hxxps://xcityweb[.]com

Analysis

user interaction
yes
max time kernel
329s
max time network
331s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xcityweb.com
Sample260810-23lbss1bre

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5028	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308767998855785"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{90B569A4-9859-46F5-ACD7-32D95D3331D8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	vеlосitуstrарреrХ128-v.4.384.exe
5028	vеlосitуstrарреrХ128-v.4.384.exe
5028	vеlосitуstrарреrХ128-v.4.384.exe
5028	vеlосitуstrарреrХ128-v.4.384.exe
5028	vеlосitуstrарреrХ128-v.4.384.exe
5028	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe
6048	vеlосitуstrарреrХ128-v.4.384.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 5020	1240	msedge.exe	86
PID 1240 wrote to memory of 3740	1240	msedge.exe	88
PID 1240 wrote to memory of 1860	1240	msedge.exe	89
PID 1240 wrote to memory of 1096	1240	msedge.exe	90
PID 1240 wrote to memory of 1860	1240	msedge.exe	89
PID 1240 wrote to memory of 1860	1240	msedge.exe	89
PID 1240 wrote to memory of 1096	1240	msedge.exe	90
PID 1240 wrote to memory of 2056	1240	msedge.exe	91
PID 1240 wrote to memory of 2056	1240	msedge.exe	91
PID 1240 wrote to memory of 2056	1240	msedge.exe	91
PID 1240 wrote to memory of 2656	1240	msedge.exe	92
PID 1240 wrote to memory of 2656	1240	msedge.exe	92
PID 1240 wrote to memory of 2656	1240	msedge.exe	92
PID 1240 wrote to memory of 4068	1240	msedge.exe	93
PID 1240 wrote to memory of 4068	1240	msedge.exe	93
PID 1240 wrote to memory of 4068	1240	msedge.exe	93
PID 1240 wrote to memory of 1196	1240	msedge.exe	94
PID 1240 wrote to memory of 1196	1240	msedge.exe	94
PID 1240 wrote to memory of 1196	1240	msedge.exe	94
PID 1240 wrote to memory of 4892	1240	msedge.exe	98
PID 1240 wrote to memory of 4892	1240	msedge.exe	98
PID 1240 wrote to memory of 4892	1240	msedge.exe	98
PID 1240 wrote to memory of 892	1240	msedge.exe	99
PID 1240 wrote to memory of 892	1240	msedge.exe	99
PID 1240 wrote to memory of 1628	1240	msedge.exe	100
PID 1240 wrote to memory of 1628	1240	msedge.exe	100
PID 1240 wrote to memory of 376	1240	msedge.exe	103
PID 1240 wrote to memory of 376	1240	msedge.exe	103
PID 1240 wrote to memory of 376	1240	msedge.exe	103
PID 1240 wrote to memory of 1144	1240	msedge.exe	105
PID 1240 wrote to memory of 3936	1240	msedge.exe	113
PID 1240 wrote to memory of 3936	1240	msedge.exe	113
PID 1240 wrote to memory of 3936	1240	msedge.exe	113
PID 1240 wrote to memory of 1508	1240	msedge.exe	114
PID 1240 wrote to memory of 1508	1240	msedge.exe	114
PID 1240 wrote to memory of 1508	1240	msedge.exe	114
PID 1240 wrote to memory of 5556	1240	msedge.exe	117
PID 1240 wrote to memory of 5564	1240	msedge.exe	118
PID 1240 wrote to memory of 5556	1240	msedge.exe	117
PID 1240 wrote to memory of 5564	1240	msedge.exe	118
PID 1240 wrote to memory of 5564	1240	msedge.exe	118
PID 1240 wrote to memory of 5648	1240	msedge.exe	119
PID 1240 wrote to memory of 6040	1240	msedge.exe	122
PID 1240 wrote to memory of 6048	1240	msedge.exe	123
PID 1240 wrote to memory of 6056	1240	msedge.exe	124
PID 1240 wrote to memory of 4916	1240	msedge.exe	127
PID 1240 wrote to memory of 4916	1240	msedge.exe	127
PID 1240 wrote to memory of 5028	1240	msedge.exe	131
PID 1240 wrote to memory of 3900	1240	msedge.exe	141
PID 1240 wrote to memory of 1356	1240	msedge.exe	140
PID 1240 wrote to memory of 3900	1240	msedge.exe	141
PID 1240 wrote to memory of 1356	1240	msedge.exe	140
PID 1240 wrote to memory of 5996	1240	msedge.exe	142
PID 1240 wrote to memory of 5996	1240	msedge.exe	142
PID 1240 wrote to memory of 4440	1240	msedge.exe	150
PID 1240 wrote to memory of 4440	1240	msedge.exe	150
PID 1240 wrote to memory of 5372	1240	msedge.exe	151
PID 1240 wrote to memory of 5372	1240	msedge.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xcityweb.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffad1c8c188,0x7ffad1c8c194,0x7ffad1c8c1a0
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,4501591740061507430,9335143294709815415,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,13046117572770822011,10020619878688205867,262144 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,4751935022741889045,8188100697081998839,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11450022922759673837,16315828382825366932,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,18218835274625579990,12429708150874300648,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,4015064530730044663,8632886325076123860,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,5437644392740995734,10669509783203158472,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5060,i,88111458043426971,17337250088655590158,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,705684492052681297,17561833646429670622,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,8744755012034624792,4691289499426211957,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3608,i,18032252664698655636,14300825225831839800,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4572212979556660079,8678774743679650190,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4572212979556660079,8678774743679650190,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6736,i,9429991722707189693,8703853060118878505,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6876,i,10328624013030454703,1822596179348968832,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,18171885902870794005,11826563479964800079,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3680,i,10641282775306491373,11790770378115699222,2097152 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,9287748115829030705,17599187618609897034,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,3543971848002364536,15107455719230523460,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,11403935206061270735,18444175068008579597,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,4104734051844817349,6630221005680251891,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,12456956657978384289,4655900084269238236,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6308,i,3329831153838412538,16747972020516858821,262144 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,835891386941143294,15032086108481338581,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,4582330381764463197,9287289804337495834,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,16555849117549425793,15034851129348571631,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17024672207897502318,8699068238258354114,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,2124467568542991820,15669655494216670820,524288 --field-trial-handle=2888,i,16583790185401198116,8134060696148925061,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5924

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_vеlосitуstrарреrХ128-v.4.384.zip\README.txt
1⤵
PID:2700

C:\Users\Admin\Downloads\vеlосitуstrарреrХ128-v.4.384\vlсtstrррrХ128\vlсtstrррrХ128\vеlосitуstrарреrХ128-v.4.384.exe
"C:\Users\Admin\Downloads\vеlосitуstrарреrХ128-v.4.384\vlсtstrррrХ128\vlсtstrррrХ128\vеlосitуstrарреrХ128-v.4.384.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5028

C:\Users\Admin\Downloads\vеlосitуstrарреrХ128-v.4.384\vlсtstrррrХ128\vlсtstrррrХ128\vеlосitуstrарреrХ128-v.4.384.exe
"C:\Users\Admin\Downloads\vеlосitуstrарреrХ128-v.4.384\vlсtstrррrХ128\vlсtstrррrХ128\vеlосitуstrарреrХ128-v.4.384.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 17a0e0c60deaa0fe493f481d0f05b5097935d7583af4de2a33bfcff57c6e03df
MD5 0227f79cc92dd3e773a9365fd5844c73
SHA1 26c6a223acdd1cc0a77a58a9aed780a94aba1753
SHA512 b111928af459b91815524f747af02d6ebd01963bf41ac7d0b3979146a1151c62e952ed2bbbf04e270d4eaddcc27e407d4be16214a26dfa039b1bb5bb663af6cd
TLSH
T164E026E805C8CA3FEA45648BD168478D82C8374BD2C8BB0E6744C8C87147498FBCFE95
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e3bf22360a13236c6f1e66cd38174cccc3418caf8c22c6ec23e86f9c64118d30
MD5 fda4add1351d2610959a8c3738df2f63
SHA1 3539cceea154929238d440627c9f6615558d853c
SHA512 ba02dc3fb2d73b4de95226e09d8a4dc46898eef792c5318008a0d26ceadb48ef37ab591ab61b32777ac8e4f6842b4a38813d205538b720a910762c6e8eac41cc
TLSH
T19E810A388D5246A0DB9C2A3182DA11077036C6EFF5637E5ECD6D5EBC2611B2F3E26809
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d472.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d472.TMP
Size 3KB
SHA256 f9f7e9d44c66dfc007cebd21845590f63286c0b404dcc5fa6722f775c03162d1
MD5 c52982cf3a0eea6e5fa051d525985821
SHA1 d7314d56808a54b8eb051913bbeb1640893d0572
SHA512 46183fb14b22d403a1bbdcad6bcba2aa4588caffe4ae2695c510626978d487e21e5c1137817e16d414ce1888036faef9b0e8dd86b6eb3db06b874df9b3aaf488
TLSH
T1F071EA388E0646E0E79C2A3182DA01177036C3EBF6673E5ECD6D5DBC2110B2F7E25009
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 381b86cb38928aec57dff5e91975873706327f7c9d10c8e7eb91273df6817194
MD5 4c9735066d4d1b142d212e85a2b3cad3
SHA1 7bfd232ca74b94fc14ef87e96c6d05f80e3c84b8
SHA512 1025a84c60193ab79f9fa5f56437a3f9abdf24601603c46b19cb3528f5edc0baf8c2c68e50c0e4d4a277cd53847c1d801418449e69bbe012cafe311888e8a21d
SSDEEP 192:DWUTqio8E8/ebCpyZiKi4FAU3lMTrnnCJaT:DWUTqio8E8/ebCpyZiKi4FAU3lMTrnn1
TLSH
T176D1DDB6C3EAC66D981116F566246E2EDD2D0A1C42183C2BC9E9EF8FD3E2431E20155F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 682734ffed85600451509c603b521d91cc11f81466430144ffaa4f22d55eeb8d
MD5 46523f7a0522f271db2d5886146aadc1
SHA1 ef8272a63d81498de226b91b8499c9297c111361
SHA512 ea29a7583d879e944acd76b14f30f10d892c25fe0385712eae18197cf2c5b4fb43a58a2faf4c2ec7646e50e9bcf640e39cfdd15d56608bf684f81b7fc4ba34d2
SSDEEP 192:sxZLSbRykc9/f8KsJcKfIdp7JHW6+WNAmd/YCefricIgrJ:sxZLSbTc9/f8KsJcKQlHb//m19
TLSH
T14222C8526E38A9778CCBD21DBA15BF13D6F95032A5D41E58E6FC961C08E6ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db863030fa4cffd1482b4c7ac6acbbdf90bfb939711f9a776ad308f8c07bb812
MD5 78da9660552fe7fb83ebb8aee7afc5d8
SHA1 7d99d3bde360153bd191afceb0d7bfb0aa424665
SHA512 7291e0cce679c08c6b2e2fdee384af6e0a22ac4ca5adb87bdb268f64265e1cbc8834ed2a8155b55962a20e73e92c1f756f62afc1999d52de8cf02fe709010b3f
SSDEEP 192:sxZLSbRy9c9/f8KsJ5GfIdpUZMJHW6+WNPPdmd/YCMtZricIg5LJ:sxZLSb2c9/f8KsJ5GQUCHbO/W1v
TLSH
T17932E8126A38A9778CCBE21EBA15BF13E6F9503295D01E58A7FC861C04E7BCD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 078b6d6435342c3f6d77f0daef8e2edcb0f8928b77986192cdcbeb95a70aaf4c
MD5 4c931b3359f35e239b21e0dce44e343a
SHA1 9eb7eda41351038de11ba50ba7df686e46db20b3
SHA512 b06ef65e8cfaf64f7344f678f1af6c33b3335e5f3b6283055c9de5ee03b690d154b698515e1248c75968d661ec3dfe0ba40a689a3cb9fbf3d450327862201f40
SSDEEP 384:sxZLSb2c9/f8KsJL66s8qMpRiYnazAW8pZS15posJWeT+sGQmCHbO/GDv:sG2o/fIL4Mnc7WeT+scCHb0Gz
TLSH
T151C21705A924C8779EC3AD29643DBE33EAEC405262C5CEEE16ECCA1C019D1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 22ad1d1d6581566899f877d74b4bf3d943b038c9041a871cb3f62cf72d5ee35d
MD5 7e19c729e74ad9d13da71975734d4e05
SHA1 409d903dd7850901c4717643767111b5bded7e73
SHA512 bab59405b065195a870b0b3a4cf43fc4cbcd1c84b49174e9b6db4e440bcb6efed7f58cedf2769d2b2a2606cce4d8e0701434be033436b749797fd6c4f028a272
SSDEEP 192:sxZLSbRy9c9/f8KsJcGfIdpUZMJHW6+WNPPdmd/YCefricIg5RJ:sxZLSb2c9/f8KsJcGQUCHbO/m1Z
TLSH
T15032C6126A38A9778CCBD21ABA15BF13E6F9503295D41E58A6FC961C08E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b6be69335ebb0a67702216ca5396f977e2825004302da1ee63e9840c4df6e48c
MD5 24d112fd707e95cd7d81f873ca21bf8d
SHA1 239969773644f44d94164ae53533a4e11b7038f2
SHA512 29b6ef172fa7c8081fe88224760707d18ee035c1ea9e1eb4b772c07e2f0a30f8daecc30e15eb5b5691a117d8d4b0e98ae7af6f4fe094524f24a147b421aa40a8
SSDEEP 768:OGqbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrlro3:OGqbUj+WvSCU6u1jaaZLbWre3
TLSH
T1DCC2E93B340CCA7E4FC01E9DDD5A6F972EA802C7A7588D4447F9994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 816B
SHA256 fc0f84adf6133eb6d8a376df1be8a27004dddc9c8d14ef41761eb691b621df8c
MD5 b6518aa7b726d931888ec0957c1b4a9f
SHA1 7a30fd223455187effebd4736221df0571a1f569
SHA512 915a7fcfee09f49da460958324c43de924987de4a4d6d5bbf590644672e12b0dbebe2bd10e4cbfb7952211829858f99e2ddc5a33c5b224a2c8e2c11e98cba7a0
TLSH
T1010102854EE68C2FED950AB310B564F473B0C9DC6715E213543D22271C3A34954161C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf351.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5cf351.TMP
Size 816B
SHA256 9595d6e39f6df18ae5194ba383e725d39c05a2aa64655b114c21a001149d2f07
MD5 7287f950964dca218fcc7f62b4263aef
SHA1 2b984d04f6fc243eb132d6145cbb377a2780ac01
SHA512 437384fbc2487c61eeb7335b95fcacd78a063aca93e813250c6257c6c25b75fc2409c152bec4806d8f87bf53f91a7ccf2b57f063d5f578a7504e239d2d9dc1fe
TLSH
T19A01E1578B964D1FD85415B6489560F47371C9006326F793507A653E1C7A78959070C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e249c85930fa45358dc9b93d856885ad27358fd4d892bc9bc12a4e34c21967e5
MD5 b09f85588814649f691233c60fd7c171
SHA1 be1ad520d9b92164a924658aaa27625a2f55bc39
SHA512 6b1d81ed82e58a0cfa7742947fc1bc947f5986096ef5315eadec5d506d539fd01c650f20f13c63928f2037405da0eb294123d4958d726392a70172c465df6885
TLSH
T136E0D8BA29E72860BCBBA3F5247148E002997998CD86BC9E1069A1D750B33612856C61
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b04508e4f217d1396f6a9c538b6031601bbb515d272946320293bf3fdc9066aa
MD5 5c5e694d052e646ce78b7deb2cf93595
SHA1 3dc5c5931d20074a52072709ee2f383f5e38397d
SHA512 759ebe2f4d9aac9e57d74ce656cd229d09a631e856c7834cbb8a5e8f3f4f690eb2f510b35019f4b886446ab8d19e2a3c3584923b002fb1bb79f6be89d2f4eb13
SSDEEP 384:eVZcIG2sNaDrQhUtjlEa+XOkj40BeRs9JKgqijUrUQ3:S/lmauOu40TjKgqmUL
TLSH
T1F0C238F154E75932D9AEA747A77D2E038EBCC027F5842A94B3D85A0CCC8657FD30A426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 656d1bc14ee0ccf7df81091665337298163ce3611aea3a60bcf38791fe222ec2
MD5 ffbb11319a5d0a733a876548ef3aea35
SHA1 6ad5264b0e0507b73e8497a5646000b433cb27ec
SHA512 adbf5a424717b8c2fe0502f2db03ad3ad8e0f84c175a3c37cf5e6580f9c158148fea46b44b22fe26f1dc78d14e3d9b6078c3dbf1d529f1855fc1824d7397ae66
SSDEEP 384:NZcIhsNakrQhG4jlEa+XOkjn0BeRs9JKgqijUrUQ3:Vh7mauOun0TjKgqmUL
TLSH
T11E929E3168345D776DFAB986F48636178FF88067DAC42FA4E1DCAF1C01C699C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2d0991d9877dc064da7309066717a59a233791f3d447f695cff673aabfdf13c2
MD5 c2bacd37fc8ece81527f2d138e163567
SHA1 ee4b150247d546b8984f5d0709e304ef56b7c805
SHA512 d875a00aca00165deb02065e33540608cf804b34010c7d3ef3089fbb7f4814b2fe4638a36da6f8044029af48226c4bbf06188e0b325f3ad8d24e2507ba2377d6
SSDEEP 384:hZcIAsNaDrQhU4jlEa+XOkjn0BeRs9JKgqijUrUQ3:pAwmauOun0TjKgqmUL
TLSH
T11F928D3168389D7759EAB986F44636178FF88067DAC46FA4D1DCAF1D01C698C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 afb870a131741b6a84caf8446f84ceb107cad174e18ac75ae7c433749e42c0e7
MD5 21c00cd982b71dd0155d63e35b1bd25b
SHA1 c0c8edd2a65db5c029a2a0de370f6bd80cde18b4
SHA512 474987d843e9d387f853aac81db3bc75c50952a45a37e3013e9b413fd7ddacfc0d710b378b0c82889dbb5b4fd3daf21fca3e846eadfd24059682bdef17be0192
SSDEEP 192:dON76Db2QmiUyBoNdBa+jLOmLtmVy1Nzhrq00U6:dON76qBXBa+XOkjr0U6
TLSH
T185124B367978AC775DE26984F48736179EF8412BDA8A7F90D5CC2F1C00DB65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6f083f8-6c64-4f50-8644-e3524d7f55ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6f083f8-6c64-4f50-8644-e3524d7f55ae.tmp
Size 8KB
SHA256 eedddeda6a13357c78df3d290f6bcfa180481683066a1e6138edd73485e44342
MD5 d208ff237e27fe65e8a416d7db69a169
SHA1 ccce5237a084f0b88333766bc8eb7f1ea17be66e
SHA512 11d28c3ea42777d8afdb9125c99b475d84c1bf3634d95c0484b0847569933845fd17c4003b35cca7cd0415a11caf652ea9cfd1f4e9be805d94e33f0f6a863ecb
SSDEEP 192:vONi6Db6QmiUySoHBa+jLOmLtmVERg/cU6:vONi6ucHBa+XOkUUU6
TLSH
T18902F93569386CB79EB2AE49F88737279FA8207BD9562F84D6D81F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

510def00-590b-4526-8de9-9177563495a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\510def00-590b-4526-8de9-9177563495a3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a2dd8b834fb119cf9f4aac8e8726d07c4380d6fdfebc37a36705bba80be0518
MD5 22c26ff34f7022c0d1904a08195e3073
SHA1 0aadbdc415ee051aa9b8a08f2a772675b53a78d5
SHA512 4aa21906e92d6b94feb40b7e8da7e1f34e8e88bacb2c233be17f29d1a6a9e6dc3e4e9f57ae1cc644f22f1f644355a7bc133e44f23f2b88e26c8e8ba3598e89ca
TLSH
T15641D558AAE91054B3B77F069BF6A8AD487E79672E17D4AE00110D4E0A67A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

vеlосitуstrарреrХ128-v.4.384.zip.crdownload

Path C:\Users\Admin\Downloads\vеlосitуstrарреrХ128-v.4.384.zip.crdownload
Size 3.7MB
SHA256 84d3ba833ff3e6d0c1755a91134a688cb614c34f5875506148dbbaf427f06b24
MD5 506b08e0615e787e3af62ad7b395402d
SHA1 15a79aa1c9d3c0a14f79d7a28e3c8aeea2ca377a
SHA512 e8808959d4b6b88f6578bf7a4c05590452ac27c810e8b4a3a1f4b00d20631a41c09c1ba0ce1c8747da9cff8c4d902d182e50d961c10c4a12eadd03b5daaa66ef
SSDEEP 98304:clsHG9x4wCVgSqBia6dX3ZsTh9ky/5Y8NEFvbpBnYDs:CTD8a1f/5fNEFvrnYDs
TLSH
T1650633B152550E33682E34589FF14410F17F1F78AA399D45C8EA1EC834FA609EADEFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5028-367-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/5028-369-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/5028-368-0x00007FFABA770000-0x00007FFABAD4E000-memory.dmp

Download

memory/5028-366-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/6048-374-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/6048-375-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/6048-373-0x00007FFABB1B0000-0x00007FFABB78E000-memory.dmp

Download

memory/6048-372-0x0000000190000000-0x00000001901DC000-memory.dmp

Download