6a1fe829ffa4c3ad9ed3ffe85b4c4c73824be152e05ffcdc62caaaf790e82fc0

Analysis

user interaction
yes
max time kernel
900s
max time network
753s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 325KB
Sample260802-mncnsa1bpb
SHA256 6a1fe829ffa4c3ad9ed3ffe85b4c4c73824be152e05ffcdc62caaaf790e82fc0
MD5 37b4af3e0c3c8af5f14bc39f2b6d9bcc
SHA1 2503c3796ce069fc473ab0fbbebe4dc99f4d37f1
SHA512 a03194345f467835fe0083d95a338672477cb91139635ef856fc3fb8758302e5095a901b0ad0e5ce7e2fc75316cd45fd79956b3d12bf6600ebfbdee8bec16a47
SSDEEP 3072:NYtgAkHnjzxQ6KSAiTGHI88aW+LN7uxRLlzglKaf2gEl:YgAkHnjzxQBSAZo88CN78Baf2gEl
TLSH
T163643C25E5D2607F682B8033F27F3318B73FA483A101C929BA1CC5D5AFD19866177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6208	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301406252099912"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{8E7547BA-51CA-43E1-BE7A-D5B79AA9B3B2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid
4
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 4896	5436	msedge.exe	90
PID 5436 wrote to memory of 3216	5436	msedge.exe	91
PID 5436 wrote to memory of 6208	5436	msedge.exe	92
PID 5436 wrote to memory of 3216	5436	msedge.exe	91
PID 5436 wrote to memory of 3216	5436	msedge.exe	91
PID 5436 wrote to memory of 1192	5436	msedge.exe	93
PID 5436 wrote to memory of 1192	5436	msedge.exe	93
PID 5436 wrote to memory of 2464	5436	msedge.exe	95
PID 5436 wrote to memory of 1864	5436	msedge.exe	96
PID 5436 wrote to memory of 2464	5436	msedge.exe	95
PID 5436 wrote to memory of 2464	5436	msedge.exe	95
PID 5436 wrote to memory of 1864	5436	msedge.exe	96
PID 5436 wrote to memory of 1864	5436	msedge.exe	96
PID 5436 wrote to memory of 6772	5436	msedge.exe	97
PID 5436 wrote to memory of 6772	5436	msedge.exe	97
PID 5436 wrote to memory of 6772	5436	msedge.exe	97
PID 5436 wrote to memory of 4184	5436	msedge.exe	98
PID 5436 wrote to memory of 4184	5436	msedge.exe	98
PID 5436 wrote to memory of 4184	5436	msedge.exe	98
PID 5436 wrote to memory of 552	5436	msedge.exe	99
PID 5436 wrote to memory of 552	5436	msedge.exe	99
PID 5436 wrote to memory of 552	5436	msedge.exe	99
PID 5436 wrote to memory of 1820	5436	msedge.exe	100
PID 5436 wrote to memory of 1820	5436	msedge.exe	100
PID 5436 wrote to memory of 1820	5436	msedge.exe	100
PID 5436 wrote to memory of 5688	5436	msedge.exe	101
PID 5436 wrote to memory of 5688	5436	msedge.exe	101
PID 5436 wrote to memory of 5688	5436	msedge.exe	101
PID 5436 wrote to memory of 4484	5436	msedge.exe	102
PID 5436 wrote to memory of 4484	5436	msedge.exe	102
PID 5436 wrote to memory of 5576	5436	msedge.exe	103
PID 5436 wrote to memory of 4188	5436	msedge.exe	104
PID 5436 wrote to memory of 4188	5436	msedge.exe	104
PID 5436 wrote to memory of 4188	5436	msedge.exe	104
PID 5436 wrote to memory of 6668	5436	msedge.exe	105
PID 5436 wrote to memory of 1184	5436	msedge.exe	106
PID 5436 wrote to memory of 6668	5436	msedge.exe	105
PID 5436 wrote to memory of 1184	5436	msedge.exe	106
PID 5436 wrote to memory of 4732	5436	msedge.exe	109
PID 5436 wrote to memory of 6268	5436	msedge.exe	113
PID 5436 wrote to memory of 5996	5436	msedge.exe	114
PID 5436 wrote to memory of 5988	5436	msedge.exe	115
PID 5436 wrote to memory of 6764	5436	msedge.exe	117
PID 5436 wrote to memory of 6764	5436	msedge.exe	117
PID 5436 wrote to memory of 4988	5436	msedge.exe	119
PID 5436 wrote to memory of 6612	5436	msedge.exe	120
PID 5436 wrote to memory of 6612	5436	msedge.exe	120
PID 5436 wrote to memory of 2072	5436	msedge.exe	121
PID 5436 wrote to memory of 2072	5436	msedge.exe	121
PID 5436 wrote to memory of 5432	5436	msedge.exe	129
PID 5436 wrote to memory of 5432	5436	msedge.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8b5bfc188,0x7ff8b5bfc194,0x7ff8b5bfc1a0
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,7669837399357482465,16863501461292032780,262144 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,10586495012869573331,13027353415719881169,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,17383636938967421291,3658872894879164041,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,448581230085105468,14794537092184953577,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,2462770920103871221,2514118608516491315,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5140,i,1776891864881448815,991900098089365768,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:6772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,15632735887576744712,4143749368062678914,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5908,i,10457523128082290394,7590875843535632802,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5868,i,1773689051117892794,6956855673902359294,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,5409298671575266316,6777963091722372510,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9076047887374251528,8180828653359511136,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12341714503847483514,4480365279717637834,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6576,i,14818048157627122746,17702631856002654044,2097152 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,14772844007737326838,7943145322763628348,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,15129297610518141519,2149944467192603228,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,10616581611723625911,18337298340228276836,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,10616581611723625911,18337298340228276836,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,1370417613891564932,18380911008920890731,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,671036097866103604,5588123931979417123,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,11922017125877104803,7237848666788426300,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,16926187094672436374,6275048133494265894,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7396,i,8192956558465472273,17353564212000540279,262144 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,6662088177233178092,6585695089182960249,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,9942188764829644629,9586815749023208261,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,12781674552802350598,7061306832087712219,524288 --field-trial-handle=2512,i,12727951333188555628,2712899023129237971,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
  2⤵
  PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5824

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\code(3).bat
1⤵
- Modifies registry class
PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7124

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f157f7329f2eba924aa0ca39485e6cde2fd8278825380c8456e9bec4022d2733
MD5 59bfb83bc4725eca05ff848ac3c2a4a2
SHA1 4d2623d00f7e4642df9afa30ce06597a532c5453
SHA512 e4c15acf75ae26b73ccdaa3290247d924d3a7f8025a4ef63ad06120f7648380481a6c1a9768e22ffc9e30b047079c9ae0efec32c522718f8316b4789f8905471
TLSH
T199D02321BB387CD7E5281571D031CB007A1A157362B792026650C40C5C7A9E266C76D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 cbe41f8a2ff63442f84d70fd3621707f6d1bd3ac7cba88a6b05eb32121814a5e
MD5 111e3204370233c11d6ddeee2773245b
SHA1 a879ae4c3e7162b1b22f66e51aafdadff284d16e
SHA512 719c442bf2b3e8f431bbd46fc34f23b009a3bb105cdbca4ef9717e6d3d078e5b44698213cdfe884d64f4a83c8ad9874be2af34adbbcd476b17671296806a0d28
TLSH
T106E0DF1C63ADCAA44A03B6C7E07CB31C40D2F456BBC8E5AB7E35E0A92448140525ECB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e091c2150ee09891208cdaa18b79f9432994cc01cabc750ab129ae598097e801
MD5 59c2d34707b3cbc62f4f007b24c173d2
SHA1 9f6e82b3022f05f9331e75e5e01bc80701b6bd82
SHA512 67218d5882476a482cdaf669a4e6e64a63040365c5557ea37be2d3ed4531f4adf1479119b4cb09b0a28695e9588167d26bd44925cd2c069ed887c1cf2bc4c907
TLSH
T18CE0268446C8CA9EA643748B517DA70C82D0370B9AC8E99A6F05CC843405080A3CAAB0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ed9213056ae74bab1723509a60f5bff2d26eb586bac34d2fd71f1ce6e2853860
MD5 a743c3d6de41ca00ccb2cafd2fb5884f
SHA1 f457b825e75a96a9d306a3be49238c0b20ec0e44
SHA512 7edb56dd603f7d38bf5dc4235910af5ad8db833164905db50591542be6a6f2b5ddc6d59e79a0b535a1ab59473a1802e677bd8870886ae79d59bdbf14a68a774d
TLSH
T1B7D0C2A8A8ECA94ED6E409BE97A5F0100F6402820416DA120160F9C136A52E41BAA020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 905c5a20e2b7183285810febd1c4c0028bc1f4992430ce78534cf9502f754848
MD5 c4c4488acbb20ba9b5572262ee4ad582
SHA1 2253e1c72b4580e0254f1759d09aa501cd5ee1cf
SHA512 4743e46f6af9a7cfdf9d7681946fea400bbd8149ba69ebe2eea46bfa47481e28a76b34e973369e52c8c9b174508164fc2e3aae907cbb3011d2c9a83fec1b55c4
TLSH
T182F0F4B6C821FC372DFC1B2860A41A47EB54136B3B41995B3B3C921C4FB463B8A8681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d7fb43b94572493d1c091f972981e105e1b86d77bf194816ee3a231afe811d00
MD5 9ffc8915310bee156ccb9d72c0273e4e
SHA1 f9e984b9d89e88b7013f43a3174e499c5c55a070
SHA512 0f087668204b8e28ed87735d8bbf2727e85e35ad9ec36cd7d1c66b7f3b2cac68493b15a65f8f8c30bf4fcdd7e8f80498a1cd064b647870e412480378bce6ce80
SSDEEP 192:D1HlWLUL98efwaVcaij6VZ/1Zmniv1T1hQAZ+kfZnd3JPER47xGiT:D1HlWLUL98efwaVcaiGVZ/1Zmniv1T1J
TLSH
T17BE1BBBAC3E8477E891152F09B246D2ADE1D055B522C3CA689F4AF0F73E24B1D14279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ac578a2bda318bf55aac196fe49567e074f9d934cd3b480db8b9428152572ea3
MD5 103b6f5e40981f8b18e0426f798cd36c
SHA1 cca99ce5fc632aafd45afa9aa00e508b6ba17822
SHA512 126a1671cc307a201534454ee0f66e1458c03a9f9e78819c0bc2747b56da5741497e74da33218463325e90282640a8380c87e7bf8768312b7fd0380213276f0a
SSDEEP 96:D14GORXoPioeqUMaVcaij6VZI1ZmnzBMRhQAZ+KOAZ5LeERcrxxSiJwZx:D14lRXoPioeqUMaVcaij6VZI1Zmn1MRT
TLSH
T1DFC1ABBA83E4477E991192F09B24AD2BDD1D101B432C7CA68DF4AE1B63F24B1D14279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 83d5fc0a973632e9a696c6a9114895a8e53a12ea6b75dfe1e73ed2fca504efe6
MD5 c4fc2eb95b6a2a1d6ca4d76cc0bc10d3
SHA1 d9eb4755a0e6a5f1e16127e6d758b45ddb47d15b
SHA512 c4ad982debc147f5d9c319bd24bed4e971fadda0ac9ca763dcfd85694104559bb2bfa29eca0a14ba6cd551f1e5eba01d2051427ded3fce4175aeb583c27713f6
TLSH
T156012BE780BEA45B10290D7F1D557C453E7EA43A758154F4EAA9817C70C50B39A12077
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a8fa125dece0221f7701d83b43f2ae5578398b750f834e5d317cc409dd31b8f8
MD5 07d2528474a4fe8fb1d2ea0c0aab1bc5
SHA1 35f93421e7747de5b001b436114f6cd7a14cb34f
SHA512 8c1b5e815884bd0001bc4b86831462fe7b0f16d9730d4d3c8dd85b8bfdaf73a9a91ad457fa23b1686a0112f9bd5e9679af94d8ce32cbd04b82393e31127e1f8f
SSDEEP 192:sxR7RGyMqZjK1Ml8wiBy/f3scwNRZ9qzoD8pe0/g6+WNIYcC4NlsGQDGIIgDfXJ:sxR7NSy/f3scwN/9Wz/5IW4nsGQTr5
TLSH
T12862E915AA345D3B8DCBD609FA957F93D6FC1533A1905E44AAFC9A0C04E67EC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0593ecac79077668be82e0aaf1f67c99b3fc6e7c9ee5fe0edf80c398a07c9732
MD5 8fda5d3e1cdaab58472b038d152b2945
SHA1 32211143eef3b8de2a71527b67a81b75c4a160b2
SHA512 69aa4499d1e2f4f6c82a6709cd83bc5aa4fc5638ecf64ee4d92bcf72de7e88ca7a19b4b50ab7404d21804a0e5cb0b55439a90f59731392108b743aa57afae05f
SSDEEP 192:sxR7RGyMqZjK1Ml8wby/f3sXwNRZ9qzoD8pe0/g6+WNIYcC4ClsGQDGIIgjXJ:sxR7Nly/f3sXwN/9Wz/5IW4gsGQTj5
TLSH
T1D662D9156A349D3BCDCBD609FA957F93D6F81173A1505E44AAFC9A0C04E66EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d544073758c2f458e4e03366645a9e7e144203784c2397e25f7be9acd9f60c22
MD5 62a66b16b5ee5ec35278eee668c6d1c3
SHA1 9ddab6eed8c6838c3497d874f3a085890e98ee58
SHA512 36fd177bb7cba29e914af071e78c7664bc51b5b4b39fcf1d03e824f086b5e62ace028259dd7a79a7a3c3633fe21049b2521a76f55c0e4111815fe281f137128d
SSDEEP 192:sxR7RGyMqZjK1Ml8UQWiBy/f3scRNRZ9qzoD8pe0/g6+WNIYcC44RsGQDGIIgDJ5:sxR7vqty/f3scRN/9Wz/5IW4gsGQTV5
TLSH
T19972E915AA349D7B8DCBD619FA957F93D3F91533A1905E44A6FC9A0C00E67EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b00e800dc07650fc08d221cbde754ab8ff64e8e3c7b068d6a903d9a673538e1f
MD5 6fb6878f02ab280b80cba3d8640948f3
SHA1 da0bbdc96e1998fb1365554ccd16c4e074e860c3
SHA512 bbad5b2b85f47aba1306975a5ab4d18fd9d32eea4fa447d83f95c5d78b2ab38a962d7eebc100090a22627d6967a5d6d6d52fd180f98ce5674a5c46d50798f442
SSDEEP 192:sxR7RGyMqZjK1Ml8wiBy/f3scRNRZ9qzoD8pe0/g6+WNIYcC44RsGQDGIIgDJXJ:sxR7vSy/f3scRN/9Wz/5IW4gsGQTV5
TLSH
T15062D915AA345D7B8DCBD609FA957F93D3F81133A1916E44A6FC9A0C04E67EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\949f5513-f39a-4cff-8cbd-effc20f3c35b\index-dir\the-real-index
Size 1KB
SHA256 363e5992b041571dd7228dc2dc310d627b5fc962a6a4ccbc827c846383ef7a92
MD5 d952c8e8ae7c8dc3ca919805a96844d8
SHA1 3ef30fb2d2d96da69ba6b4fdaadb262af19689ae
SHA512 1bb7ff6f59e1d2d25ebfd9e83d6f5f29746e4c6037cf719247bc220b7d41326d0e1aef90940e60aafbbf7241e94b62cb40c170a6371cc430cac5c7aff0790a1b
TLSH
T15141864B9CC5AA1BCC341072267D11D8373D94DE1649CE47205D7438BCA7A391A94E28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da645.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\949f5513-f39a-4cff-8cbd-effc20f3c35b\index-dir\the-real-index~RFe5da645.TMP
Size 1KB
SHA256 57dff524954c4e902940d589130a8ca8406b869c5afc6078558959f659f50ee0
MD5 4c50db3747243771cd894571216cf750
SHA1 7d3d15dcf8ca20918fa663f79d53ee89a03872e3
SHA512 5fcafaf0cf19e2fef823c2f8dbafe0d0d9dce5f8abd7fa4c5f1c81c563ec730a286d11fe755d250f675d072e801ec7a1d4c169d24c6c0a26b1707db14d65b021
TLSH
T1674198238C41EE1BDC3900B1565E409A373FA47513599B0F209DA8387CC633C6DA4A64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 866c62e7aecc4ad9cf58d724a10f432866f83595663c162d331a8ee119285c6e
MD5 efb9dd736c51f9c72b0c07861f65cb5c
SHA1 576be17cf66bad153d7096251b47475f5809a087
SHA512 ae9ed9b4395fbbf00e50147f17090ba4bc8a3107a3ecefdfce34397f73d879fc574cc2534861982a85e1db94d5b4767aaeb41bccaaffc443f1a66aa0afe63832
TLSH
T12CE0D8F63DA61824E9AB53C238B1A4711041BC949945FC4F145BD59750712142406C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 262ebe30c7f5bae238b8322f9530b9a0e7303d0937d32b7909d0a17c061f93c7
MD5 65acc5b3ea52bc635025554bf2c15ed5
SHA1 61f5fbe93bd33ad901064b77f6d0841d9e1897ae
SHA512 3c27386abd2522f11da390442cbf29e211828ee5daceb4757753ef4689f96e5b787ff886ca0df75c58cac22f38a4f4db7048017a93f655e9f0996fad81ca92b6
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JVc:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRp
TLSH
T118B25B11713F4290387EA90C91B8D81F96C2B4637519E52F7BA801A65F67E138DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5a6271545fac994de9c1e858fe7a85be727d62f818e79e61b4213d2c0afd3ac5
MD5 c0e02f4c8240b45404a09c7b01f14f61
SHA1 f3b56ebee01ee3cad63b1e8e1627095a235e818a
SHA512 3f4b727a1266ef3a0cc38db3d5ef9955a9cca4b59602654ee190f46b82d33f54d6c32f6d1e092be0aeabaa8f3b3c202e176142eb5ccc4c1ae2be0e155fed7def
SSDEEP 384:nfiFVZcI+8NLP8TUNTUlIRFPvuTzXAeff+GGnR9nnFLifhnTKwBODNZOCdWx8LE7:qFt+QPwgTu3BGRShnewBKZOIWl
TLSH
T1AED25A32DCA4D9B7EDE78FD9A6497206DEE04263D58C6AD4D9DD6E0C00D72AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8c381b2c73383695051f33b0a9b0d13227957e79df35cf270c49ad8377f4a42a
MD5 b6f2429805b93bfe6ce998fb76482a2d
SHA1 354ec88ac71ab384e48196ee4a79901cb961961f
SHA512 852e659a17240718686e1d1af455bb059e14ebe9d4e1f8db259f543bbbefd1d462c14dd409db283ebc5e1b0c70faf0775a3ae97a7d0426410ad958e7f2fbf916
SSDEEP 384:n6iF1tNn/s3n9S48NLP8TUNTUlIRiPvuTJtKeff+GGnR9nnFLi1hXH8LEEIz+G:xF1j+9lQPwgQuDXGR0hXz
TLSH
T160B21932DC95DA7BADE78BD9A70A7646DEE0426385C96AD4D9D92D0C00CB2ED0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5ce6e518c4a75495ae51c2e3629f57cc54349ce516df231521ad54a762895540
MD5 ece28e1a9f5547d2d10c69186ac2fd10
SHA1 1f1659048390653907bad1500677f2dba28d47b5
SHA512 7e05d7b27e87319caa521a819c34a759feff1fb7816ebb99dfa82d9c2ee7d3741686b85c670840d08112cea4d3e2f8ef86eb1efc49785d612441b026deecb818
SSDEEP 384:n6iFKtNn/s3n9S+8NLP8TUNTUlIRiPvuTzXAeff+GGnR9nnFLifhXH8LEEIz+G:xFKj+9XQPwgQu3BGRShXz
TLSH
T1CCB22932DC95DD7BADE78BD9A70A7646DEE0425385CD6AD4D9D92D0C00CB2ED0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 63185fbf6160c2e1934b335ee846685796d29dfa71f3735d04ac71877df672a3
MD5 cc0b3393eddd2b434852209cbcc1f25d
SHA1 cad1be41186d2d7a4db4208d2186524b3eb8a259
SHA512 13974f0d0458b26f3f2e5ca6992724f264e2b3d782c84e3ec045d1d402db5bb4a231a29e2bf96a15e6bfdf48e5a40866cbc50eafbe0a757a93c7c2cf029deb65
SSDEEP 384:n6iFVZcI+8NLP8TUNTUlIRFPvuTzXAeff+GGnR9nnFLifhnTKwBODNZOCdWx8LE7:xFt+QPwgTu3BGRShnewBKZOIWl
TLSH
T1D5D24A32DCA4D9B7EDE78FD9A6497206DEE04263D58C6AD4D9DD6E0C00D72AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b7b8909899ad84bcb127845bcaa27f2b73ea5107a43dd15ca4de880151f32dbd
MD5 d3bfb829d56e8edb3b3b2744bc4d9463
SHA1 19bca7a8676d621121c61c25dd32d9c9c5c64c6f
SHA512 d3134ff105e56c31e2f252b688e926981953589f5a1654013c62ef3a48c9548727ff5dea60f495b96caceec5f52e6af4158590b34b5c775f79134bf6a156a960
SSDEEP 384:n4iF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuZReff+GGnR9nn/LkOObjI9G6w7uW8O:DF1j+9SXOwgUu8mGRRk29Mj
TLSH
T110C25B36DC95CEB7EDE74F98B24A7A4AEEE01267859C69C4DAD85D0D00C72ED0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7f8f347-4f90-4ba3-af84-a9818f511cc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c7f8f347-4f90-4ba3-af84-a9818f511cc1.tmp
Size 28KB
SHA256 f552cb0cac2151c1013074c717213604da83c18d81e630222b31bb311174f575
MD5 d2093ed52b35224c6f0bd76ad72d6fdc
SHA1 748dd675e479ec36d3ab8810d6ed5c0693049b03
SHA512 3665fd3de3d851d324dff0bd2a488897cdbf88ff98012c8050a48f38f99cd5900c0a1915c2171a51fa3a9fd8c5ebbf834ca0815e170acae13bb9ffbf1a2586bb
SSDEEP 384:n2iFVZcI/58NLP8TUNTUlIRFPvuTzXAeff+GGnR9nnFLLLhnTKwBODNZOCdWx8Le:dFt/5QPwgTu3BGRnhnewBKZOIWl
TLSH
T139D25A32DCA4D9B7EDE78FD9A6497206DEE04263D58C6AD4D9DD6D0C00D72AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

code(3).bat

Path C:\Users\Admin\Downloads\code(3).bat
Size 2KB
SHA256 f24d44d8a5082bde2a688309c22ce0686b345958d9fde4038c5100f6d0de302e
MD5 b3f7cfc201c010bffee3cabb5325f56b
SHA1 327a76c0d6e6c402bc679d75dd4310584eff2805
SHA512 1d7993fa5f677433b40029f8d194a48eead9ebdd49e63df518a0e0063d6c42d470cdb8d4ea9b30425df56f4b04769e7d98fa682dd1a29210657503502620b9a7
TLSH
T13B51B5676840157E87FA8990DEC7C368B79E527E80091AC1F9EDD18C1089DE8C7AC4BD
MD5 SHA1 SHA512 TLSH

Submit Download