36517b91d06b585c467921e1467349ceaec627cd5aaadbe3cbbfb2778b02c61b

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4WPpgRnbrKEyBAWsMXMlGg.url
Size 79B
Sample260809-qmsv6ayblh
SHA256 36517b91d06b585c467921e1467349ceaec627cd5aaadbe3cbbfb2778b02c61b
MD5 3600fb9b5be9075d3618166fe6633631
SHA1 6bf8734af966da244b8dcb6f9e23a3411aed698d
SHA512 d2d70f74afcf037375c0b16893a9e96bb9735fb2c4f57586b902c48b39ec3a38d0155551a83a83f39647c40e0227054023c8364152663e0a806d340fb857c2ce
TLSH
T1B5A024C1430DC054C407000D31375F10FC571554C4FDF443D340C711144D04344C010D
MD5 SHA1 SHA512 TLSH

Score

5^/10

spotify discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand SPOTIFY. 1 IoCs

phishing spotify

flow	pid	Process
55	5148	msedge.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 54 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4960_1407317196\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_556666169\_locales\it\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5148	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307554053393318"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{8F72D9B9-8B0C-40DF-86FC-0BE314425234}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4960	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4960	4316	rundll32.exe	89
PID 4960 wrote to memory of 3324	4960	msedge.exe	90
PID 4960 wrote to memory of 5148	4960	msedge.exe	91
PID 4960 wrote to memory of 592	4960	msedge.exe	93
PID 4960 wrote to memory of 2868	4960	msedge.exe	92
PID 4960 wrote to memory of 592	4960	msedge.exe	93
PID 4960 wrote to memory of 2868	4960	msedge.exe	92
PID 4960 wrote to memory of 2868	4960	msedge.exe	92
PID 4960 wrote to memory of 6108	4960	msedge.exe	95
PID 4960 wrote to memory of 6108	4960	msedge.exe	95
PID 4960 wrote to memory of 6108	4960	msedge.exe	95
PID 4960 wrote to memory of 3332	4960	msedge.exe	96
PID 4960 wrote to memory of 3332	4960	msedge.exe	96
PID 4960 wrote to memory of 3332	4960	msedge.exe	96
PID 4960 wrote to memory of 248	4960	msedge.exe	97
PID 4960 wrote to memory of 248	4960	msedge.exe	97
PID 4960 wrote to memory of 248	4960	msedge.exe	97
PID 4960 wrote to memory of 204	4960	msedge.exe	98
PID 4960 wrote to memory of 204	4960	msedge.exe	98
PID 4960 wrote to memory of 204	4960	msedge.exe	98
PID 4960 wrote to memory of 4940	4960	msedge.exe	99
PID 4960 wrote to memory of 4940	4960	msedge.exe	99
PID 4960 wrote to memory of 3004	4960	msedge.exe	101
PID 4960 wrote to memory of 3004	4960	msedge.exe	101
PID 4960 wrote to memory of 3004	4960	msedge.exe	101
PID 4960 wrote to memory of 4232	4960	msedge.exe	102
PID 4960 wrote to memory of 4232	4960	msedge.exe	102
PID 4960 wrote to memory of 4996	4960	msedge.exe	103
PID 4960 wrote to memory of 4996	4960	msedge.exe	103
PID 4960 wrote to memory of 2120	4960	msedge.exe	104
PID 4960 wrote to memory of 2120	4960	msedge.exe	104
PID 4960 wrote to memory of 5488	4960	msedge.exe	106
PID 4960 wrote to memory of 1360	4960	msedge.exe	107
PID 4960 wrote to memory of 1360	4960	msedge.exe	107
PID 4960 wrote to memory of 1336	4960	msedge.exe	110
PID 4960 wrote to memory of 1336	4960	msedge.exe	110
PID 4960 wrote to memory of 4860	4960	msedge.exe	111
PID 4960 wrote to memory of 4860	4960	msedge.exe	111
PID 4960 wrote to memory of 4860	4960	msedge.exe	111
PID 4960 wrote to memory of 2380	4960	msedge.exe	112
PID 4960 wrote to memory of 2380	4960	msedge.exe	112
PID 4960 wrote to memory of 5248	4960	msedge.exe	114
PID 4960 wrote to memory of 5248	4960	msedge.exe	114
PID 4960 wrote to memory of 1140	4960	msedge.exe	115
PID 4960 wrote to memory of 2588	4960	msedge.exe	116
PID 4960 wrote to memory of 2792	4960	msedge.exe	117
PID 4960 wrote to memory of 1636	4960	msedge.exe	118
PID 4960 wrote to memory of 1636	4960	msedge.exe	118
PID 4960 wrote to memory of 3344	4960	msedge.exe	121
PID 4960 wrote to memory of 3344	4960	msedge.exe	121
PID 4960 wrote to memory of 5324	4960	msedge.exe	122

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\4WPpgRnbrKEyBAWsMXMlGg.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://open.spotify.com/track/4WPpgRnbrKEyBAWsMXMlGg
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffbdd8dc188,0x7ffbdd8dc194,0x7ffbdd8dc1a0
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3445114404640825777,6084866816976013980,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
    3⤵
    - Detected potential entity reuse from brand SPOTIFY.
    - System Time Discovery
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,194136722755206860,6020503447312916417,262144 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,15099737120634532389,15874247260247543818,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,4596497487656285446,12601604734425381513,2097152 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,7265660859954173673,2445412543528163621,2097152 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,10774441050718573521,5748009338776301753,2097152 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,16984395439714690728,4079165232687291496,2097152 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13020011402118214194,13945207739193913893,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5568,i,16412227349250226294,8183605164337794423,2097152 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,17653934679020405401,493617904415010074,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,394386095531211797,3211154916181750955,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,3099023669382407333,10216852866487634281,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,12207769234802928832,14998886538184601655,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,12207769234802928832,14998886538184601655,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,10918564669908157526,2049005654583005787,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11868093466494611372,15440749756866011054,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5208,i,3198712872669276707,10673816275514702384,2097152 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,12201521026879392291,8932691369405248489,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,16238762982374923448,856851372464071276,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,17903884686928596356,5495114889952299744,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,6751626318734551871,1240882579341652275,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,117719926013247470,5895854548408326097,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,12925485877166565474,709066093092577925,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,7658054267687560614,10790836500465083871,524288 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5856,i,8435470324607239582,4104625954870740531,262144 --field-trial-handle=2656,i,13350279844015069561,745738494171557417,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:10
    3⤵
    PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b6c734ce7e6dc8dcaaf2e0b421c308e86fdc60fe40ffc0d650071277cc693035
MD5 e04959235d7973acf649b05337b3ca65
SHA1 75efad98413681c5aae8f80bf53cb444efa8c55c
SHA512 ac04749f47a40ff1427adb16637f410b65953b5f8c0b610702a1ebb821fa8afc62b244c946134a277868b837238ce2ade7f566a4bba3ef062f061580ef2f6d25
SSDEEP 48:F3OOxxK14/okNlaTG856lhcR18LL9joZFpadhDMDi+FhQVYKclLg6:FPo2aT5ahcR18LL9jCWdUi9Fcj
TLSH
T1AD813C508B73EE90CB228DB498FB58E8F6F1C9460103AF53A2A2DE7C105AF4415E3263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c88401967330baafcb6c83d1139651170b2f694427720ebf4768df5913c0ff03
MD5 60d55e4c8146dddfbe600ea414e8f1db
SHA1 185ed997f4bdbcdf9cecc363fd95050703d33a1a
SHA512 ac32582eaf7f929ce4ae819cd17e4947cb629231a96122b66129cd83897feb110e4965dbc3f619d2241898c6eab22c1ebaab3dec896cd2c538fbc6d2ac494689
SSDEEP 192:D2IbADnh9ayZsVaZjh0ZBesmkhTG6RMTTHpGbqo7MVT9ba:D2IbADnh9ayZsVaZuZBesmkhTG6RMTTy
TLSH
T1AF027BE3C3E9C23DD91152F4AB583E1BCE6E192483383C6A89E5BF1B67D1531E24065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32f7c715c5e4df7d8034bb1081b1c75bae89a1d62888e038e8e544c3dc555580
MD5 5d7056e6274966f995dead28467fc0c6
SHA1 425bfea119fc335c9d623e30f6b358d2056857b9
SHA512 f27bdac8e84afaa5e9037650ce7efe8b362c7a9a2a959753ee28196ca35febf928d68e3243aec2e95fda491e086a95423d0551a8d062796733970cb413118475
SSDEEP 192:sxRNcRHCDX/fEesd315auZZ5NaDKgEzoA8p7tbjSc/g6+WNbttK/Soel2ZgiNGLt:sxRaY7/f3sd3Xh3+DKKR/5a/Lgt
TLSH
T1C842E856A928A93B5CCBE21DFA25BF13D2F95032D0D51F58A7FC9A1C00E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e16721356467345481786020daa0af91ade26ac086571814672b8e4069823b95
MD5 86f824f5ed9efad0a596875526e5fa23
SHA1 d8aafccdb9a8dad4944982e8e9f1c1dd8a732c45
SHA512 ed8ebbd6c7e6fbffbd76c04cee726f1bd2c73f9087db91230845e52b5f9cb51d889d28440e8387dd267808be175e678dd531049080d9a6a12ee6163770da97f9
SSDEEP 192:sxREcRHCDX/fEese315LuZZ5NaDKgEzoA8p3c/g6+WNbttK/SaelcZEiNGLIgVMJ:sxRdY7/f3se3X63+DKKM/5a/HgC
TLSH
T1DA42D7566928A93B5CC7E21DFA25BF53D2F91032E0E51F58A6FC9A1C04E7ADD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 89d54f5b2c5997211454fb1f130840e956e5ded1b584ee1a1f8339393221f480
MD5 a633657d69ce25e79ca1977384260fa2
SHA1 75b0f5df5b86126e250d1e08557e6540803a9203
SHA512 06c4ee0ba1db254f9fe1e31ac8219cb18fd43c275dc6a213c02356a36c5f4382cab435e86e27fc6f05e23f0097ced73b4764359ea632a3a2052960977b899028
SSDEEP 192:sxRJcRHCDX/fEesd315LuZZ5NaDKgEzoA8p3c/g6+WNbttK/SaelcZEiNGLIgDMw:sxReY7/f3sd3X63+DKKM/5a/Hg3
TLSH
T13342E856A928A93B5CCBD21DFA25BF53D2F91032E0E51F58A6FC9A1C04E76DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ba9e31f98c5319e9be1a62649f68eeb030c1d48eb991663d0a835d50bedea792
MD5 d2aba96229850c9a4dafd0fcf810e1f6
SHA1 1921cc59278e94dadb7347e0af13fa12bae91c70
SHA512 1784f2633a7055a4eeec3a6bb46a3696c77bb47f03d99fd34b07b5a32ed0e19a46cad2d2ee7d16926c40a7f8cff4e7ad42b348b31253550173b06167e4c0c3f4
SSDEEP 768:dofA3j7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVl9N131KroiP:dofA3VE7AxWgg+fJJu1jam9Nl1hiP
TLSH
T1C6D2DA7B640CCA7E4F804ADDEC19BA9F6DA802CB9698C94047FD945C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\397e5d81bdb71a423054f3b5524da80fc3c2e3bb\0e06fb89-a2cd-4f98-92a0-183f4fa6208c\index-dir\the-real-index
Size 5KB
SHA256 f6d9dbadc644baffa06794e5543c3153fd3b64a22c1762103424276a0c58eb15
MD5 a7eef549201f73632d84a56b92562d73
SHA1 cf6c50f93c85fac124cbcfe80596e2418949762d
SHA512 9a540b2378933bdbb79c17cf9f534e752e80672363744759ed7cf205214ef85fd9c52ad4e31156737fa06568f19ba8d61d14de245db42593df3503f38f10fc04
SSDEEP 96:9WQwd69qnIPzQKTbNa2R4vWyu4LsUuf+kYk7DY:Kd69a8Qib0vblnIYmY
TLSH
T110B1090428569B67CFB41A39146F165433F6EC46C789FF57BA2875FD8E0B3A0881B788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ffd2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\397e5d81bdb71a423054f3b5524da80fc3c2e3bb\0e06fb89-a2cd-4f98-92a0-183f4fa6208c\index-dir\the-real-index~RFe59ffd2.TMP
Size 48B
SHA256 1dca097414807997e25137ab1024f9f2c0ae382ef5cef2e7632ec489194750f5
MD5 6b783b88e78221cf078f839e73e14fd4
SHA1 3eaf52f249fb9fe0ddd03b8f026c25f60b8181bb
SHA512 3e5003a2c23120405a12776dec3d8f3594b66d6e2f109b7326d683bd97034dd1af3376a90a4905ddc7530016340f4595a47f65deeeae05b4a58699bafd19cebc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\397e5d81bdb71a423054f3b5524da80fc3c2e3bb\index.txt
Size 247B
SHA256 3cac440773d2982c3b8fafb8423dd8bee05f3b43b54b3f8fd2d9770b4e0823ba
MD5 4b04edc4448132529a07bc0dabcf0160
SHA1 70c7820ca8fc19af43ea7403a9a71dbab58a12f6
SHA512 12feb5c2761131d59e02b027e603a6ae03915a4be4a32d27709e76f8dd145fd3e33e7cd0dc3da0b772ade188fb8444ae296d2597506f49345595e550c5a16fcb
TLSH
T17DD0A5F75661C530EF4545C939BC793DD43F39449594F98D4331109500D5411B861F07
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0011.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\397e5d81bdb71a423054f3b5524da80fc3c2e3bb\index.txt~RFe5a0011.TMP
Size 251B
SHA256 6c6d3409191b118e0cc738141954fa1a43199785cb12d99e7e6abc71ecf4300c
MD5 ca3cb7284442f7fbeae80a0c629c4ed2
SHA1 726ee7a3a6fbb7c699b74677df9accb7d5d5f0ae
SHA512 c68dd2530705f79935b5211c2d124f36ad5d3e54bb0fbd34334cdde4670370f0a95aced504acf10261cd7bfda941a730a0a67c752a87b4ccb762af015cc9d0b4
TLSH
T13AD0A5E75671C130DF4501DD79BC793DD43F3D449994F9894332309500F5412D861E06
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c1301da31a6ddd0e90a81f72259d2e7e488a251184549e2533a3faedeaa2a018
MD5 89962d162831626353309fa19808d36a
SHA1 7f9de9038cd676921591009b905c450796815109
SHA512 fb1b30c107bf984ec4756132abac84971815c64de6f12ceb42fb8fc71d5bf4375deba8829eaae39a3c969031ca12c85ec0b78b6ca0d377f4e3d7642a94f4ad77
TLSH
T1DAA00226254E14A3CD44267811D53D4833B048514B41620296B1B0BFDDD17405142515
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ca7a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ca7a.TMP
Size 48B
SHA256 1de4d18b8ad745c316adf267a0ae8a6998ee1e6844566c2a5f08caec2f2d5142
MD5 6e102e5a2120600935d9f11c84a7ed91
SHA1 f38c778f329b51bd29bce3481e8c1bee4bde9f4f
SHA512 f5d18969ec6e19b88d89e3b7915deb5ec61b5a8cbcc878140b7ec2950dbc5f9ee566421dac4acc0559a4a467cac25b2b50564f62a20b806a7faf01ca84360f4f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7fef2c625bd0320d0e1220a40f2c621f576c47a62f153890cb759eafcfe29325
MD5 97002151ad52374a789ea82d7c8977cd
SHA1 7fdc8424639f4e636a38497d97547f534ee05af3
SHA512 d0a60ab05bf10ca53cc0e925574b5d4f923e092dbd992712f369b9f46048d3bdc54687e1864edb611641903e5d6a62a5d547bb7a1c4d92a9a44b601f152df70a
SSDEEP 96:KROjyuIQAWWQVdguWK4zgsWcGONcOHHwBUAyeSIWWLbgIIK4Ng6Icoob6DiAK3Ks:COjyuIQAhQVuu+zgsFGONcOHHwBUAye4
TLSH
T193913942317E12803D3EA60C92F8985EC6857C62706BA96B7F6D51B50F6BE064CFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a07d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a07d1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7fd81a14cea33cf38569df94a5701382489040499ea635e07aa5beb8c1916e67
MD5 12081c88c294b1727ee76ba7746a8760
SHA1 4f5868166e9bcb5ad97531c6131a1974ea1ceaf5
SHA512 bdb0f81bfb4cc2db6aca8d29cec273b77ef947e1554a23062c7a1a18c0544490df42f3cb340d74c8d19f5b4ec71e2cd4d886ba04132a5292e8388365176462b0
SSDEEP 768:g23fQtiJhSKIJkW5NHXmTWTbc+Hw2ewBKZOU4:g23OHJkWPeWn1Q2evZM
TLSH
T1C4F2BFB19CB9AE739DE69F89A54B6B076EE84163D4D82998CADDBF0E004314C0347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 37d6ee23f2f627212bbfc494a9ce4953fb26db267c2980279794dacd9758ace7
MD5 a80bbd4a289406a9c27ab73334d17c7e
SHA1 aa75dc81c5557cb62455b760f6a421d73dab8b4e
SHA512 bf257ce0ca71488bedbae147f2f70c11c4c663f885c2ed9e3f973ec5c6bd4501d72817f7a05ec4a2634efc958de3b37ebf79d2c262f8c00d1d23a8f16f82d6a2
SSDEEP 768:erv+4UNbd53tAtiJhSKIJkWsNHXmTWTbc+HweVH1SvBy:ebsb33AHJkWkeWn1QEH1+y
TLSH
T13913BF729CB99A37ADF69F84A04B7A077FB8115780C41694C9D96F4E028719D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 5c796764ac0c9e2db38a40109ec07796d86ef70d0e8b49f11c32f28553cd9e7f
MD5 03804ca62dbcb63f519a824be8fa3586
SHA1 cca243df3d10eb98c454756e651a334f3b3f9d62
SHA512 bbd19fc33c7e9162c7b0b73b45a7e14b49b19ef2c468a44275bf42b5f5b3aa76be63d2d5fc83192439509d51d15b60310aa8bfa38da48673c86869ab725f82ee
SSDEEP 768:kFQz3bwgb8IchSKIJkWZNHXmTWTbc+Hw2ewBKZOU4:Hz37JkWveWn1Q2evZM
TLSH
T15A1339F188D79637D9AE4B87673D6E069DBCC153B4981494BBD86E0DCC821BFC306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 920239ca7fab613fb805d954f3f43e93d5355e9bad71fd76b9535fc5ae018f50
MD5 717024ffbc796553961256783259c60c
SHA1 abc7bfcd46cf5cf8e5e426d8a1c71cb74f9f8e4b
SHA512 8713e60bee14dca8fd1bdccd1eaf74a6d9439278ef74de10dbeb8d1308dce2d8ea55fe75319998317f901c86cc4b326beabd2e338b91b1365f8c51e244179fad
SSDEEP 768:1rv+4UNbdM3vx/iJhSKIJkWVNHXmTWTbc+eweVH1SvyZ:1bsb+3BHJkWjeWn1jEH1dZ
TLSH
T1C203BF7298B99A33AEE69B84B04BBA077FB8116781C40A94C9D96F4E018758D030BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2304da51-a31e-432b-8f89-86727f9cb4cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2304da51-a31e-432b-8f89-86727f9cb4cb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

f70263ff-f075-4242-9dd4-c816ecb5fce5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f70263ff-f075-4242-9dd4-c816ecb5fce5.tmp
Size 38KB
SHA256 358dc6824f2765be3391584ecbf4a59d89bf24ffa320dea06f3f0407ce179daa
MD5 4329166dc97a3a73dba396673f9bab6e
SHA1 deeb94eeeabcfb5dfa18f003609817c8eead89ef
SHA512 3ff927d22c2db47a88856728dae725ed6614f96dfbb794ca189e581d0f65bbf3e4786e23280a26bf469e1b46cf1fd23fb1b8085cb8574fb0c4c541a884f1257c
SSDEEP 768:arv+4UNbdM3WExiJhSKIJqNHXmTWTbc+/leVH1SvyZ:absb+3hHJWeWn19EH1dZ
TLSH
T13503C0729CA99E37ADF69788758BB6473EB81163C5C40AC4C9D96B4E018758D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0cd29ae-72a2-40d5-b3ab-51a67e8976bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\b0cd29ae-72a2-40d5-b3ab-51a67e8976bd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4960_1374831534\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads