7b0c6a009f135396dc2525e2d076a507a83cf929cb378a2d4358a096e5e7f554

Resubmissions

18/08/2026, 03:15

260818-drw26awtds

18/08/2026, 02:59

260818-dgslzsfa9210

18/08/2026, 02:57

260818-df242avcnd1

16/08/2026, 12:55

260816-p52eksyvdx3

Analysis

user interaction
yes
max time kernel
321s
max time network
326s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
sample.html
Size 294KB
Sample260816-p52eksyvdx
SHA256 7b0c6a009f135396dc2525e2d076a507a83cf929cb378a2d4358a096e5e7f554
MD5 1e138056b63e892e569747332f9fffd0
SHA1 88a562f3312dc80482bc7a70f32fe93f4df78eb7
SHA512 8de2fc298ec9f93b9d919a05e05adff4eaaa4c3f6a03267af709550489ff6306664bfb69008f8a8ac4cd4e50816fbaee94e091e9fc23549c8e9a16dc4a5037c6
SSDEEP 3072:XX+NCyzqMwL4bIdfr7enlkqLH5Tj1byU0AAIRWXFhy5YqFR:XX+NCyzq5L4Idf5qLH51WYAIuRqH
TLSH
T12B546C326300B43BA817DDA0A6BE6F4E3C25E12BCC1647F8A595E530DFD2EB2151A71D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4176	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings	ctfmon.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313585543147707"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4EDA59F8-5E90-46EF-AA1B-415D1807D2C8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4904	taskmgr.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	taskmgr.exe
Token: SeSystemProfilePrivilege	4904	taskmgr.exe
Token: SeCreateGlobalPrivilege	4904	taskmgr.exe
Token: SeTcbPrivilege	1912	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4904	taskmgr.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3944	4560	msedge.exe	88
PID 4560 wrote to memory of 1948	4560	msedge.exe	91
PID 4560 wrote to memory of 4176	4560	msedge.exe	92
PID 4560 wrote to memory of 1948	4560	msedge.exe	91
PID 4560 wrote to memory of 1948	4560	msedge.exe	91
PID 4560 wrote to memory of 3128	4560	msedge.exe	93
PID 4560 wrote to memory of 3128	4560	msedge.exe	93
PID 4560 wrote to memory of 5692	4560	msedge.exe	94
PID 4560 wrote to memory of 5692	4560	msedge.exe	94
PID 4560 wrote to memory of 5764	4560	msedge.exe	95
PID 4560 wrote to memory of 5692	4560	msedge.exe	94
PID 4560 wrote to memory of 5764	4560	msedge.exe	95
PID 4560 wrote to memory of 5764	4560	msedge.exe	95
PID 4560 wrote to memory of 3032	4560	msedge.exe	96
PID 4560 wrote to memory of 696	4560	msedge.exe	97
PID 4560 wrote to memory of 3032	4560	msedge.exe	96
PID 4560 wrote to memory of 3032	4560	msedge.exe	96
PID 4560 wrote to memory of 696	4560	msedge.exe	97
PID 4560 wrote to memory of 696	4560	msedge.exe	97
PID 4560 wrote to memory of 4076	4560	msedge.exe	99
PID 4560 wrote to memory of 4076	4560	msedge.exe	99
PID 4560 wrote to memory of 4868	4560	msedge.exe	100
PID 4560 wrote to memory of 4868	4560	msedge.exe	100
PID 4560 wrote to memory of 4248	4560	msedge.exe	102
PID 4560 wrote to memory of 4988	4560	msedge.exe	106
PID 4560 wrote to memory of 2588	4560	msedge.exe	107
PID 4560 wrote to memory of 4792	4560	msedge.exe	108
PID 4560 wrote to memory of 5832	4560	msedge.exe	109
PID 4560 wrote to memory of 5832	4560	msedge.exe	109
PID 4560 wrote to memory of 3512	4560	msedge.exe	111
PID 4560 wrote to memory of 3076	4560	msedge.exe	114
PID 4560 wrote to memory of 3076	4560	msedge.exe	114
PID 4560 wrote to memory of 5380	4560	msedge.exe	115
PID 4560 wrote to memory of 5380	4560	msedge.exe	115
PID 4560 wrote to memory of 2444	4560	msedge.exe	116
PID 4560 wrote to memory of 2444	4560	msedge.exe	116
PID 1912 wrote to memory of 4500	1912	svchost.exe	118
PID 1912 wrote to memory of 2468	1912	svchost.exe	119
PID 4560 wrote to memory of 2604	4560	msedge.exe	121
PID 4560 wrote to memory of 2604	4560	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2c8,0x7fff5e5bc188,0x7fff5e5bc194,0x7fff5e5bc1a0
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,16648764475231381479,14230323164207015327,262144 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13419047923541365310,17201045293509963846,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,17858681267517424494,6843853874718283106,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,5817397109665474166,312679493650955612,2097152 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,16947511171259359120,17183958879345542031,2097152 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,4572901656500692779,14077477068364104512,2097152 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8537959626861234272,13479610745314258831,2097152 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,3602465874817330373,249594994193220536,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,15174766863102862558,11087262627646516594,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12579532395614663468,9120148544567203747,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12579532395614663468,9120148544567203747,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,1950241764044265538,13709543436486582064,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6889271299333717992,14234960261810294475,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9980122061593265142,3389098092083776735,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,511218122589781270,2622797500428788095,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,1099486698166652025,3583520697407161998,262144 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,962961340679462851,7365244721231255309,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1033766375568428510,6774045161393913491,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,6710397783341201649,6478133745724138483,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,12044944814084907306,4100254151535736119,524288 --field-trial-handle=2524,i,8967812718235887798,13650218052978765178,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4308

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:00000000000001F4;00000000000001F8;
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000244;0000000000000224;
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a25d44f6e40920b417586645e3b892e744381c9fb8f924f434b44c1f12647050
MD5 fc358af96bbce189446ac423110beaac
SHA1 fee902da419b747ce7a523c16e14fa70f8b8aff0
SHA512 1180fdc1549c0268f2cf83edea62d6ecec780a2a3ab2539e1bd0eb1ac476703c97d7110dcaa0025db14d52a4cc5fea164231e76c59705f78f9c9c3a6ecd85061
TLSH
T1A2E0268805D8C3AEAB84A8C7616C534CC280370AA2CCB91E2B548C9AF042144A283A90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bd3c05281b430a9898f84ad01f4d0656c96255a2f8688ba142c9f2f2b677790a
MD5 499fd830b5b03fb08999c6bc925b2f20
SHA1 2aa2d9115e7dd6c5ab1d71bf6464ea5231a9f216
SHA512 1e8db4c59f4995985ab61e5ac3ba98a84bda527598299ac44b990ab3e7f03c8c37418c4c167ae1a3da40ba5721b73ace8de2b9d1c525a1773b9d435f5659415e
TLSH
T13D51B9E303171DC2C7E582B214E16CFA7A39C6FA41CF9E95788E94B4864331E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cea1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cea1.TMP
Size 2KB
SHA256 e57cc8209d5db820c46e40b5c22ad17693aee2fca5cda7ffba7d535c850ff8ad
MD5 3ab4ee6a9e6d58a9ebadb29b53e0fc85
SHA1 9d62efdd248cf25539680816fa2d19bb5432e53b
SHA512 1146ffa54bc9e26f0890ec8a1aff32e94ca32673b4e242b9e011bf52de6d2185349fd3737b8f893ae26f33fe6f23decb1cd550c964289d2da03633533c763795
TLSH
T1455197E303171DC2C7E582B258E1ACFA7A3AC6FA41CF9E95788E94B4964631E35D5024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 12025a1beec9bba1e199172e1bd94ae95bc645b07aa403b867214c78ac18bc59
MD5 c0b38ec097bed48d3daf661883203b9c
SHA1 dd9c7146eebd92ee93dfae8913fcb657a90a5f6b
SHA512 0eb490f71237aa0db9a62e663ca27aee2ea6dbc8e1f9e74a3772a18675904b4deb85435e31cdf324b3a4e0a95f2a5bbf1fc00be5b35abedca87a51984a5b3aa8
TLSH
T10C51B0F7C3E4867E990156F0AB146E2FCE2D0516432C3C56C9E4AE6B63F24B1D141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1c96df9011f4efe3c3ad2afa59352e3e0fb422798182875ec73a3fda7301f8c9
MD5 e9420858cc2799e841d492f13d5d20c8
SHA1 11427f93bfbd2f5625f558a27caf8fdf767ab86d
SHA512 ce2604ebfe64d365bf33bc2d9f1114cba981457c91a02a1e5537b809e96fd1a7b989d885499b744a9e2e24d3799bf3655abbce1940f696ea0399446880cd6d66
SSDEEP 192:sxR0RibC/fnsv5eZDde5lSezoD8p4k/g6+WNIYC87uO9GCIgDbJ:sxR0KC/fnsv5eZc5lZp/5IKVp
TLSH
T1E042C8166928AD7B9CC7E20DBB56BF53D2F9503261D01E48ABFC961C14EB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3684273f1d3ff706bbf955f70cc9b573cec11ace189b8de71adab108ff11162d
MD5 f1735d80f7457abcb8c44523fb383c09
SHA1 40d5e0fc29d8e45ab83725893364be4c16ce5c73
SHA512 df23a72d49201ba9aa4cc3216bf2ee939d62331720fc8fcc1aae6dc759c6d6646b8fc880a64d356fe6d83b8fde1fd9d49fda220f2bfe77a282c1307926356014
SSDEEP 192:sxRDRibC/fnsO5e8Dde5lSezoD8p4k/g6+WNIYCNxuO9GCIgIJ:sxRDKC/fnsO5e8c5lZp/5I/Vs
TLSH
T1F532C8156E28AD7B9CC7E21DFA55BF53D2F95032A1D01E48A7FC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b0d021e3b3ca124741421a93c4e9a94c4a90baf22101c2d42215d2f178ab998c
MD5 39273103dcdb49a8944e70784953dbd2
SHA1 783217517140229081df3989fd96851810dd2690
SHA512 af36d26aeb93ef471bfc61ac9060fe9096df72594c5d867e3d416c547e3a0f69916713c4abb75f2417a1742f9c8c26b630cd04e517836c181847a19609a755c2
SSDEEP 192:sxR0RibC/fnsv5e8Dde5lSezoD8p4k/g6+WNIYCNxuO9GCIgDVJ:sxR0KC/fnsv5e8c5lZp/5I/V7
TLSH
T1BB32C8166E28AD7B9CC7E21DFA55BF53D2F95032A1D01E48ABFC961C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a9fff53f059b3a4758cdfbfd3c0b99e53f4cc28a73df6ab864332eb44b130aa5
MD5 fcf98d473b54399c27baef45f6850e19
SHA1 d5cdee9e884f512c8d46ebde3812403e6de53db8
SHA512 be836dfca2d0bdb876c0ff7641a12c32ba0ec747fd8c83b1a04d4aa83e6e551f6557155ddc611bda1a233616a3aef4f86d9cafd50c4b7d445d5d8c6810a7058d
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvnroZSa:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VR
TLSH
T159B2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6e0414fe-9ad0-4c29-8237-6a8fbdac6f36\index-dir\the-real-index
Size 72B
SHA256 afb169a378868f3c72f26d53205f45068fc085c9de85ae466b3fe5cd76324368
MD5 39d73a5c67b3cef04ce1dbccfa2c7480
SHA1 49a4a9d87bd68d7b4cf8a94806c999ccd91fad05
SHA512 fe4bfcea781fdbba159e0de0eeff2f0602900966588464483902be9e547df0060e6b34a721297bcee9aca791aad55ffc0003507158100d65e1982b5639723513
TLSH
T163A0021A46813040D08226F21AD71165535149D00100137550D0404CE8D8B4555A600E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e0ec3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6e0414fe-9ad0-4c29-8237-6a8fbdac6f36\index-dir\the-real-index~RFe5e0ec3.TMP
Size 72B
SHA256 b17960b489b55a226081045e0f7333bdb1f5077b31b06cac304e616812d1b5e9
MD5 ebe4fbef0ee5d3197b8a71fa4e841b53
SHA1 6222c95d859205a15f4659a86c75dd0696675870
SHA512 36aa42a480fe701380e3040ae567a0f769336b5f761c8a5a658d20663729b19e21795d95f1a2f334aafa39ef87361ea428ba1189ea47287525f6833c5a8b6c47
TLSH
T121A0021113C14047D0E236B15FD7126512198C50B500220656D10244EC50964458300C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 273B
SHA256 c6140f1c7e83c2af8b3145582fb6de1e5836fa762920d2121247df28783b1576
MD5 61786ed19a90d59fbd14181c6d785999
SHA1 0a18ebc4a21a5fbd013950a9c716217211376467
SHA512 89fdce5415c6e07045bcc493cd89800c75c05033ece94657831e0e34197b168b14835a6682a2624a6adfaabb7c61700fb3a4b76167aac92f1c0a7b5f08911621
TLSH
T17FD02BFF1DE51820DEEFD3D3203165F1000678649948FD4E106992C320B16253517C10
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8619f6547d3df470a5bbbcbb5d507941b977b380b235aac44f98428536f0aba6
MD5 fd1d93fba2fb7379158f56239a60057d
SHA1 d2e00cfef3a379842b44beca8540eead72244e6c
SHA512 4c964b6dc33f33db7d3fed57f6a22e2eab41b2a2f8f1b65c72ca0bae3f744c9e2c139dbc4bba90b9c1eb9f7c2e1b31325441c6746c665a443b8240e923bb0cf9
SSDEEP 768:oA3ZAJFap8+p3bd66j+4BRv86aLIWdPi9Pf:oA3AE8+p3Z6n4yXPA
TLSH
T1A1F2AE71E8A89D739CF6DB85B25637036EF85563E6C01ED898DDAB0E118616E030B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 75ec2fbd76157d0fa64d7408246167621a436bb45a48a6fff8193b3e86d355fd
MD5 42e6e0045f4f4517d4a81a3a8c273440
SHA1 48e92e5bcfe35ab926c4d5c63b97d03077fadc78
SHA512 4d0ad102ec93b7b230de09c265bcd49f3fa3bd2cc97a6863a9b7bd66202bb020f63687194f546e185f8f6dd421d7cccd15a50005e522a364ffc49d66e82ff645
SSDEEP 768:oA3RAJFcp8+p3bd66j+4BRv86aLIWdPi9Pf:oA3Y68+p3Z6n4yXPA
TLSH
T164F2AE71E8A8AD639CF6DB85B25637036FF85163E6C01ED898DCAB0D158616E030B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7f4c5c431272e264c461bbbeb906ed404576159ac082a6dc8000bcadebcbc137
MD5 bbc072879658570fe2f4be53c8ded457
SHA1 5f945bb254d7593e14c52a006ff5edca87605815
SHA512 17a2bb021795673ba0ae74c69183cd4912796998371a18d979af662f6691ebef1eed8273b6c5dc20926f102e3917469bf380b0f20c2eb7ee2377d52b21699f06
SSDEEP 768:QF6B3BwgkAJDp8+p3bd66j+4BRv86aLIWdPi9Pf:fB3r8+p3Z6n4yXPA
TLSH
T171039E72E898D977ACFACB85B6563303AFF451A7D5C05ED4E5DCAA0D11870AE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7ae2c057a6fd6a3d2571f0d94f63acd7768df0f7f07514dd71e5dec6591ea417
MD5 f96c3ceb51b995f132ab55e6be9b6031
SHA1 1caada2c09b9ec0c4131bd5416284e8d5c179e52
SHA512 e538e7ad3300552a26bfacf88204d52c6333cc425d5294b018ef6a506047792a968cc007a6b12ce36218cc3078c527572c591333d1adadb89b9b35a9d4725268
SSDEEP 768:4rv+4UNbdD3oeJFNp8+p3bd66j+4BRv86aLITd2bwCl1:4bsbp3FL8+p3Z6n4yc0ww
TLSH
T1F303BE72F8A8A9739CF6C644B14776437FB851A396C10EC4D8DD2B4E119A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 58a3e622aad5986c167f0f51bcfb1a0d949e321c3632e66d3d23063de1dd4e6c
MD5 2acbf12c2454bf737be2193ff720dd49
SHA1 9f92918f18874ff5ffc2a1ebecd3b6529a1878af
SHA512 4eee59d159ad0db63447754034451f318d3530d3517a25ef4d1de145f66874ef7790017b96bf65b6cafeb7163667d18b09cb1c9c344eeabdce104c0e07aaa6cc
SSDEEP 768:QFHE3WwgWAJ7p8+p3bd66j+4BRv86aLIWdPi9Pf:CE3c8+p3Z6n4yXPA
TLSH
T194039E72E898D977ACFACB85B6563303AFF451A7D5C05ED8E5DCAA0D11870AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6908cf2cd4d4a56e87e32e58b58bde7b862c8c8c906ba207a0496b00968ce0d0
MD5 e65a606587f221f8ea716141517eb008
SHA1 fc391b30271b1c79961f9dc295fc2f4e8900734d
SHA512 341bde11afac07456141a5550d35bc39413475860bf8b822402f97cb6d4cbfca76128cd224907b69d5c03709bf2c44105957b198975a50812db080b3963b2f44
SSDEEP 768:QFQS3qwg0AJDp8+p3bd66j+4BRv86aLIWdPi9Pf:DS328+p3Z6n4yXPA
TLSH
T19C03AE72E898D9779CFACB85B6563303AFF451A7D5C05ED8E5DCAA0D11870AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 026ae3c8242b5f6a05a3b03727150d2b854ad512054be9e21606a0562c88c168
MD5 be8c88d8f6324dd6bb741aaabedf4002
SHA1 fb0ead5d4a00eb298d0f59faf00cc17e4e908074
SHA512 44d802067adb61fe4e8de5ba70c52c8d453cdd307a82fe369003a9aa9321f81b4a2e03a9383feba1abeafbe0bf5e266551a63e51be2289e247a92082667d75db
SSDEEP 768:FS3RAJpp8+p3bd66j+4BRv86aLIWdPi9Pf:FS368+p3Z6n4yXPA
TLSH
T1E1F2AEB1E8A8AD739CE6D785B25637036FF85163E6C01ED898DCAB0D158616E030B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b00dee515218640c5c858dda2a53bef16ada1b1b86d2e0821342052e9da4dcb0
MD5 984389105981eefc03cd56fcb193d5d1
SHA1 94eeab50b024688af4fb836374261e0371163715
SHA512 70bb23f5b3da61c071e6429935a8a7179fd948c8e82ce4f223bb86f6eb125bf2eb755f759150182e7de93d69b4fe5f4c244ecf576ca36f40519a52af6c85b9cd
SSDEEP 768:Irv+4UNbdD3Hc4Np8+p3bd66j+4BRv86aLIiD2bwCl1:Ibsbp3tL8+p3Z6n4yB0ww
TLSH
T10D03CE73F8A899739CE6C644B2467B437FF861A396C10EC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc0e4916-9bf5-4bd1-bb70-46ee2768d180.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cc0e4916-9bf5-4bd1-bb70-46ee2768d180.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4904-276-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-284-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-282-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-286-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-287-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-283-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-285-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

memory/4904-278-0x0000016E98460000-0x0000016E98461000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads