hxxp://stripchat[.]com

Analysis

user interaction
yes
max time kernel
40s
max time network
42s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://stripchat.com
Sample260807-lr2xeafb33

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2436	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 5844	5164	msedge.exe	83
PID 5164 wrote to memory of 4656	5164	msedge.exe	86
PID 5164 wrote to memory of 2436	5164	msedge.exe	85
PID 5164 wrote to memory of 5540	5164	msedge.exe	87
PID 5164 wrote to memory of 4656	5164	msedge.exe	86
PID 5164 wrote to memory of 4656	5164	msedge.exe	86
PID 5164 wrote to memory of 5540	5164	msedge.exe	87
PID 5164 wrote to memory of 3740	5164	msedge.exe	88
PID 5164 wrote to memory of 4144	5164	msedge.exe	89
PID 5164 wrote to memory of 3740	5164	msedge.exe	88
PID 5164 wrote to memory of 3740	5164	msedge.exe	88
PID 5164 wrote to memory of 4144	5164	msedge.exe	89
PID 5164 wrote to memory of 4144	5164	msedge.exe	89
PID 5164 wrote to memory of 2548	5164	msedge.exe	92
PID 5164 wrote to memory of 2548	5164	msedge.exe	92
PID 5164 wrote to memory of 2548	5164	msedge.exe	92
PID 5164 wrote to memory of 2972	5164	msedge.exe	94
PID 5164 wrote to memory of 2972	5164	msedge.exe	94
PID 5164 wrote to memory of 2972	5164	msedge.exe	94
PID 5164 wrote to memory of 3400	5164	msedge.exe	95
PID 5164 wrote to memory of 3400	5164	msedge.exe	95
PID 5164 wrote to memory of 3400	5164	msedge.exe	95
PID 5164 wrote to memory of 4764	5164	msedge.exe	96
PID 5164 wrote to memory of 4764	5164	msedge.exe	96
PID 5164 wrote to memory of 4764	5164	msedge.exe	96
PID 5164 wrote to memory of 1892	5164	msedge.exe	97
PID 5164 wrote to memory of 1892	5164	msedge.exe	97
PID 5164 wrote to memory of 1892	5164	msedge.exe	97
PID 5164 wrote to memory of 3108	5164	msedge.exe	98
PID 5164 wrote to memory of 3108	5164	msedge.exe	98
PID 5164 wrote to memory of 3108	5164	msedge.exe	98
PID 5164 wrote to memory of 2768	5164	msedge.exe	99
PID 5164 wrote to memory of 2768	5164	msedge.exe	99
PID 5164 wrote to memory of 2768	5164	msedge.exe	99
PID 5164 wrote to memory of 3124	5164	msedge.exe	100
PID 5164 wrote to memory of 3124	5164	msedge.exe	100
PID 5164 wrote to memory of 3124	5164	msedge.exe	100
PID 5164 wrote to memory of 4988	5164	msedge.exe	101
PID 5164 wrote to memory of 4988	5164	msedge.exe	101
PID 5164 wrote to memory of 4988	5164	msedge.exe	101
PID 5164 wrote to memory of 2220	5164	msedge.exe	102
PID 5164 wrote to memory of 2220	5164	msedge.exe	102
PID 5164 wrote to memory of 2220	5164	msedge.exe	102
PID 5164 wrote to memory of 4956	5164	msedge.exe	103
PID 5164 wrote to memory of 4956	5164	msedge.exe	103
PID 5164 wrote to memory of 4956	5164	msedge.exe	103
PID 5164 wrote to memory of 5200	5164	msedge.exe	104
PID 5164 wrote to memory of 5200	5164	msedge.exe	104
PID 5164 wrote to memory of 5200	5164	msedge.exe	104
PID 5164 wrote to memory of 3656	5164	msedge.exe	105
PID 5164 wrote to memory of 3656	5164	msedge.exe	105
PID 5164 wrote to memory of 3656	5164	msedge.exe	105
PID 5164 wrote to memory of 5768	5164	msedge.exe	108
PID 5164 wrote to memory of 5768	5164	msedge.exe	108
PID 5164 wrote to memory of 5768	5164	msedge.exe	108
PID 5164 wrote to memory of 4876	5164	msedge.exe	111
PID 5164 wrote to memory of 2328	5164	msedge.exe	112
PID 5164 wrote to memory of 2144	5164	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://stripchat.com
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff81cc7c188,0x7ff81cc7c194,0x7ff81cc7c1a0
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,2418126211591482480,5873858731170896261,524288 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,246656341645964325,15674613122050251094,262144 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,650654470517831210,14523576835341115137,524288 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,593440902706781768,3428065452839134598,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17508118764479766870,1997766943847119996,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,11947415460854923945,9682176152799775134,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3700,i,8634273362839072586,620118383409554752,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3508,i,14833921970244672993,5017762566667940422,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5772,i,3298427325807389084,13042729166180668538,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6028,i,6806371369723000802,10133200726852661926,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6244,i,16545912650944978670,8867172945546161363,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6396,i,4672584733697517939,817850267427395874,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4852,i,9703805722415462701,6907671710166775782,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5676,i,1676708935143435839,2103914844695134826,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6536,i,18153409956263503693,13361724125938382023,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6896,i,671923104483179793,13582831539301502337,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6276,i,4327613305460078008,2693037603153218622,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7448,i,12366589736439907692,9396395410146969620,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7864,i,5260699788490313903,15388109752313740630,2097152 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,885952911367369038,9709765882365518229,524288 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8853118893968081197,8272778137420778765,524288 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8204,i,4697428524272589335,7268964104874326425,524288 --field-trial-handle=3000,i,8078912725458505814,6868363835430394687,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:8
  2⤵
  PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 59KB
SHA256 94cbfe216ff5a1acee212eacbaffddc4becd52544df9bb6f99e9487fb3244d1c
MD5 a16399ff963fcf04c2d92db4ef33f888
SHA1 625ef6037986ef4cdf3b0c5446cf17a68b4264b0
SHA512 0dc08cd3555affc0e82a1ae6e960ac857660871155ac94e30392510fafcf08be7734d995177a2690f18ef6d716f2d477aebdc5a00934ee22af0ae86dc6ba577f
SSDEEP 1536:J5aqYLLivKKznqI6Qzms7I9uhqP/VDdDcldYMh3ZuzxGA:JiLuvKKznqI6QzmEiuqHVDdYc8A
TLSH
T13A5302CD71376D96C0ADD447E3B9A41E34A252A9727C2B61B8AC0CFED8F5DC70A84364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fe49819716810074c10dab24e8abfb22e5c97e3c20638c4db4e15f1a21e911cb
MD5 6385a56f7f8362fab4ee41f92bb597fc
SHA1 17519e504ad9dec4391e01ba641ca224b3210faa
SHA512 3e5a77f1083e963db6570f0e62e4fc02b40cb56f789e15f91c8171f2ca5f90960a2dfdd29c43c5aa27a654d1a35237b3c2d6b879055c9cd4c190e841e31530ff
TLSH
T12AD0226353C0B0F9B66C3E9140AAFC9FC33620205982DDE812E098DD263656C6927248
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8bfc49086a37882e4ffd860262d253436a74ea784fd4774c0cd4607ff21c126e
MD5 4b51413da4254b72de1d838cca97d502
SHA1 e65db5dbb0bc88377078a7b6fb924e19f80b7b94
SHA512 9b7e5ce2f1bbee30935119c26c8991ae2face7c4486ed09614ab5193fee1869fdfce42242066a46efef868e23ceae8c8410807cf77dee2b14dbe300dd97a2ed0
SSDEEP 192:sxZZR8yMqZjK1Ml8MkX/f3smg4CZtszodpUpdjqcHW6+WN5pUB/YqouBIgjEwJ:sxZZtMX/f3smg4EtvUrjHHb5i/zjP
TLSH
T14062E8566A249D7BCCDBD209FA457B53D7F90523D2804E589AFC8E1C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0bbb378a5d49bb0aad3acbd1bac412b756dd5ff9b2220ba42025ebba1ce4813f
MD5 307418e8ee05b4c1ddbba8b7a5462fe9
SHA1 e1719e1e8bc09268ae374c1f5af40155b6298dd0
SHA512 3a7134e1e2e306ff8b395e695b8cfe38e4798272fa2f00c3776a76ea343753b7dbb37898b8edf069765e45a43e104aac0e74e01ce934fbc1d9cbf827b8ebbddf
SSDEEP 384:sxZZQsm1X/f3sKYEtyPUrjIHbwP6WI/z3nE+X:shxm1X/fhYYrjIHbwStLVX
TLSH
T106920792652089778DD7C119FA55BF53D7F80422C9804F98AAFCCA1C04EB6FC2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 767567e423e5e544174c5ca175af5c25f36d091fd8f7189458185dc1c1e75ae9
MD5 2e5cd3746e8cce5abbb5099759fed1bf
SHA1 9150814c2570bcbcae3dcb179899ffda84faf2b1
SHA512 96adc5abf2899e9f4071b0941b09dbd68c0f970893854f5201517c7672411464543a37dad974c3e908cda68563a454bfb731eef2b2d2ff13021a3c89455aed06
SSDEEP 768:+IM2tv5WvF3I/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4sLl2cNV9rolDWr8ljQ:+IM2tv5WvF3I/u1ja1sLUcV2lqr5
TLSH
T164E2E93B680CCB7E4F840E9DDC266F976ED8018BA698495487EA484C03C77EB52265DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index
Size 2KB
SHA256 984393ea9ff9cdda93bf4e64f087e1e5ec13ff42f14a8d39215d8afde47515a7
MD5 968bb3302b039e9ddddb35873c7c23df
SHA1 fc3a337066c085b7d4b896a08e247f50341f8bf8
SHA512 cbb5994594e86b87c4a1b622f81b11a3494e178f6ccdf38a1077f46f4dbc08d3ea9209892a7a46a65d3dabae4efab94d84f585a7c7c55eafab988248f3fa961c
TLSH
T1E151D78D0D47572AD9AC567314B314A437B0ACCC6B5456137CBC6336784376D1A6F39C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c09c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index~RFe58c09c.TMP
Size 2KB
SHA256 c1d92e1933e3c011b64b53112a8106419c8bde521e04fddd5fe5ed5df56361f3
MD5 2dd37ee177fe195d6d758c6dffc01edf
SHA1 f3f2fb3caf6a3cf14d2dc14c5b4ae14385d7ffe0
SHA512 1fc52372fa736de664e11a40055c5ae0d46505ed3aa15800d7670055e212f065dfd14222dd0bbed3716c5ef7d7c40d8d6308084977ac44ed14bdc4ee3b1015ec
TLSH
T1D551C49E8E42463AD8D441B309D3A4A4373959009B1ABE4374FC9636BCD33AE3D1E3C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83a2edae-fbbc-4cf6-94d9-76b665f24852\index-dir\the-real-index
Size 72B
SHA256 95197c70c43e2a9244480e1864b7c0bf21dec5156923bffdc6137576ab30f3ce
MD5 694a480f1faffe23d8c16fa3c85ad8fc
SHA1 f4b9bfeef1bdbc5a05990bc0373d3c67d37a8978
SHA512 d87246d130acaffa6307bae157e7e0dc5ceed4e293e76cd5e045e6f18f1dcf256da8ba5f356538974f70cbdf35aee61fc4df1afee333adef0ba888ee23a39048
TLSH
T136A002201DE4DA82C00507F09282D1513398AD160101530D70E0045DCC921F94621088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb28abc2-2861-41d2-a193-109ce7f6a885\index-dir\the-real-index
Size 72B
SHA256 36e86e07573762246822fdeab4daff962e53c8c3316b8ed497a7763da5466d89
MD5 480d6ca589903f9ce856440ebae5bfc7
SHA1 8fee6e47e2c1cd80629efd63d0826627965419dd
SHA512 2220fb7709a5f17db20f57b3a89f280fb32f55be42ee86c9376f1c9a9b3aa1ddfa13c522bddec1c48f936ae1115af93716ae84ce697d6c6b7c3fb547057001a5
TLSH
T15DA002910351105FC80913B0748391C4622449304113464D4B95B9FADD661804645502
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c927.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb28abc2-2861-41d2-a193-109ce7f6a885\index-dir\the-real-index~RFe58c927.TMP
Size 48B
SHA256 dfd50408b68cca72bfb4c244e4e980f51c05b16db7e1ed876b0db05345d57f41
MD5 984ca68ae7e8231eb5bdf11ec12ccb04
SHA1 270269a6f43bf7caf16344d7d4140c09d6805064
SHA512 5b2400bdc32501bc0dcc538b5f80139db5c84c65746c989e64bbcf0b1a7d1526d513c9e0ca233b21d10ec9a2a6baeaeb84c76c28c9237fc8cee51127b103dab2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 423c068e791e7c23e36132f943ae9461362d6b7d97b6fa8a0d5e8440cfef6cca
MD5 e0e113bbd768b2cb46fd104eeb43659b
SHA1 5c6c2a6f1da841d0917814ef390128972c3fbb44
SHA512 66566743324cbe292936d3d33cc76467ec3cfdb32e73ea366d6da093e0c690b9d40521871c3a48480e44f1eb22b6e074e1e27428b55895b0493df9eff9cb5236
TLSH
T10FF027B77EF31C20FD6FC3D5287104A446497CA4C861AD0F2426BAABA1B23092449C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 dcb03c3366a6969bc8a584dfb9935bedfe41ba53ad957e1d930b9cbba03ad3f4
MD5 64f41575232e3a510af751ae20bc4840
SHA1 ab908efd460e37ca02a9b8ecf93b263fcac411dc
SHA512 63d18d93bccec8756a08e9f482bcc714011ef63ab65e0851c131bab7327615efa2e3619a6e3a73094fb971e27a43df00d5c16528e29c99a76efedf6786fe5639
TLSH
T185F027B76EF31C20FC6FC3D4287104B4464578B4C871AC0F2426FAAB61B23082449C72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\18286f80-2166-418e-888f-18f9583dd883\index-dir\the-real-index
Size 96B
SHA256 500e20f37282faf40a750c3014694ba9c72f7cf496120b3b79cbe54e1a0fb840
MD5 a4aca022a4c3c0362e6819f6f11dc655
SHA1 671af90334ae4355c7cbb5e77c21efd46aea5df7
SHA512 70d3c44f5b3f7fe443632761c469c7fcec18789cabbfe82d88c086e44b57658e23668d8dfae265fb5719accb25e8be0ea4eaea46b1c64d823b4993eda69bc661
TLSH
T11DB002B24201124FC02963B4BA9ACA9E73396EA45FD2139BF2F6117ED5F16C681CB540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5895e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\18286f80-2166-418e-888f-18f9583dd883\index-dir\the-real-index~RFe5895e2.TMP
Size 48B
SHA256 700fe6b354cffcca8afed2dad593da8d308d03b44582c776a5cea748e9a7d177
MD5 91480a50b6a3c348ec44746eb73254ea
SHA1 389170285d0d2b1cd00ef583ba0d305a890d7b84
SHA512 84011cd11c5c511ad6f1b9213317b03b12965d5c024745413e98460edbc724250ed8fd646b021cbf2c17b74e0794b2d6bad17eaedfe2f6f3982006b762db09b5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\index.txt
Size 176B
SHA256 f53c99d2fef72e9db19d725d59ecb21e9c725d4e2f517e56204cd06ed672d7e8
MD5 b4569dd3d79b2be2992e6decafc5ef63
SHA1 2361cb2e2b233ca765a19fb9503da12ac4772590
SHA512 38eeb77a25d2d701acc2df8ff4ddc7c5bb831bbf5abf62d794617f6bb526f361de2199ffbc5bd071639a111952a9d5c028f516102a9f53374e85ce4de4adaf60
TLSH
T1BBC080F36910501C0F13427A85CF72659C3F17D057DD585C4D500551206F6F33075916
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589621.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\index.txt~RFe589621.TMP
Size 181B
SHA256 8d0e999dc96f2b815e0b05fa5c019e016868391d98ec05d58c43a0477360fe30
MD5 a26911c22d440da473bbbe37737053db
SHA1 e9a7371fb4895b63a2d6047819d6e2b523ff5dd2
SHA512 a3814915a54032e4b30e6aab5cd9192909ea3243a9a8943ce276dfd1516d2d0c3393b9601935a5ee2c28debbe80fc62861820571e63fc4f80c198837cc908166
TLSH
T1A8C080F36530501C0F13417BC45F61559C3F5FD016CD985C4D913551207F1F3607591A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b1aedd1508caf4381cf1a371271d1e38607634bec343bf9a34d78a6aaaf8863b
MD5 cce6b19ccf0f03e6ca31ebc5f048a6c1
SHA1 e9f14ef3af6c0acaed18b6e53748f3b99f75e6a7
SHA512 d72eba98916f2e24d2ab4f7c61804d52907b9613ee7320a322a00174ca2b1859b1264fa1932835fc93c56053c7f76ae77bd9dc754ef963901aef5ca3cbe8d942
TLSH
T1E3B0220280CF208BE2008B38C28280A033300C20030B3A23A8E0FCBCB80A38082223CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bf25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bf25.TMP
Size 72B
SHA256 678339055656f0dd158c1cde6f262f2dcec1e6521259ed916435434c73094a23
MD5 58f53ccd4d45e2c6a01dea054562e57a
SHA1 51eeb9575d9719cc96cb2a9f7329c81a1d3b4f01
SHA512 bd546832d3316401879b8dbd79c02087516dd03de318a876fb050ca4ceebc939797c068a75e8bc09b338dc7ada2dfb7efca1e1baf14f8d0da6348e1c45ce7b6e
TLSH
T1A1A00222834B5858D40005F2940722615350896A130012069495909DEC915CA5571109
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 768af7df72129c64329d9bf5c3f843a8a6652700fcd984646f235e4ba0ae43c6
MD5 0e55f1a83942eb96f561d39bb4b4ae69
SHA1 fd41c672a75bc3da0a7b7b4ae7bdccf8af9c2981
SHA512 a20eb23b781cb0040c1818cfd183f6c1233f570d88d05a12d0cf4e2ba0156115fe8900371f7f7ecfd8c8038a79857b8bc490883d5503697ba733bfa182f4d951
SSDEEP 384:nsiF9CcmyWCs3sNb8TUNTUlI4k9n7fWpQZiBf+UGoAk2I1mpqJE+jukje4KV8p0x:XFccps3AwgjUGbkxuq2MukjI8p0R7
TLSH
T124C24B31EC54CABBFCD64B99B74A7A07DEE0422786CC9AE8DADC5D1D00971DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 db8870d8e1dd035a6390b35e6b0be492ff6bd67e8032fdfcf4a6c6021c89c23b
MD5 14fe755e0e1f88fe44e365e0b6cdabbc
SHA1 f2f9df84159b3e0bb2e3061422c87b351a12afe6
SHA512 8a93b94e146498c290eb9dd6e5d408993a63404d26144eee0d4778e481905847fb9aecf787b196cc949ffece07b9eb88b602fecbf9031b96cc9294646d386c71
SSDEEP 384:nCiF9CcmyWCs3sNb8TUNTUlI4kqTn7fWV09iBf+UGoAk2I1mpqJE+jukj55Qty/R:JFccps3AwgkIGbkxuq2Mukj3
TLSH
T141B23A72EC95CABBFCD65B99E74A3A03DEE0426385C89AD8DAD85D1C019B1DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f3cc21569a882ad1a1638fe5529bb5dc68f25c241ebbbdbe274dde6c20249211
MD5 74ab5b68a930e9c411068890c21542e0
SHA1 2e872ceb7af6a8fbe18ca0494a1607c92a519d5a
SHA512 0b33707fbb588f221f4684c91ab600992213a0957230a8f272cc9b1f520ca6b38aab3bcfb2965b26e87b629751b3468c319986bfd4cae7a6be600a7646989ae8
SSDEEP 384:n5iF9CcmyWCs3sNq8TUNTUlImkrn7fWmKmiBf+UGoAk2I1mpqJxae4KV8p0hHotf:QFccps3hwgYFGbkxuq3aI8p0Rm
TLSH
T127B26C31EC59CABBEDE64F99B74A7A07DEE0022785DC9AD8CAD85D1D10871DD030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dd07c744751b1bf738ac1cdd36e4ac6579611de8b2c2d86ee81c85f54e8b230a
MD5 3a74c33d942a3f18ae769bd20c1f749d
SHA1 874fcad858d3348d4a6a2cae912221c83f11ac49
SHA512 56a8dfc5966eb3293f85f75dc4cc7857d13fe24fe6e6b996e829c446e98b4e096873c5bba094f96491155082f2abbc69efe0219330d4e4cc0cba393d0c9c0b39
SSDEEP 384:nsiF9CcmyWCs3sNv8TUNTUlImkrn7fWY7KiBf+UGoAk2I1mpqJE+jxkje4KV8p0Q:XFccps3QwgTZGbkxuq2MxkjI8p0Rm
TLSH
T1FDC24B31EC55CABBFCD64B99B74A3A07DEE0426786CC9AE8DADC5D1D00971DD430B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads