hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

user interaction
yes
max time kernel
234s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo
Sample260806-285bvsck4z

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3312	2800	WerFault.exe	124
1176	2136	WerFault.exe	129
4524	4024	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3892	taskkill.exe
3252	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305317796155890"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{FBC0222E-2C2B-469E-A5F2-DCCA686C0FA5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3924	OpenWith.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1052	4636	msedge.exe	85
PID 4636 wrote to memory of 3988	4636	msedge.exe	86
PID 4636 wrote to memory of 4420	4636	msedge.exe	87
PID 4636 wrote to memory of 4420	4636	msedge.exe	87
PID 4636 wrote to memory of 4420	4636	msedge.exe	87
PID 4636 wrote to memory of 3340	4636	msedge.exe	88
PID 4636 wrote to memory of 3340	4636	msedge.exe	88
PID 4636 wrote to memory of 2016	4636	msedge.exe	90
PID 4636 wrote to memory of 1896	4636	msedge.exe	91
PID 4636 wrote to memory of 2016	4636	msedge.exe	90
PID 4636 wrote to memory of 2016	4636	msedge.exe	90
PID 4636 wrote to memory of 1896	4636	msedge.exe	91
PID 4636 wrote to memory of 1896	4636	msedge.exe	91
PID 4636 wrote to memory of 4064	4636	msedge.exe	92
PID 4636 wrote to memory of 3772	4636	msedge.exe	93
PID 4636 wrote to memory of 4064	4636	msedge.exe	92
PID 4636 wrote to memory of 4064	4636	msedge.exe	92
PID 4636 wrote to memory of 3772	4636	msedge.exe	93
PID 4636 wrote to memory of 3772	4636	msedge.exe	93
PID 4636 wrote to memory of 4836	4636	msedge.exe	98
PID 4636 wrote to memory of 4604	4636	msedge.exe	99
PID 4636 wrote to memory of 4836	4636	msedge.exe	98
PID 4636 wrote to memory of 4604	4636	msedge.exe	99
PID 4636 wrote to memory of 2284	4636	msedge.exe	102
PID 4636 wrote to memory of 4296	4636	msedge.exe	107
PID 4636 wrote to memory of 4296	4636	msedge.exe	107
PID 4636 wrote to memory of 3788	4636	msedge.exe	111
PID 4636 wrote to memory of 3788	4636	msedge.exe	111
PID 4636 wrote to memory of 3788	4636	msedge.exe	111
PID 4636 wrote to memory of 2800	4636	msedge.exe	113
PID 4636 wrote to memory of 372	4636	msedge.exe	114
PID 4636 wrote to memory of 4440	4636	msedge.exe	115
PID 4636 wrote to memory of 4052	4636	msedge.exe	117
PID 4636 wrote to memory of 4052	4636	msedge.exe	117
PID 4636 wrote to memory of 3204	4636	msedge.exe	118
PID 4636 wrote to memory of 892	4636	msedge.exe	119
PID 4636 wrote to memory of 892	4636	msedge.exe	119
PID 4636 wrote to memory of 1920	4636	msedge.exe	133
PID 2444 wrote to memory of 3892	2444	Trololo.exe	141
PID 2444 wrote to memory of 3252	2444	Trololo.exe	142
PID 4636 wrote to memory of 2852	4636	msedge.exe	148
PID 4636 wrote to memory of 2852	4636	msedge.exe	148
PID 4636 wrote to memory of 1708	4636	msedge.exe	149
PID 4636 wrote to memory of 1708	4636	msedge.exe	149
PID 4636 wrote to memory of 2736	4636	msedge.exe	150
PID 4636 wrote to memory of 2736	4636	msedge.exe	150

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd6931c188,0x7ffd6931c194,0x7ffd6931c1a0
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,14061413626402870502,5672083023071106001,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,15636991161311222579,5421705793098909747,262144 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,4945800798675815076,17404470345397059790,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15648740307562999903,5674347861910856007,2097152 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15219887404146824393,8670924496153349040,2097152 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,12497481519968616095,10066251726720301504,2097152 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,7265763363409830121,908839069571304720,2097152 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,15900549683327107486,1840284346510768328,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,16471626456262006400,13960754341615132137,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4454055687619123219,9052352076582270466,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4454055687619123219,9052352076582270466,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,1429939232638972685,3535126414842600116,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4820,i,7890692129121065651,13448586903923398690,2097152 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,14252203463323794853,13411266917555521100,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,11381980702674897799,18130447539409174254,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,6007134679880573931,10462287274051938919,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3020,i,1669603666787495060,5539534844970009812,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3775265364737691302,7945614914040987781,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16172754809896181113,10260616799584737993,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,13092428432294314615,11392502723413091503,262144 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,8308155968931311342,5560421137810758681,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,454110481695545537,10890965831395048124,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,10120607144545706024,2716753130091178547,524288 --field-trial-handle=2312,i,9800435132756416117,15588933615294860815,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3924

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1556
  2⤵
  - Program crash
  PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2800 -ip 2800
1⤵
PID:4728

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1528
  2⤵
  - Program crash
  PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2136 -ip 2136
1⤵
PID:5044

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1528
  2⤵
  - Program crash
  PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4024 -ip 4024
1⤵
PID:5092

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Flasher.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Flasher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3244

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Hydra.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1020

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Launcher.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3000

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Trololo.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Trololo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3252

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3548

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Popup.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Popup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x498
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 d8cb9301e7ddd5806918d1205d50e96973c41fc76a76f81b486c4a8726d92a19
MD5 c21d4a2b62784e1ffba7bda3bb5ea775
SHA1 1ed9d995078c0d57fc8bca6ecbc6e8f9ecd809e6
SHA512 d34c9e90ef142583cb24641c3f565fef955ab5507ac8571f4670542f77541fccc8578b70bee340a9abee5cfca66e6adf6494928f5a0ad593ba3b98b77cddf5e3
TLSH
T1EFF0FC4563CACAA969C095C79578A32A80D1F3DBEE8CDD5F620874CD644005293D5BA5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 87febab177c508788f72b82c8e749fa83ebeb0b0c51c1cba8ffc4b2405d4f518
MD5 06ab1aafd429c6f926de4b17ce048b79
SHA1 7d5ffb0defea69eef85cd46d3dd4ef415e07d10e
SHA512 1e3729051d7aaa90d908f4770e9e5601ff6a418dbe026654d7b51f8634f8251565e6d8be3cef95944c302d895359e2652e86d47c1d383e75df77170afd823e15
SSDEEP 96:nVPfFJDZWJ7oCCAH6lTbBMrVewEAATFg2kPbCFZ1l4SQN+kT0iV3Ve:VP9JDhiH6lT+BehW6lINTx8
TLSH
T1B0C1C418DE47805EEFE03270E3C1A1B77471CB668A13AEC9F3D4DCBC590C3A64586A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ad4cc4fe2bc6fbb2ede07b5d08f22489dee50af4bc24cbf63cfcdc8966bc570c
MD5 5caf7cbfb6a04904a7de912d5989cac5
SHA1 da84ab46c8e2327fc31f440d20018cd466d2e898
SHA512 99d5c9ae86a8569c4fea4a76fd8df75e881fce91ed9fdc6db100724c6c4e577cfb09c41339a98ca19f16412b91a8cb11adc94d368ea1f817563cfa3bc40950e5
TLSH
T18161B75D1E46C063EF603230D1D261F574724D7A8E13BE0AD0C8DCBD580D7E7469AB18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 96cac85ae144ff9215368efb7a007317f97527b5a85cb887124253c6fdb02c19
MD5 b71a773920f692a8d61b10d0ef195aa0
SHA1 80ae3c26a49cca07ae1b26a888bb840b38fc676e
SHA512 6ae7a5a3e720881a11795c31433d91331573732e99c30c1a74caf8333b2b2b6b98c9a49c0e6ee5de07c3ebb0388584bc81a413d05552b83a8489e2807447888f
TLSH
T1054179F787E1956D8A0255F0AA18EE1BCE2C0110831C7879C5E0BE57D7E3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a23bfcbd99fa79d4b618e893b6594a3df8463ac126616ae5efe693e06c843734
MD5 4a9fcb1bd134c8abe2970578952fe9b0
SHA1 3ce59f4cd4d2d550498f8396c5d665735c4d155e
SHA512 32f30cf8384fffdcb82f4cf9f116c27cce7f6e507ce3671cb9679b653664716de57de97d260bba12ed83d370f36a18f012d3ae5c574796c3ceedfe883b51654b
SSDEEP 192:sxZAR4iyM/jK1Ml8Mk2/fhslsz5eIdp9/fBHW6+WNYfCTL/YHM4XisIgrJ:sxZA+CM2/fhslsNPxBHb4CL/129
TLSH
T13752E7566A346977CCCBC21DF945BB53D6F94422E2944E48A9FCDA0C00E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4dcc2db1534b02159a3f2d795baac43e4c32e0caa28bcfd609bcd2af6cbcfd7f
MD5 5496cb0d60336dbdf33cba9f47bab801
SHA1 877515345e9e6ef14faf444309795d4caaef9c7a
SHA512 f0d12a26a06ff3aa7efc52ffc105da2568680789f040dc0a52ad2190a8ebf94fc95fa79c72ec7b003824938ff2c422d50a5de679893455a36aa81c39cdfb4881
SSDEEP 192:sxZAR4iyM/jK1Ml8M92/fhs8sz5eIdp9/fBHW6+WNYvVXYHaXisIg56J:sxZA+C12/fhs8sNPxBHbKXxg
TLSH
T1B252E7566A346977CCCBC21DF945BB53D6F94422E2944E58A9FCDA1C00E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b3aeb24e42b274538ac74eef05fa65d8e5b577d03758bb2a48790d0eb52bb037
MD5 4b30c5696a677ee8239bc6f14248bc37
SHA1 d033a2edcb24af7bf9a7df9b60543855e9c88093
SHA512 fd915c3936509760f10946cb9bb7776aec2e5d901437ff4389a62f81ffaa90450ac088889c413972b45810fe040070ef0d153e4df13f3efbb058bb84f005e595
SSDEEP 192:sxZAR4iyM/jK1Ml8UQZj2/fhs8szJeIdpv/fBHW6+WNYvVXYHb7dsIg5+J:sxZA+Cqt2/fhs8slPvBHbKXpg
TLSH
T10462E756AA345977CCCBD21DF9457B93D6F94422A1944E48AAFCDA1C00E7BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5f5c81e14446a2d96424966620db2a98353613134499d07e8dfc4f0f1ac9e810
MD5 8dda64046c7860d2e6bc08d051f57bb1
SHA1 ad0cd0dabf49c1494bf9f457f7884b7db668b797
SHA512 80101973979356d7bbaa890da0803c1644dd4892faa75e2569b308fe17a768b71607e0e93500f41c1a8509835c61335b79ef80c9a1face2376ac901e4c904be0
SSDEEP 768:Uu3AUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R3iroVP00:NQUZYTMWvg0Pou1ja7eLZmRJ20
TLSH
T18DD20A2F280CCB7E4F844E9DEC2A6F967DD801CB5A984D5447EA884C03CB6EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0d672dbbd18af2aa08cc8fa73418469568168735f421479b6e8384424f487aaf
MD5 c837453f713bfd2c290ea81a6b72cc68
SHA1 e93ae71ac86f1f6d92a4a8991c840718fae40385
SHA512 e1870851e2a7dd0a33a50d9ef943ec00fb639c799b7a81336b144f8c6b2ad46a7a257714890f21e0675da3e8befe48aaad764c635447b222b835b3cde1b31ba9
SSDEEP 96:KA1eK2AozWKco+GjaKAQAx4fjxvPxWDGsA7xKI4ARxUJhe7PSiIgKNOmz:E0F9TbzN
TLSH
T1A3E1F51271BB02033C3E2948A399D77A0F45B1D33858A46B7BA904B25E6BE345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bca1c5f2-4629-4918-a1fb-74dd4fa29e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bca1c5f2-4629-4918-a1fb-74dd4fa29e50.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d5a83da16f298b7771fd591b3d3ed73fa651e034474c0c47cde81a7702766747
MD5 dda2b22271ef5626d2b564c425664ceb
SHA1 bd06605c49525b715c1348b94466fe9bdf6bc608
SHA512 694507e64156b915a5f05ec070bb1c6d2f76de63e0c87e47dd8712d672efeaac7cc0dc9aed4aa17855348a253cb5849e605848c70063fdfe1a10d8e69c697311
SSDEEP 384:oZcIhsNECfho+3zX5od+H8ykXBDZPDpOjRFsXVBu7:WhcLONBDZUdFKBu7
TLSH
T129927D7264396C7B99F3E154F44B33139EFC9063A7C86B90C5EC2F1C059E6A8231AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3abfafd72a6a30f567e10f1004dc15b63779190ac34f2a83f7c71704d26aaf24
MD5 0061ac46951b6da6cb69f61151443e7f
SHA1 3fbe073461f8b8d71e833907b7fe9e85a8622d88
SHA512 7b69e076a93ba129268dfcd722767f1fc23e4188c569fb7876c1cd7e06fc667461c708746d8cee9ef1fbb1e26449cd62c38066d2ed785fb1eba571377e02c547
SSDEEP 384:eiFiZcIszsNM8TUNTUlIl3fhoF3zX5od+H8ykXJDZPDpOjRFsXVBu7:1FQQ9wgSLONJDZUdFKBu7
TLSH
T158D23AF244D7983AD9AE9757B77D2E034EBCC063B584A650B3D81A1CCC4A1BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9c7d31ec7ff557792f499269e2fe979b82594b8f866691bf34946ceb3468d27
MD5 3a28b30713845393b1d16f09ecfd4ade
SHA1 280f6ebb7771d78ba0f6300a16c8f7a86d1d90af
SHA512 0ba6f49de0584cc60ba1419523b1bc53cff02ccb43f8862d031b08ed4a6429e480b18e1c14805e65fb802f9c421fdffc4a700b6c67cb1d9fbd4ced1c32059c7f
SSDEEP 192:yONa61VWQmiUyUNgGX5Obd+jTjzoryu/aC3j+U6:yONa6WrgGX5od+H8y96+U6
TLSH
T19A02C735A9686CBB8EE2BE49B44737139FE42067EA946B84D6EC1B1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 08bdf16a32fa76cf1c75be7457d63901b97eee0e3bd042f13ad72bb58e1e3d12
MD5 81f88d1587d11289e619690551f737be
SHA1 ff7dca0ad0954f53beaf8ba83da180b8a72b6156
SHA512 7a066836ef544b402e305b5904a9f64d30c50a26d4e5b8669076e3c97af56e2583d512aff2a346050b49c41c784c1a5cf11775b004f63e8e450452805cd42d7d
SSDEEP 192:OONN617WQmiUypNFGX5Obd+jTjzorykX3HjJaqbU6:OONN6AkFGX5od+H8ykXVDU6
TLSH
T1FE12FA32B528BC6B4DD2B555B44B33139EE95167EA887B90D6EC2F2C01DF65C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a765d1d47e1451af232cab6685bf53303901d0abbc990f08807d01d0dfde77b9
MD5 46bb81674217697967378d01e033d54f
SHA1 9645a53eb5db6fd6ae46e94436d2c2129ea22b15
SHA512 7b8cad06523a62fc54096e5a6c2d8ff6fee8b2b9b2f76fdf74d720ae2332c883b185ebd45679b28a69fbed65fc567d790a0a09efbda088f57564d2861a37b277
SSDEEP 384:eiF5ZcIs3sNH8TUNTUlIlDfhuF3zX5od+H8ykXCDZPDpOjRFsXVBu7:1FRIkwgILONCDZUdFKBu7
TLSH
T1F8D23AF244D7983AD9AE9757B77D2E038EBCC063B584A650B3D81A1CCC461BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 84973db1e14759a7e4a48921e57a43f73408d767ac878acae43ec61775df7c1d
MD5 cf10500073cbc2cda6c1345df5e8b07d
SHA1 8c61fa96ad8e02982735cd304c047d33fd6ee3dd
SHA512 8acb50f580ec04b1916929ed87debf776a7cbfa57279a9b7c6e291f20b5fa5bfdbff16e62fd71f96ea37f19fc11d773ea90bcbe38af26ee249a619d9e7148402
SSDEEP 384:1ZcIhsNE3fho+3zX5od+H8ykXBDZPDpOjRFsXVBu7:NhHLONBDZUdFKBu7
TLSH
T1FA927D7264396C7B99F3E154F44A33139EFC9063A7C86B90C5EC2F1D059E6A8231AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ae7b24958dbb9d7be04cd605411f6b68798fc5d5590cd909554238893fe6d7a7
MD5 cbd4faf5b43fd02b536a6453a36d6bdc
SHA1 fa8d6a600dfd7e31d91698ac99e5e180033e5fbd
SHA512 4e9850bd688b66dde9eef9417b53edd5e41eba75a2b12a3b76d44efc03902ec1160143b2c299acdbd1db3ac5ce81de28b2a00a258270b4304e5279c390022e53
SSDEEP 384:eiFOZcIsVsNM8TUNTUlIlDfhoF3zX5od+H8ykXyDZPDpOjRFsXVBu7:1Fse9wgCLONyDZUdFKBu7
TLSH
T1A8D23AF244D7983AD9AE9757B77D2E038EBCC063B584A650B3D81A1CCC4A1BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8a28f6c0913fc1ae2c5fcb56a34e11c8faa8771ddb07b4c74c249304b15d9a1c
MD5 79b48f19144b9ccb0f82c41df7c81d73
SHA1 6e464ae2d1613374dff8019b0c77e2591302a824
SHA512 0b1af11e882b4d594449d303e6a72733177fd5fe3f233921edb231535e148308be03ec9ca829cb01d4ba795c94d18324a63a435c01a278f448fd24025a90562f
TLSH
T133412858B6F91048B3B37F56ABFA686D48BB78672E06915D10110E4F0A26B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1020-493-0x0000000000F60000-0x0000000000F70000-memory.dmp

Download

memory/2444-494-0x000000001BDD0000-0x000000001BE76000-memory.dmp

Download

memory/2444-495-0x000000001C350000-0x000000001C81E000-memory.dmp

Download

memory/2444-496-0x000000001C8E0000-0x000000001C97C000-memory.dmp

Download

memory/2444-498-0x0000000001640000-0x0000000001648000-memory.dmp

Download

memory/2444-499-0x000000001CB40000-0x000000001CB8C000-memory.dmp

Download

memory/2800-463-0x0000000005300000-0x0000000005356000-memory.dmp

Download

memory/2800-464-0x0000000005100000-0x000000000510A000-memory.dmp

Download

memory/2800-458-0x0000000000580000-0x00000000005F2000-memory.dmp

Download

memory/2800-462-0x0000000005080000-0x000000000508A000-memory.dmp

Download

memory/2800-459-0x0000000004F70000-0x000000000500C000-memory.dmp

Download

memory/2800-461-0x0000000005110000-0x00000000051A2000-memory.dmp

Download

memory/2800-460-0x0000000005620000-0x0000000005BC4000-memory.dmp

Download

memory/3000-508-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/3000-500-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/3000-522-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/3244-497-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3244-531-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3548-502-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/3752-503-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/3752-533-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/3752-536-0x0000000000400000-0x00000000004DF000-memory.dmp

Download