a9ba6d60123bf415efe8869102ae3365766eb8f8903061e67a7faeb6e3031c30

Analysis

user interaction
yes
max time kernel
47s
max time network
48s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paradoxfree.exe
Size 1.3MB
Sample260811-2prxeszyew
SHA256 a9ba6d60123bf415efe8869102ae3365766eb8f8903061e67a7faeb6e3031c30
MD5 6107241973fabb660b58386ed8addb6b
SHA1 a48651e9cbdcab2ee5386bbc20e0b77c8a7e6526
SHA512 03a9f47c005542b864c14eb3383c779ebdeb0dcd7a4c4f4d32ab624f12b8bcbad38dff878f7102d0b1d5a13ab50e2c4402dc7dc61eb9c97b71bbef8abb20c3c9
SSDEEP 24576:MphztR7vNOrEhWuemAo8UiCCnMxmKRlYMniMnFryc:KzPN2EhWNmAo8RC+gLRlYMnL
TLSH
T132559DD0BAE427B8C17F803A9696D647E5F7B840033099FF1398A5493B662D30BBB715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com
28	discord.com
32	discord.com
91	discord.com
95	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2628	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309619683765785"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{7D80C34D-6C48-49B8-8A84-73F268C32908}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{A51F2C2C-41A6-46F9-A45D-2E933A6F5915}	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4756	4576	Paradoxfree.exe	81
PID 4576 wrote to memory of 1152	4576	Paradoxfree.exe	82
PID 4756 wrote to memory of 1164	4756	msedge.exe	83
PID 4756 wrote to memory of 2628	4756	msedge.exe	84
PID 4756 wrote to memory of 4516	4756	msedge.exe	85
PID 4756 wrote to memory of 4516	4756	msedge.exe	85
PID 4756 wrote to memory of 4516	4756	msedge.exe	85
PID 4756 wrote to memory of 1468	4756	msedge.exe	86
PID 4756 wrote to memory of 1468	4756	msedge.exe	86
PID 4756 wrote to memory of 2336	4756	msedge.exe	88
PID 4756 wrote to memory of 2808	4756	msedge.exe	89
PID 4756 wrote to memory of 2336	4756	msedge.exe	88
PID 4756 wrote to memory of 2336	4756	msedge.exe	88
PID 4756 wrote to memory of 2808	4756	msedge.exe	89
PID 4756 wrote to memory of 2808	4756	msedge.exe	89
PID 4756 wrote to memory of 4568	4756	msedge.exe	90
PID 4756 wrote to memory of 4568	4756	msedge.exe	90
PID 4756 wrote to memory of 4568	4756	msedge.exe	90
PID 4756 wrote to memory of 3284	4756	msedge.exe	91
PID 4756 wrote to memory of 1244	4756	msedge.exe	92
PID 4756 wrote to memory of 4340	4756	msedge.exe	93
PID 4756 wrote to memory of 3284	4756	msedge.exe	91
PID 4756 wrote to memory of 3284	4756	msedge.exe	91
PID 4756 wrote to memory of 1244	4756	msedge.exe	92
PID 4756 wrote to memory of 1244	4756	msedge.exe	92
PID 4756 wrote to memory of 4340	4756	msedge.exe	93
PID 4756 wrote to memory of 4340	4756	msedge.exe	93
PID 4756 wrote to memory of 648	4756	msedge.exe	94
PID 4756 wrote to memory of 648	4756	msedge.exe	94
PID 4756 wrote to memory of 648	4756	msedge.exe	94
PID 4756 wrote to memory of 1316	4756	msedge.exe	96
PID 4756 wrote to memory of 1316	4756	msedge.exe	96
PID 4756 wrote to memory of 5084	4756	msedge.exe	97
PID 4756 wrote to memory of 5084	4756	msedge.exe	97
PID 4756 wrote to memory of 976	4756	msedge.exe	98
PID 4756 wrote to memory of 976	4756	msedge.exe	98
PID 4756 wrote to memory of 976	4756	msedge.exe	98
PID 4756 wrote to memory of 908	4756	msedge.exe	99
PID 4756 wrote to memory of 908	4756	msedge.exe	99
PID 4756 wrote to memory of 908	4756	msedge.exe	99
PID 4756 wrote to memory of 4440	4756	msedge.exe	101
PID 4756 wrote to memory of 4440	4756	msedge.exe	101
PID 4756 wrote to memory of 4440	4756	msedge.exe	101
PID 4756 wrote to memory of 4868	4756	msedge.exe	102
PID 4756 wrote to memory of 4868	4756	msedge.exe	102
PID 4756 wrote to memory of 1352	4756	msedge.exe	103
PID 4756 wrote to memory of 1352	4756	msedge.exe	103
PID 4756 wrote to memory of 3924	4756	msedge.exe	105
PID 4756 wrote to memory of 3204	4756	msedge.exe	106
PID 3204 wrote to memory of 3240	3204	msedge.exe	107
PID 4756 wrote to memory of 2040	4756	msedge.exe	108
PID 4756 wrote to memory of 2040	4756	msedge.exe	108
PID 4756 wrote to memory of 1336	4756	msedge.exe	109
PID 4756 wrote to memory of 1336	4756	msedge.exe	109
PID 4756 wrote to memory of 4816	4756	msedge.exe	110
PID 4756 wrote to memory of 4816	4756	msedge.exe	110
PID 4756 wrote to memory of 4488	4756	msedge.exe	111
PID 4756 wrote to memory of 4488	4756	msedge.exe	111
PID 4756 wrote to memory of 1704	4756	msedge.exe	112
PID 4756 wrote to memory of 1704	4756	msedge.exe	112
PID 4756 wrote to memory of 832	4756	msedge.exe	113
PID 4756 wrote to memory of 976	4756	msedge.exe	114
PID 4756 wrote to memory of 832	4756	msedge.exe	113
PID 4756 wrote to memory of 3056	4756	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\Paradoxfree.exe
"C:\Users\Admin\AppData\Local\Temp\Paradoxfree.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Qsrf86hzR9
  2⤵
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x36c,0x7ffff2a6c188,0x7ffff2a6c194,0x7ffff2a6c1a0
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,15622285555470448080,215848098605126684,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5491742359322070046,17028576199209842802,262144 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,5879320177687679278,8496707545818769911,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,10932038672396026563,8373977595546898317,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,12150477618860384127,1624297735736248400,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,15158864893986289626,8689493809426005851,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,5866638990985928891,6825073595779909640,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,8592737380842703880,7795644458215433220,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,11852570809860114248,13750670295377769194,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4612,i,4669941759595803647,14293178020646167690,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,273175066626924870,15680337812297871333,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,214697364243060196,10484950183771248482,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5800,i,17086160969307398474,1148149697146398165,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5928,i,3715341536858951919,1658490074027697481,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6184,i,15791513869335828643,7055895994849682430,2097152 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,4138761150791441147,13973971186847406860,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,11323264976249161805,15380727817325341208,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,5660923195206289518,1376181681092704063,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,5660923195206289518,1376181681092704063,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,7606577364037745756,16652029964464901975,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,7646694054606374322,10464021607776642542,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:14
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,7460008921060645663,18220439167430377687,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,11662552074975481343,6600202601424669603,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,11204381775496887940,6641056127191428363,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,9107285165772533390,179718843077620119,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,10948218105882430933,15633257939658682640,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:12
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,3841879984243801933,6341657126544070241,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    - Modifies registry class
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,6180316657572819078,2086209485585788531,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,17723913806820776479,13097034340394189388,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,16602353892681601730,8257628300377531165,524288 --field-trial-handle=2228,i,4049402367823515107,3606832583136764794,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:14
    3⤵
    PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/glockolex
  2⤵
  PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98ade942a8747b838525fab33e985cdad967132f18099e1927edd4ddcf705c
MD5 f204288b44f873d17a6ceedad1591584
SHA1 24474f57edf00bb3bed673ea9c6fbba1c2d5706d
SHA512 218a8f5b6756a36d75649cbf0e80cab71506f3cef44c8b62b5d9685a2a249d10ca13547cc8a461116e8dbf2c2b9cddc73426ef41d645a31b93a43585aab2d6c6
TLSH
T169D09B30F7995053D1411131DC915F506655499528AB86815331444CE959094E3D7146
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c83bb71881d68df311b7d08aa2e6a019e6b93bf5181e9a72264de6e1803570ba
MD5 17afb69c978b25e839ebd70bce43444c
SHA1 cfb584c11da974314166a2f32b32400e81b25a89
SHA512 a8fb4a3226b44db30e63ab214329cc6ffb39457c4defcd55c605e1475b5342be9de4588ba6b217e62c5488be7d4d4c963feee2dc1fd87c5154f6a37513655523
SSDEEP 192:zZBR0c+/fzscbWEdpod/W6+WNzSwjIg/eBnS0oY45IgyJ:zZBF+/fzscbps/bpz/elQO
TLSH
T1D822C7526E38A9374CCBD21DBA25BB13E2F95032A1D55E58FAFC961C04E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5e96ee7c2a9563d42e088930e4f8dc9eceaf13a18a77ce706551c863ef9b2d1e
MD5 fbffc12d3ce7ad552885627c3209af2e
SHA1 ef1e7c8c313f7222d6542877ff3b199054d8a20a
SHA512 c429ec477631d2a7f783e9c80a20c20576733d0f1b2261049866ae8e232b5d3e8c820ff57c5a798e6f6f940b99b528339d095d73d84e1fe727dc7c3ef1de0896
SSDEEP 192:sxZBR0c+/fzs1bEIdpod/W6+WNzSwjIg/eBnS0oSxn5Ig5bJ:sxZBF+/fzs1bds/bpz/el7X
TLSH
T19E32C5026E38AD375CCBD21DBA25BB53E2F95032A1D14E58EAFC961C05E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d8a015894c79dc32190983ad3fc4e57fadd54f8d72ea7c849d82c0cb34ae79c6
MD5 66e2f0b5ceb2701ba15d71503f17afbc
SHA1 232ea3bf42c2738ffb8bdbf071a17fe3f1d16245
SHA512 4a3fa4cd9dcf5e73ffbc40123cf8e761f29d951b82d335e88db85a11144593b6a976c072b916d8936366adfdfc50cc6683e02a1386517efc6319e28e528d2015
SSDEEP 192:sxZBR0c+/fzs1lXF+DXIdpod/W6+WNzSwjIg/eBkOS0oN/n5Ig5FJ:sxZBF+/fzs1lVfs/bpz/eioE9
TLSH
T18342C6026E28AD375CCBD21DBA25BB53E6F95033A1915E54ABFCDA1C01E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 760d389618033f013653f96465d8553398292864ffcbabfe0f2ce6cbecf8f13f
MD5 6f04dc3cf793131d12690cba60540eca
SHA1 fc5554858c4309bfcefae711379d11ee918eecd4
SHA512 fa32edf461593bc2a2b359bba0f4c280c945563ee706ed4f10bb4d1254eb2b31db6ed3a06cab8c5dda0518cfa04378e84561115566dcffa41b9bba1c89f302cf
SSDEEP 768:SXcis83w2QfWRm/JQ118F1+UoAYDCx9Tuqh0VfUC9xbog/OV3qOLl/TB0O6LroMV:SXcis83w2QfWRm/JQ11u1jaKqOLpTuO4
TLSH
T184D2F83B644CCA7E5F800A9DED566F973E9802C7A6688D4047FE894C02C77EE521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 25952c7202946490287e6e9fa5a74a6a549dbaf482a207dc2b69cd18d7b81913
MD5 2bee4e7ce5d59f8bef2c9abdd4364045
SHA1 85a310e54dd44317d42d424fb8e199f5fbfd7d90
SHA512 de76cb4759a75edd27e0a6a77d5f02547f831c09b65301d44eaf9b8440c4f0a69a8e659070610cd28e58a89af8c2f66d07d0ec5c90ed63249f384a1e0ece7528
TLSH
T1E6D0971BF0220A52DB7B8EC40E21308ECE313C886494704EE403282CA570A8BEA00F83
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 099936fb26dbbe5b71f05d94300e0f794cd15b43114663b294fcaea3a06703e9
MD5 c3da2a8c75fd9f3f0e1ebe32cbeb3c86
SHA1 773fdbbffe654034d9c5417d84e69d93bbc27c0d
SHA512 ded8dc12f694fceff0a74bae85f044f5a7b58fc4575d6d31e82d1749cde4f1c0354093fab2e43edd6dc34ae31e3d541296f0a6f883b38b6baedeeb9f0346be10
TLSH
T1D0D0A71BF4590B52EBBBCFD40F11319ECA213C8964A9704EF442492C9A45A9BAD41F93
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5880f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5880f3.TMP
Size 138B
SHA256 f85d4ddfc5d9edf09d3022bdf19e2b6b5ca84f73c4af7b7b0037d1a015e54db9
MD5 9505c2280bb06eff51888f82e3474c5e
SHA1 9d16dd0fbe84d296ccf3ab504568c8677b4bdcc0
SHA512 8548116f7466ec2769134b3a9d334046022b0da126f1f9ea3bcc712c5309e3bbf018d1796b961f81d6e5c3b7912759d0e250c526da26fcd3979465ca0f633bbc
TLSH
T1E6C02B77B0010A11CB268AD40732F18DCB003CCC8C82A08EB00334683034E277101FD2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e4197807a721425e3a3c8c8c9edda774d84a841756848e90c7c2dc2c2d8210e
MD5 f57bf7988b411a3374c59db79f81f0d6
SHA1 f66d5212d138d50294acc46db90757909481bd4f
SHA512 bdb73b065bab36fac434cd0b00aa7e9bde945d31d6aa67084afc7377b3fdf1d49dba53d7989c6993ffa141a7871c062fb837d716993bfaaaaed13a7627804f6a
SSDEEP 48:KoBIlKSIwfy7Z49pvL/grTmzIixgKp1xngtBwUWH33I1KEcgXy4hg375rHbz:KoBmKSIa66oKXqI3mKEc6Kz
TLSH
T199917691B4B74B113C3E390895B59B174A4273A7B568E43B3FA904724EABE101CFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b7b78b51026a984e383de4022e90cdff8873549487354be0540bc405f98f26ce
MD5 23a94197b55ae7312033ce66dfda2477
SHA1 06da4668f5920c6d1bc5c725c86bd06a4bc2a412
SHA512 c1f1919cc69622abda98aaa9d0ccf13b2e01afa258a65c221c6e7a9eb35bc034b773186933d6d276357e3f8a6670477f5077dd3d82a08ee540aafb26a3439753
SSDEEP 192:XGNx6jCQmiUyCI8f4SufoPxzYfSus6OImsSnBfzoU6:XGNx6qxrfju8YKusBxoU6
TLSH
T13D02EB756C6C7C6BAEB36E45FA8737135FA4212BE9852F44CAE81F1C00D725C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7576c1959ebb59973e823e38a9df3097db560a4373d86a6e332d0400504e9fc5
MD5 a88bfea758ecfb814cbd8fa0f1698e85
SHA1 adffa0c12d6ac6b304649850d3fcff1287b243c7
SHA512 130a11328e421be0ca7d201bdc71f95250138626e2b2559205841958a4aa1b72484dc366ef2ead212369f14363fe376f0b64e2183f3725574b3b9b71c495a63e
SSDEEP 384:nhZcIZ8NflSGMELiO2Uu8YKuscuHQOOPrXLpe8C/IBs:pZNG8O/CK1cOQOi9Pzs
TLSH
T192927DB1587DBC277CA7A649FA9626139FF82477F9C02F08D5EC9B1C00D62982316C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 29fbaa059e8ab25943cf9f7ddf79b4786bc2effced5e02a03b57a23eda2dd155
MD5 bcb37ad4a2e024b035e57c42b0aaedf8
SHA1 ce0a1d071461d6ef481ebea1c991eb4721a52ec8
SHA512 0295c8e1c8fe675eda806bf67c5804f83034b74b46a824f1bda483525534138dca26e8daa5664d61ea41f5ca9f677adf46c417676841361f5dfee110e866e851
SSDEEP 384:ncZcIZ8NfMSGMELiO2Uu8YKuscuHQOOPrXLpe8C/IBs:KZcG8O/CK1cOQOi9Pzs
TLSH
T107928DB1587DAC277CABA649FA9626139FF82477F9C42F08D5EC9B1C00D62582307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b11230eaa36a69a671ce874758cc05c664a6d0a5a61407a2a4bace9d7de5a8d8
MD5 255d060eb4b983e057f2d23d17d39480
SHA1 cc3aedd585d947854b2dfc0c5df44e14bfb2d779
SHA512 5729ec1721eca72c7ba0c13b2210b60a977a8f81a746a75835790ce6e9eed3a361a8ab61581fd03dfce1b5086b04fa85397d426d7d8d03c5b073a297c8d185b1
SSDEEP 192:zif8Nf8Q1YQpAM+9fFQmiU1vwO8BJSufoPxzYfSus6OImZSunFhBegqa+6gK:zQ8Nf8SGMEL2O2Uu8YKuscuHQ4
TLSH
T120423A716C7DAC27ACA7614DF65A36538FB8207B9D846F08DAD85F1C00DB298330BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 79508129fcdb4399db199acbcf62b8ae78bd43a1864c1923f6b0f8a503feafd5
MD5 b7217a13339cee5601264e90cc878a61
SHA1 89057723580415f6b9abb5fe0e335ac44615a072
SHA512 1930f7b2fd6930c410c02815cb71c99820305645682ad2eb7d707e79f3524b6fbd884b598c47e041ed978730cb9923144a3f2496eee5d8833d072d749e42e430
SSDEEP 192:zwGNf1j9flQmiU1fw6ZJSufoPxzYfSus6OImZSuyOhBegqa+U9:zwGNf1BrmYUu8YKusculQU9
TLSH
T141220870686DFC27ADA76558FA8736539FA42037ED856F48D6E81F1C00DB298330AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b4d7f141e410f371844849714b2aa86d37d8d1180a767feb2469e4daa1b166cb
MD5 b4a087282640502351d2048f61dc695e
SHA1 a92db25ca7f35592b29bec8b1fb3b327b6ab489c
SHA512 ed23af0773406572223045faaa865112912d13b628bd7d63d394cee3dada06584bf91d5efe3e4d99357d8f6a5b4c51f48d95423e2dada91d7ffcde4dc44b055d
SSDEEP 192:jGNi6jZQmiUy18X4SufoPxzYfSus6OImZSuyOMBegqa+U6:jGNi6zjXju8YKuscuYQU6
TLSH
T16212F870686DFC27ADA76558F98732539FA5203BED856F48D6E81F1C00DB298330AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06ed4d78-9f8e-4ea2-8916-4c4d0985d90f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\06ed4d78-9f8e-4ea2-8916-4c4d0985d90f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6b1ddd28-87ca-4e3a-a4a5-dd1fab59db7a.tmp

Path C:\Users\Admin\AppData\Local\Temp\6b1ddd28-87ca-4e3a-a4a5-dd1fab59db7a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95e7d01d-565d-4426-86a6-1f4b6fd8030a.tmp

Path C:\Users\Admin\AppData\Local\Temp\95e7d01d-565d-4426-86a6-1f4b6fd8030a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f6497c5d-f43f-4587-8773-609e6f7aef17.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_1144571495\f6497c5d-f43f-4587-8773-609e6f7aef17.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_322356019\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads