SHA512 90feda8a5353df8214851d43a763a77bfb182fdb660c6b8d020171fd707dd9665b372f24928e4cba484c00547e69b26eb96733561ac5f253bb94330248519939
SSDEEP 384:nznEXWr5cJ6uRVytrsz/yY+mKlygCDjwBTvgetY/bHP7OQKZt7+RlaiQPc9Q0faH:znEXWFo6iytu/yYe4LDITvXtabKN37wO
TLSH
T10EB2D0408A81C2CDEABF0FD92E129EF9895C13A13ED8D75003F7496E676F1DA5B80B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 24KB
SHA256 71d59d52db63098777fc823ed319a4d76f85119df0e98cc43f534ef3fb68074e
MD5 5c68cb21c587241a832d2adbf2df74df
SHA1 87cc6c5b6db7296191ae59954e5f2294b8c370a3
SHA512 31e2cbffa9854a3311490d5e63713fcc7bb76672a86bf09f549cceb56ec55323dd1dd1ddedeb97e71ca876e875a1c3bf1ae233894cec3d860f424be5aee105e7
SSDEEP 384:a1CL4zfayiJjqTY/fLMSKyvBW46fIQb3pU5JRgRxdAvpYx0IGW6hwJv5LE2oUJ:Wwfy6nQNyvBWpIAp4HgECxdX6mJlE2n
TLSH
T115B2D019AFD78005A00B7C614DD033F57BC4AA4AF0952D13E76E1E6D8842EC85AD0EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4366f8a0abe22b40_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4366f8a0abe22b40_0
Size 245B
SHA256 c720f821404f06150ce79d02352f49a8f7a6dc7074117ff9fbdf5ef876638c19
MD5 7eff2037f63fc5748c0c490a91fdadca
SHA1 db0e69976168aace09a28f35be3d8ad3978037e1
SHA512 b2bf923e9437c8a2f46e75e989967c8af39a860a3c54b36bf0ea3200c72b22add4d89ae3a1716a79a10e5abd3476100fe3612045e05dfb299b27ba2d6f49d318
TLSH
T10FD09723A8042810CA2FA9F8CE6A808C2222802804A883F2E08570AB2599EF26A06112
MD5 SHA1 SHA512 TLSH

Submit Download

a2d6242627c51ec8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a2d6242627c51ec8_0
Size 332B
SHA256 f2b86bcae475aec7b520bfa5c82cba0b861ce134ad185958bcbdddab31a0081a
MD5 07c456a2f7cf9f9edb08132d21dc62b5
SHA1 68e5406248aa7feb3c28b4d145d3620bea77752d
SHA512 d13b5a91721cb5285f6b5081082404e1f4a559046bdaa2e8f07ecda4e429366b4100379555e011f5e2d5a74649508ade808a51347c1f3cbf61f33375fc7fa34b
TLSH
T127E07D63005628CAC54F53F4CD3E520E3A23801A19CAEEF60088B1BBB5285B1764F6A5
MD5 SHA1 SHA512 TLSH

Submit Download

dd2da02fc31477dc_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd2da02fc31477dc_0
Size 423B
SHA256 81076f22f3f7351b670e3a792e838935b9f5eddf2652a5d242cc67398f1d32ba
MD5 f2295556b7106feefc4e537682976c37
SHA1 8d97bb72a05c0745203de86a2ef6192f920a477a
SHA512 f80bd9f4d915e8926be5fe128541b912e165a31ebe667c8c5885abd3c1012b4fe2dd8e6ec265b2565bd938e21941cf48486a9120a5c73e4024b88124c6c48628
TLSH
T152E0F13304222884DC392878ADA0544DF973C08EB5C9A4F104C519ADF38647D7A37F50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9f5f6f8686816fa047f82e8a18fb68c044b96ce0e9b92de2d4f2a6f5e89b5ee2
MD5 c03d7c3a4f594a023ddaf7615135e583
SHA1 dc0bd0f47a2939631d77ad88cc4c1125522bcaf9
SHA512 88c9f527d7ecb2f04fb2b09575989c38e182b245cf623b571514eef3b0f1f1a568e5e27395ed13bb51b5cb2e15ba9cb65ed0ee65c46967ed6c0e47d9335a9fe4
SSDEEP 96:ZTrOcwIkrxfNcqeKBxG32GYRfoTF1jDttwMD3urnai/9CT:ZTOIqxfNXeKA2LfoB1jDAMD3knVs
TLSH
T183B1EAF601B50898EF5EDAF074E16A06383179F8FD9F6E9640C4AEB43947394890A178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 81bc3c877d512984e83fc36b041ec0ff56f84ba8285173b71af2bf807dfb79be
MD5 12d2022d0de103339057f3e28efbc60a
SHA1 b073028d71d134844ca86a32a9ecbb9bf9a2f3c4
SHA512 8102dd368e0eaa82c0c59b80a9514778e1edb60ea40581092d5272a3b3b413d4fd3e711e116243bcde4ed31c10354a1106545d3bfd1fd62e2c1966b19ff73352
SSDEEP 48:ebfrz6lN4IcEtNT81rLmIp3emDxYeWQlXxRvB8+MwI3aW3MZWjUnoVARvnmiuxEx:iOanNLmc3eKYCZo3x3MAZIfluUloA
TLSH
T10C9176F541B90858EB5ADAF170E14A0239717DF9FD9F2E9650C0BEB8298B3D0590A4B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f1be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f1be.TMP
Size 3KB
SHA256 f19c31714c40b18999d6baf8dea110f8a9bf028c2a72a7f598c73faf9c7e7190
MD5 f623a4b9b70aab1d7d4335cda1d6619c
SHA1 e82c0db8f1d66a2cdde5a5e6408618bf930b87b1
SHA512 6dc4885defe63c5a992b2e3c6cc41154a33769f1a3407f6fd75913941349eed95c9c53deddd6aa365d31efe9a2208dbf81b741bd8a2905ecc2b05bc92ca6ce4a
TLSH
T1C771B6F54279489DFB69DCB070F181023570B9F9FCAF2E9680D0EA387A92354990B13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fe36621a0515dac5419d2aebfbe00f0fdbef70d09a58a912b6fd18ef88d33947
MD5 28edec5c6b19ccf5265a75ff97148976
SHA1 5249987f103b0ce725a9b3d85c436970a6671e88
SHA512 3ee7913b38f1b86b9b805ff9e5213d6cce79739c1078590f429f9856fb55a84b9af90471157a9df3d4d84d69e810a8a5f377841da3f6b0ce1ee62f43562bcf4c
SSDEEP 192:Dv4cdXugeZ6Pw/ygGsX5zmstfqKLTarR1qDbVFU:Dv4cdXugeZ6Pw/ygGsX5zmstfqKLTarP
TLSH
T14EE18DF2C6E7C5AE8C1157F6AB243E1BCD1D151842183D2689DDDF8B9BE2472E20264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d02bc9076e6d9d44c5e9db98b242a3017adb1349210a684dce0621ca8774b74c
MD5 21865b6ecb056f42788f3618f62e668a
SHA1 32c38b8a640993d79e156494abbb87652a8d5b5c
SHA512 458b8b4dcf19e7f5bfccbcc4c826040b50932154eaf94dae0f5661ac1061d0f0f02a456296d8f8f3839323061f62b0047e2fbf1883395ac842851478674c65b3
SSDEEP 192:sxZJRbyM/jK1Ml8Mk4/fZsfZ/ehIdpr2HW6+WNwFb/YzJ7k0IgrJ:sxZJrM4/fZsfNrCHbW/c9
TLSH
T1D552F8526A34A977CCCBD209FA557F63D6F50472D6900E44AAFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 109b1d5e1eacb6f63f6d923fbdb9ef7cc90c4c920d7662006453d25942dda96c
MD5 8a13297550f9cbb7327f1bd5898e36ff
SHA1 c580ba7dac65093ad28546a34a0768afb9ac4460
SHA512 7ea4f25547bdd7aed3b0724a3a9d31cb2af0953f5b2e6093087bcc5fa940362a3a4a77f0de9b99e45bd97a7b9df600abfdfaeb82b107910d4d5b5fa9fc3255b9
SSDEEP 192:sxZJRbyM/jK1Ml8Mk4/fZsaZ/ehIdpr2HW6+WNw+dXYzO7k0Ig5xx4J:sxZJlM4/fZsaNrCHbnXhDxc
TLSH
T10D52F9516A34A977CCDBD209FA557F63D6F50472D2900E44AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 907d548e78fbdd3e583fb1a6032afc34b4fcf6e6cab657ccc659bb985413e924
MD5 e65214057b23adf1b6f2794e18cf02e1
SHA1 e6af6d9e41d9056f185628170dfedd4fc644b9da
SHA512 061434c928dffab532f04d1bffdc290c51511c99b1afe68c427b4fcf708c566550a1686b23635d1ab2f24e99c7136443d2545ab2b3ac2a0d099841a2998f739c
SSDEEP 192:sxZ3RbyM/jK1Ml8Mk4/fZsaZpZhIdprlHW6+WNw+dXYzO/k0Ig5x34J:sxZ3lM4/fZsa/8xHbnXND3c
TLSH
T19652F951AA34A977CCDBD209FA557F63D6F4047392900E54AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9c56c308f211f2833bc7f28879daf750cc38fa0b8b072f9df7d64e2ce665f283
MD5 60b108a0bb2bcdc884b0d7dd6d484125
SHA1 1b5f1ea32bb755269bc1cd5ae387a28c57c5b5d4
SHA512 2c3a4d1eedc27e3456b35f381f3d75530d3ccddabe4ee2183679e4f6a7107450db0c38fe3ef4148268ca1f5e5e7ccd9245cd27587443cec64e72f22dd0621ce7
SSDEEP 768:1sW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjSroInXiLlYO:1sW7kf0Wvqidau1jaa5LA3jJaO
TLSH
T13ED2FA3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 65eb9abf68825042fbff4c27688962f582926a83105face9fe9b49752132b019
MD5 9b62a3590e66d0c790ab7e8a4cc46403
SHA1 8c0f79b6be00e90dd595960f21da18e040f57256
SHA512 16de152169081285b23d1f4305c3a97f225330ce02e3c54f1feb19971ff388c1801eb9f13bc3622450c83a3c8b7779ef8345cf6bf98a94ff004cb42c6c98476f
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTenI1K0k4Py1zIhKM4MXqP2aoMwkAMNPINV:KIbCKcenWK0kymzuKM4PVw
TLSH
T12F914102317E0681387E294D92A6A6679F4272633818A9FF7BB410A21D76F550DFFCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 155B
SHA256 d416b78a41a102b835698bb58c9f5ab8351fec8099d730f4e67fb66c454e4058
MD5 bef8d73c2161f87ce8f45b2af0fa25d3
SHA1 9878e51808b8d5417952a0a8ced2930f135ca833
SHA512 d299e3939778999e9e35fcc69d0b5c52ef76d0508e934549dfd0ad50347090db6e3b42441a958338ad01f46370538c6ea6429aec16b60830451bb543b1a8da0d
TLSH
T1E3C08CE32801978B06B0AEE83014B62DE807864C8CC0C8F4D409500212387628002E78
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 239B
SHA256 074faa95b5af8fd0f55ca1cf4494ef71bee9cf3d687c731ecd4dd7ae435ace16
MD5 a974fe90c8693750629ca52f91e67aa5
SHA1 e894b8dbd375c19508453054871bc710d6c04501
SHA512 c1b2bc21010da9543562d12b66d18c30a786daf2c63c23415448acd90e532c4da1e42b0d940f2c9db72080756018ea6ecb42d25edd3a993598f080b16b6d6284
TLSH
T1F3D0A7A71431DA672370AEE47124616DE8178D49CDC088E89805B4472178362C042A78
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e375.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58e375.TMP
Size 162B
SHA256 d03408374ceca190413bc1d5ce553a0a945d678bd13180c2bad5ec622a1cb4ab
MD5 cd70576bc856e603fde5c26b31fb555e
SHA1 4766564c6c6ce3d55e414d85e9b84f649ff82add
SHA512 aa14a65c809b7a666e94566cf7aaa73ee22b118f7f46e6b4342dd536ddc5546008c931fc53a2306373ab4e4277dce16d85106b53a44f4c3f7789ab54d57d2cb8
TLSH
T114C08CA32411938707B0AAEA3024B65DE8078D4F8CC0C8F8D40A70022238762C106E78
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000003.log
Size 343KB
SHA256 836c69271e047401abfc8c882c8ddba789e963945bdd4425c4ad06bcf7c6e3ba
MD5 c00e2e86f3676d8c12a6f7f9ba765d42
SHA1 5a277a8425acb9c486090995eec23aaef5947f53
SHA512 c92bbcc01f2c07b6c1331ba2ffb4faf485d486cd3ca885b38371df0e4dfb41b42d6b2289bcd561ee4b29c875fda0e73db082ca117541c9430f21e118803a7806
SSDEEP 3072:7CZlqsI7xMYgy9Wmw2ASNKokXV+p5/MD8nGbWYqDhS5K/8xIXBgez4N/qAcAa9pJ:PM3PFM/G1u
TLSH
T100740B24621654E1F43B0333AB929E4AC732C6D6E7606036F973691C3AFB7482E5727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\LOG.old
Size 329B
SHA256 b34d44c4e0c633e8b37590046a2aa659ec034917280bfb426b3818166281a3d4
MD5 b23ba8ce411daad1702a52958012b21f
SHA1 2a74bcd9671a81c40f8f24e057c664146c6ff23c
SHA512 abbe34f3811014b30fe676065c37a48025e87354f98c16a9e424f0369fd595d1122bc19159508b34bc9629055a19c8647b6f362b986812d876d106ab4f52d759
TLSH
T17AE0C01884C6CA1F231438E380387B0CB2B1740FDEC47D010F08D85C788E008D97D2E5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

39900cd0-030b-404b-b900-843076d76599.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\39900cd0-030b-404b-b900-843076d76599.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 423b449c59b523a883eb5cc780e5265d6349016959263af7a051b76769692cf5
MD5 17a071064f39e236901b8a59d51d46b5
SHA1 480e2fd00b7a9262443f44c273348524f6b1a0e6
SHA512 487d54ab311a273affa13280b40104d697496305c2c27ad132396c1419a8d62ef5caa5482d4c643ef8122d44f063800dd20b7d07bfb932d94d1649dd97f7f3ab
SSDEEP 384:EZcIhsNwR26mbdfitdKR+298VnTKwBODNZOCqWL:ihwv96wl2VnewBKZOLWL
TLSH
T1D2928D716C386C369EE2B545F84B36178EF89177F6C83A94E5EDEF1C04A9268130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 36a1b3f97c6130c1b86597ba0d9cb7b913c1f941ead879d46c1cc19060a79c15
MD5 6e1e967ca33a10440160e81b3f1d6266
SHA1 c6313c13f4153ac32b45af2d51bbd5e374f87c3e
SHA512 43f0242ff8338430cb320d62f808995d4c17b914095439b265e437b88f705ea5e2108e213b6ec64ed532427a7afc4a695ddf625967766e27e855deb67c7a7b1c
SSDEEP 384:FZcIqsNwo26mbdfitdKR+298VnTKwBODNZOCqWL:9q/v96wl2VnewBKZOLWL
TLSH
T11F928E716C386C369ED2B145F84A36178EF89167F6C82B94E5EDEF1C04A9358130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9f7fa2e09034838225dd403d0eeaca21db314cd63f2db3b842d98ded4822ab2a
MD5 868d84d90b763f2afe406ac3ab6c712c
SHA1 a3185fcdb5f69ddd7fd4b863d6cfa908bc71c3fc
SHA512 ba2cef72889eb3a2f70ea507346c036b5eeac7d9631127e6bab9123fcb447d796253008c7202c039082e657da4755797799fb4bc4771b2322a4e93721db98791
SSDEEP 384:UZcIqsNwo26mbGfitdKR+29lVnTKwBODNZOCqWL:Sq/v06wlzVnewBKZOLWL
TLSH
T175928E715C386C369EE2B145F84A36178EF89167F6C82B94E5EDEF1C04A9368130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ace13f37bbf696e633ae8587658c59b85995843d4312be2aefe773bb085a8163
MD5 e7a406e39e46396a31bf54e2c2dfc9a0
SHA1 cc9cccfb3d50f40628d1f8999991de60fab826fa
SHA512 9524614598530ba0dc58147fee97189871b4dd105f435a0595900c5e940302edc52436fde7137c18b4bc2164e57d9a29ab8a9d50d90a8ccf2ab4881d7c8e75db
SSDEEP 192:ZONZ64ByQmiUyyv+5GBPKp/+FdG7BGc+29zWwsqzU6:ZONZ6euT+OdKR+29/VU6
TLSH
T1F2121B35AC74AC2B5E92B541F48736135EE8412BEAC57B90E6EC6F1C05EF79C3306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 370af8c2ebad9050257208b05dc74d6b22707638c321e0224ed3de1a0e9b56ac
MD5 4c32cded167c7ddd2f6dceccd3916c5b
SHA1 3b042e2ab1ea680f63e53dc9eb1251f5c0fe9c80
SHA512 f02ed57793be46f023be65cad065d52f0b82d6c95f9f0a8b82068a082a3b634860ac630ea90d4a376295fafe7a4136c477d5d980d38146e9a01b588c2c2db6b1
SSDEEP 384:NiFPZcIIOsNw8TUNTUlIlo26mbD+itdKR+29CVnTKwBODNZOCqWL:EFHdpwgNvm6wlsVnewBKZOLWL
TLSH
T107D219F248E7983ADA9D6747AB7D2D038EBCC163F5846650B3989A0CCC5617FD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 824d7a8592c3459fe88f364c0f1198da46a55d2393c643dbfa07b0a7ab58115a
MD5 890964cb719c2f488969985fb3533fed
SHA1 815cfeed71deba73a033c425de5ee5cc0ae316d5
SHA512 aa9dd404e06f3a353a7d412d38af11a664f2f9ae3bf0d9abdfb9b457dc905ff3b9cc9eecbab14395be999f744b98c493b6d21cb70c27975b2278dfcd65abcbb8
SSDEEP 192:MONG64BAQmiUyq1vW5GBPKp/+FdG7BvaDKCdU6:MONG6eApdWOdKCldU6
TLSH
T1E002FB34AC786C7B9FA2AE45F98637175FD8113BE5D52B44E6E85B1C019774C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c56d107c9b534e7c9b061246607ec53b0dc42efcec49f2ed00b5b0f87b321117
MD5 2ef380a890fb8d24cb10dd17cbefd83f
SHA1 8127682a229d69990f0594535c0ac45803786dd8
SHA512 76386fec135effea9ab7ae83622ab085d58fff6b668423e4babb1ab9bad473f4bf7adefa49a72f4915a58406047e65f62513bf77af4b1a994dcf7762363d8fda
TLSH
T167410B5CA6FD1148B377AE0A9BF7A86D847AB9732E06946D10110E4E0663B00C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

RESFF4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFF4A.tmp
Size 1KB
SHA256 21ef53d7e4040945cdd97fa06732dd68782c21515d72cff359aaf8f249b284e0
MD5 f53d854ef9a70b8ce3026bb31caf619e
SHA1 534b334291f960a51cca916204c751b7236730e1
SHA512 241f99ea154927221044bd24bf338c69f861cd7b539f5e81c5ea524e1406b49f2543b3edaba4431122f897c66e38ab9bf35be7c86b5c13479bf6be5572be1821
TLSH
T15821AB0143E8471EF0B35B3169FA0B6BA668FD55EFB3976B854051282C41504DFA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mom53vpv.edl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mom53vpv.edl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c1csfnv3.dll

Path C:\Users\Admin\AppData\Local\Temp\c1csfnv3\c1csfnv3.dll
Size 3KB
SHA256 933c216da58de89c2fbade79c53c14f633b39e4469cd9d4d912d7a38882cdde2
MD5 7f0f2ef969c10d1539feeb208d8c22d4
SHA1 e3f4183e67491b703e2a89fe27c72386ad784797
SHA512 f57ab603504a9309d25ddebdf3a15280cb56f59ace084e8193588067a929103a95eee370de8f75fd04a7754e5e0cfff410231ebca54bf9182aead4c2cfc85fdf
TLSH
T129711F1A93E44257E4BA0734AEF7071327F4F8905BA38B2B498442196CA16248D72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3A0DDBEADDB3469BBAF8912A9819EBD4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\c1csfnv3\CSC3A0DDBEADDB3469BBAF8912A9819EBD4.TMP
Size 652B
SHA256 5d902dc53f213c43aa3d88d3f4defdee346d7d4c43bc614d5e6b03d3295cb1d1
MD5 2ec3f31e969e7df4bc93d64b0b1e9cc5
SHA1 ffa05a1dec49ab0f404f05ceb68753624874e801
SHA512 36b40fa19cb4bfd77a74a8ca5efb914c128ffca0f1ccfd6a26f2fc469ded8d4d6fba22f8d9715deb2ff404bc380bbea740da435fec8d03026ddea69f5058a252
TLSH
T138F05E0963F8020EF0F34B34BEF6876399A8BC65DE7397ED2844035968649148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

c1csfnv3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\c1csfnv3\c1csfnv3.0.cs
Size 602B
SHA256 c28dfe12ceba75d5d7a8d76d96bc8648fa2f66f5bd8c866ac0d073e6e2f2128e
MD5 f5b2a8023658d39e99030c4a8a93363a
SHA1 7241928a1d9019b7e4645a4b291d6c96bf6359bc
SHA512 8866e2336b77d2d7f654b64590229ccf1075ec330d1dd34e3613950e47d9a0be9ba0abe6c326fc3054fffd84a6ecb9e1db893004baef5f4408b2fd842e827556
TLSH
T112F028542352D7A2A423943E4986F4BDF113407326FD2C00EAFC1722CE47141E23965E
MD5 SHA1 SHA512 TLSH

Submit Download

c1csfnv3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\c1csfnv3\c1csfnv3.cmdline
Size 369B
SHA256 a9e33bc0dcd40d8874f914fe4ccc451ee7cfe1e71327a46557bc0acfd2e1c70a
MD5 958fe169e14774625a490f3c2262aecd
SHA1 4dc9ac23536748df29724d365ad450eb271c91eb
SHA512 d8dc18998c160a6208bb8975489a0ffdd078225c222811cc913f992d32a06b03d2e3a5a0ea9d59c091f6ff6739cd4dfb49d2b079166668eac6528dba2ecd1f4c
TLSH
T148E0C03A5356C37D01DD7107296DCCACCBF2174739803FC4D448440ED02700067D1745
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-465-0x00000200B3F80000-0x00000200B3F88000-memory.dmp

Download

memory/1428-417-0x00000200B4440000-0x00000200B4484000-memory.dmp

Download

memory/1428-409-0x0000020099E50000-0x0000020099E72000-memory.dmp

Download

memory/1428-466-0x00000200B4410000-0x00000200B441D000-memory.dmp

Download

memory/1428-418-0x00000200B4510000-0x00000200B4586000-memory.dmp

Download

memory/1428-452-0x00000200B4760000-0x00000200B4922000-memory.dmp

Download

memory/1428-476-0x00000200B4410000-0x00000200B441D000-memory.dmp

Download

memory/2356-472-0x000002976E770000-0x000002976E7B5000-memory.dmp

Download

memory/2356-488-0x000002976E770000-0x000002976E7B5000-memory.dmp

Download

memory/2356-473-0x000002976E770000-0x000002976E7B5000-memory.dmp

Download

memory/2356-467-0x000002976E770000-0x000002976E7B5000-memory.dmp

Download

memory/2356-475-0x0000000000B50000-0x0000000000B69000-memory.dmp

Download

memory/2356-471-0x000002976E770000-0x000002976E7B5000-memory.dmp

Download

memory/2356-474-0x000002976ED50000-0x000002976ED78000-memory.dmp

Download

memory/2356-470-0x000002976E770000-0x000002976E7B5000-memory.dmp

Download