hxxps://dashix[.]cc

Analysis

user interaction
yes
max time kernel
209s
max time network
203s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dashix.cc
Sample260817-ftx4catdkc

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4692	msedge.exe

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	TextInputHost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DOMStorage	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	TextInputHost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314170469742127"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{BFC70F0A-257D-409D-9478-923612F0382D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5492	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5492	TextInputHost.exe
5492	TextInputHost.exe
4816	msedge.exe
4816	msedge.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5852	taskmgr.exe
Token: SeSystemProfilePrivilege	5852	taskmgr.exe
Token: SeCreateGlobalPrivilege	5852	taskmgr.exe
Token: 33	5852	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5852	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
5492	TextInputHost.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe
5852	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5492	TextInputHost.exe
5492	TextInputHost.exe
5492	TextInputHost.exe
5492	TextInputHost.exe
5492	TextInputHost.exe
5492	TextInputHost.exe
5852	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1368	1284	msedge.exe	89
PID 1284 wrote to memory of 2568	1284	msedge.exe	90
PID 1284 wrote to memory of 4692	1284	msedge.exe	91
PID 1284 wrote to memory of 2568	1284	msedge.exe	90
PID 1284 wrote to memory of 2568	1284	msedge.exe	90
PID 1284 wrote to memory of 4904	1284	msedge.exe	92
PID 1284 wrote to memory of 4904	1284	msedge.exe	92
PID 1284 wrote to memory of 248	1284	msedge.exe	94
PID 1284 wrote to memory of 248	1284	msedge.exe	94
PID 1284 wrote to memory of 248	1284	msedge.exe	94
PID 1284 wrote to memory of 252	1284	msedge.exe	95
PID 1284 wrote to memory of 252	1284	msedge.exe	95
PID 1284 wrote to memory of 252	1284	msedge.exe	95
PID 1284 wrote to memory of 3880	1284	msedge.exe	96
PID 1284 wrote to memory of 3880	1284	msedge.exe	96
PID 1284 wrote to memory of 3880	1284	msedge.exe	96
PID 1284 wrote to memory of 5560	1284	msedge.exe	97
PID 1284 wrote to memory of 5560	1284	msedge.exe	97
PID 1284 wrote to memory of 5560	1284	msedge.exe	97
PID 1284 wrote to memory of 2380	1284	msedge.exe	98
PID 1284 wrote to memory of 2380	1284	msedge.exe	98
PID 1284 wrote to memory of 2380	1284	msedge.exe	98
PID 1284 wrote to memory of 1648	1284	msedge.exe	100
PID 1284 wrote to memory of 3548	1284	msedge.exe	101
PID 1284 wrote to memory of 1648	1284	msedge.exe	100
PID 1284 wrote to memory of 3548	1284	msedge.exe	101
PID 1284 wrote to memory of 2340	1284	msedge.exe	103
PID 1284 wrote to memory of 1900	1284	msedge.exe	106
PID 1284 wrote to memory of 1900	1284	msedge.exe	106
PID 1284 wrote to memory of 1900	1284	msedge.exe	106
PID 1284 wrote to memory of 1160	1284	msedge.exe	107
PID 1284 wrote to memory of 1160	1284	msedge.exe	107
PID 1284 wrote to memory of 1160	1284	msedge.exe	107
PID 1284 wrote to memory of 4584	1284	msedge.exe	108
PID 1284 wrote to memory of 4584	1284	msedge.exe	108
PID 1284 wrote to memory of 4584	1284	msedge.exe	108
PID 1284 wrote to memory of 248	1284	msedge.exe	109
PID 1284 wrote to memory of 248	1284	msedge.exe	109
PID 1284 wrote to memory of 248	1284	msedge.exe	109
PID 1284 wrote to memory of 3156	1284	msedge.exe	111
PID 1284 wrote to memory of 3184	1284	msedge.exe	112
PID 1284 wrote to memory of 2508	1284	msedge.exe	113
PID 1284 wrote to memory of 4492	1284	msedge.exe	114
PID 1284 wrote to memory of 4492	1284	msedge.exe	114
PID 1284 wrote to memory of 4492	1284	msedge.exe	114
PID 1284 wrote to memory of 1192	1284	msedge.exe	115
PID 1284 wrote to memory of 1192	1284	msedge.exe	115
PID 1284 wrote to memory of 1192	1284	msedge.exe	115
PID 1284 wrote to memory of 5724	1284	msedge.exe	116
PID 1284 wrote to memory of 5724	1284	msedge.exe	116
PID 1284 wrote to memory of 5724	1284	msedge.exe	116
PID 1284 wrote to memory of 3480	1284	msedge.exe	117
PID 1284 wrote to memory of 3480	1284	msedge.exe	117
PID 1284 wrote to memory of 3480	1284	msedge.exe	117
PID 1284 wrote to memory of 1896	1284	msedge.exe	119
PID 1284 wrote to memory of 1896	1284	msedge.exe	119
PID 1284 wrote to memory of 3016	1284	msedge.exe	121
PID 1284 wrote to memory of 3016	1284	msedge.exe	121
PID 1284 wrote to memory of 2156	1284	msedge.exe	122
PID 1284 wrote to memory of 2156	1284	msedge.exe	122
PID 1284 wrote to memory of 2156	1284	msedge.exe	122
PID 1284 wrote to memory of 4264	1284	msedge.exe	123
PID 1284 wrote to memory of 4264	1284	msedge.exe	123
PID 1284 wrote to memory of 4264	1284	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dashix.cc
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffc2b16c188,0x7ffc2b16c194,0x7ffc2b16c1a0
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,17790421369542675069,12850887810912071345,262144 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,10213472396803629839,5106181515942914046,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,16772494238826405387,5577106488251711808,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,15941604910751324119,47145822547830076,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,8090975720884514164,18399925784111753232,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,3524356804227413921,9487038100319787252,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,12538152318318823000,8567078013530511097,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:9
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,2306362632578555664,15883787883585491430,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,2430897019417737904,15398375589257690784,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,9212634328591613025,10533977587866125798,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3044622417099061811,14326833080500116417,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3044622417099061811,14326833080500116417,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6528,i,16515844650365258822,2244192228500683673,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6740,i,9749112791179734673,14629037677784481929,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4332,i,6978177476550291544,12070454154026723243,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6576,i,12739890670332960946,17504766506203865489,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,17685922998754175759,11616397074305929796,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,723245345835191559,11558153475147736134,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16262002515995718861,8998061487234463589,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5212,i,17475902065294859017,15189980609902380269,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6828,i,5714455257791581238,9672625510582542429,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3840,i,6382385797699347735,6359269015198485533,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5108,i,4046128675421311963,6769887838810732378,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,7575386819443128966,11802197737089570728,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,13106748208730339642,18290753636198883738,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6512,i,9817636891982810047,6583859765626878595,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6176,i,9324703191133963748,11064224900400108538,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=812,i,3722559050212677965,3822037135585334861,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,7838724781290804966,15193717522632396457,262144 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6076,i,9626789752770734178,2363016068115003525,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3352,i,8683655432751961221,16538541741057349538,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3432,i,1617191134763891167,16770069213292772108,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,7542669378720676389,2221632027115457378,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10838545928915492845,1833537922336386732,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,7037180707007025824,17974254288072592395,524288 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5280,i,10281647696124248881,8306359934601385048,2097152 --field-trial-handle=2244,i,16520633761030205658,10670539062491199151,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2108

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5492

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38e192f2-5cda-4ef8-9af0-e60762e33205.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38e192f2-5cda-4ef8-9af0-e60762e33205.tmp
Size 38KB
SHA256 3ac78a06c0506e1b9856f4915cecdc6a4aaa2b2f7f5a9d7468cc0f0b80057742
MD5 85d447d1fb15186a47f65ea5dc3cb441
SHA1 541d180931f4a91acc75925ccf9cbec950320a20
SHA512 81be4aa6d6cbfe74f135e94d1505359a38707f7e2bd59b9a47bf5038ead3f200c0d6037313dda8eaca762c057457f1de5db49f9ee63215fe0cf3eadde4f3b1f7
SSDEEP 768:arv+4UNbdl3kPkKL2+jF669yrqUjWiIwwxMR8Uiler:absbX372jF66INWZTMKUsQ
TLSH
T11303BE35AC589AB3CDF2D286B2437783BFB4509396C40B98CADD670D469B4D92343A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 159b53cd1694fb2b7e6d45ecf77a4c98c16d5020863598c4c372a8233d0a32b9
MD5 d92ac9f66904c41d94495c415352c5d2
SHA1 71354678cf5966d61c1353afb1501fbe7070d2b3
SHA512 c6a2402cfb8d74715903e4f22a8a2804da61e7f8a71c250be67dfe3837d5cce3bbafd65f5207de0ba4ddcd498462ae24b3db3b4611e6e9660daaa4adc94bbd73
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T102B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 867121f8d49b5b3b21a863d852e92f5a138268c4afd105be2d5b69c40673fd53
MD5 d33353bd376a2599b98582fc92d184c7
SHA1 0e1c3407dcb69294dced15cdec2497bfe78ad3c2
SHA512 d20e319f4994e50d87aba5ac5bc009a6660fd2a35742480128904aba0734fe2b2ff6de8d8d950870bba005d29eefe06eb0eeaf11a38394facc248753386af7e4
TLSH
T115E0209904C7C29D5A44A4CF917443CC8281368BA7D5FD0E2B40C8CC7846944EF83A91
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e45a29609be98aad915666da2d5de3d10ada999266e3a9c28e90eedc9d78cea3
MD5 9ecce12f04bf5c93b1c5badadeb4dea9
SHA1 4dede7195929dfc7d6431a1aee7aeb022ea66ecd
SHA512 55cf1a2331b7b17a61b116ccaf64ba4db9ebfe9bded7c887bfcf95455688d895d37df7eb3294d263e2057a70022f648dcc3314458829624cbf2a406ba2fdbfef
TLSH
T15961C55ED32EACE2D72490B315E208C9367484E1EACF2E9B82B6F57C940E795721433D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cf8380ff3a0e1df3de46e812e346774782e6c8a814dcc997d232b3ebe520849d
MD5 5e34c120a8ba9b197648b09cd69852d2
SHA1 a45564cb7c5bfd74d6361f2682adcc4a005e50d8
SHA512 ca621d8c0cfc78c8da45c90b804d7ddf586d8df93f983098634216e6fffbc7204c09b0208795653df72f52ab903265ead71dd71855e33ec032b57ab7c8da5636
SSDEEP 96:S4k+huD/mY/ZVVOdAnVzsEMkL3ncRG5NK31E4xuSdN5iGxK+j12:xOCEjnn1qbXH6
TLSH
T19DA1855BC39DEAE2FF1450B305E65CC9727880A6A58B1FA7523DBC78608F3E17125228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe599706.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599706.TMP
Size 3KB
SHA256 461220eea8e27ec578ca2aaa88c05a3eb8b69edc369de97b3359328993217b0b
MD5 c97ebbaeaeb6c3729e51782b80f2c1b9
SHA1 c394101eccf624b6c0caf07d66118b35719f309e
SHA512 b190584ee0881362724a502259bcdfe0ba1f3d59ad4c3086264a2f19a8a91a6f8014db38159ea8ac10a1308b20ff11453d83a7e84905b8850bcb6d0b5c948de3
TLSH
T18961C55EC32EA8E2C72490B315E208C9367484E5E6CF2E9B82B6F57C940E795761433D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fe40e9a999a17616aafe498eba4dc1889c2a281a564201aaaa1ba79565f0bf0
MD5 3863d930fdc7fa650dc2c85578c475d7
SHA1 af9d7f1607e91aa4c38970eac8a58917a1d56e08
SHA512 90af0a4da397a6e0c66c42674370bc99a47242a2b6dba3b2f758ab2cd4b3243497b61a3dd4e8dc70ef5b20295b7b3b8cd475c4d551163e5ceb2b2a39446b60fb
TLSH
T1B251A9F2C3E6862DC91256F09A14AF1BCF19055682683C5AC9E4AF5B93F2471E112B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4934d9956ede6c4a11b2f5c261bb5fe163d4c6eeee9aeb183ac5590777b9e8f3
MD5 e00155b01dc332b9beb02200298c31e1
SHA1 8adbb264ce3fdd71449c4d281499f70f6d50e617
SHA512 4b0178483ff063acbddf0f58b6ba7abfc5e239edace19428062ca5e9a60b6091cdf5b8d11bb5f2e091243bb0d7ed73b60815f479eedcb2c86188eefa99505e33
TLSH
T19641AAF3C3E5856D8E0156F1AA146F2BCF180516436C3C5A89E4AF1B93F28B1E101A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2feb46a465c4838b46508d60f955000f783ed51316e1c28a2fe7694c15d512a5
MD5 c90a73abea9038b9513853330d7bbc61
SHA1 46052c16c2badb38f3ffec7e86d59ca7b7bd4458
SHA512 7ef6273475ba3be1554ba65c92446c452a49ca9a9723eaab8957990462a60e16a046db59c5f93385b4eeb8138da70855aec5e455927b26d0eedf8405aa53e19e
TLSH
T1A7D02223224030B5A9BC7EA6806ABC9FC32611A05893EDDA51D0DCA8863A4BD462F281
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 12a9cd8fbeaaf02acffdaa7097d5295e420ad647d8fb3dddd75fe1eb55123b4a
MD5 36594c25a622e6b3ec27bd9e0598abbb
SHA1 ddd8a3bcfbedcb3559c7c85db6d567f0793d6a14
SHA512 e83664faf0e5286dfa3e2651e9f57cdcfb489bb66d5b9d8428de3c1ca58e4e8664492c7864b51621e5ec288e337bbc3c3e0719ce45fc0381bb99e19eafa2c76c
SSDEEP 192:sxRxR2yM/jK1Ml8wbA/fgsdiqsmZ9zoA8p9S/g6+WNHYYx/l2JuGLIgDpJ:sxRxYlA/fgsdiqWU/54vdH
TLSH
T18462D905AA28A977CCDBD21DFA457F53D6F81573A2901E44AEFC9A0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 27b2a40fd502dab2eaa08e474777c694ba930afb121aa9a819e76c8601ac94fe
MD5 f9bb88878cc0145af421fb2a0479db46
SHA1 691c6457c570d684566344629e0c86695afa81c2
SHA512 5465d5b6dd5d02e46ffb6b554916dac53162b9d99a26baf08e1f4c3e611604e8b6e52dd4998663225597356b1d337bc14a20919e70ab48a13b39d7cf29e3c0c4
SSDEEP 192:sxRWR2yM/jK1Ml8wbA/fgsBiqsmZ9zoA8p9S/g6+WNHYYx/l2JuGLIgIJ:sxRWYlA/fgsBiqWU/54vds
TLSH
T12D52DA05AA28A977CCDBD21DFA457F53D6F81533A1901E44AEFCDA1C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d54179df1209c5aa82391737530aa6a8753a7f17c9412e8ff1f4f238cd1b0729
MD5 22193f4bca0638da56aa3a12dc5c6aeb
SHA1 c8f7ddf03299e5b9729567965e6b1403aacc7f2f
SHA512 55206102c4b0bb162301d29dea35568a931c7192d690101422588fbe3310c5e9ea80e7bd886c0c3b9cac02a4a33d7b08b4078ce9896d23d1affd8992cb327539
SSDEEP 192:sxRxR2yM/jK1Ml8UQxbA/fgsdeqsmZ+hqtoA8pXpeU/g6+WNCuiNeSCtqYhYYYxO:sxRxYqZA/fgsdeqwJB/5Cn6XJddF
TLSH
T1F772F956A5246937DCDBD219FA41BF93E7F85573D2901E44AAFCCE0C00E6ADD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d19e79c3477b4878ac8ceb6574f85fa210b855d1acd8eead200380c930d8ef13
MD5 c82d015665be133463748a09bc4d9884
SHA1 96c7c998e851bee463d3d253c73173993f171885
SHA512 c450886289fb3d3a6afd2867091c5105a8071887fcd920184eeb6c9c708264d322b0929a525407ccbcf57c2e4579b23046d20a819ad6e854c585aa9d483b4b0e
SSDEEP 768:0xCyAjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAeroJPeHn:0xCyAjWgbrfM1u1jacpA1JPGn
TLSH
T1CEC2EC3B640CC77E4F844AADEC25AFD77DD802CB97984D544BEA880C03C67EB521A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 840B
SHA256 ed54a1cbbda3259eb27f1602c081d4c38d1b3f861053a4124e4e52947aca511e
MD5 1c1ffd9c1d0cfb306ac25b449103077c
SHA1 81480e5800f02d475760cf45685902ed3462b82f
SHA512 74577cee2b1f3f75b8eb77714327ee033c3e981a57be57e79e7af71d31ba45d207e85529e387486d97ae434c645d8059af9f79ebfc48db728c7f3daced15253f
TLSH
T165010263CCC2484BCD33AE77A63F349A377A06EC210ACF9B101D4D398D8763D5A01268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 3KB
SHA256 b21dc653fdd0a4353f0b03f84cf7af370e705788d6e193df2b7a4fa805ca90d4
MD5 d4cb732d8e8b70a7d1a0f6ab2dcfe355
SHA1 bb655f2091d9832f6144e02f08778e741142b70b
SHA512 b895dbc457f99eb8934d64c961cedf4cdab6d2b3fafb6b60dde757454947ea517e747ac41bd1b986431686cff5bfa7170c64666d8303de5b5e347d4cd85a7160
TLSH
T10F51D84E8C451D6DC9AD01B21DFB184237762DEEAB49DD076BADA130ACC333B2D14116
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1cff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index~RFe5a1cff.TMP
Size 840B
SHA256 f0f22b749ec1c0b48f82313cd58af0f52a13e972bb2c29624d20a35e74c1856f
MD5 260d4d203cd33985ca2975c65744011b
SHA1 861974c4768e54462b8eb98f3285ae70d36a8daa
SHA512 cb18de7d07f9ab9937066df1fa2cd3b4f3f27ec0194862009a7bb9ed1c188fd17a7a6f59eb37fb8f26cf2307de9ac16ad64734d43ed9912175c2dde6291ce52e
TLSH
T1290196A380C2ECC7CC22A5B8F557209A337F8410211EC74F309F3D71098363C4E01525
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8bc522e7356688dc41781f58899f56d855bc657ca4ac72c883441d803df69b19
MD5 929d52ff473053d928fc1fd871c4afaf
SHA1 6f3e2cc608213e8b24b86eeea188cde0af2d8215
SHA512 17aa19f1c6531c4594b4a41d3a9f977a3cbbdb01b926c99ac69d9df04d8bda1b27978c26bf1b966c5cd22a788009d2ad940f5f3ff58087a2eec00926c8aa532c
TLSH
T1C8E0207B3EF61634F97FE3E218718AF1454279599900FD4F7425D2C75471350646AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b05c64357b7930bd3984b06a7de25d08e2de81fc02905c9dcf7803d16f6f6b16
MD5 a8860b44188111fca79f239c7d20b8d3
SHA1 fd63f87efa3580a067dbca0116f030316384499d
SHA512 48d9c794e0e36a5b8cfd3732cedbec06bf0504e6da947d65d16ce473449a876ebcb1b0c56ddc0268add2f7e7147878d2111f0be41384cb9fc3f89b9a2f38904d
TLSH
T1ADA00216CF5D9346D018027098B601C523108ADC0A45A21755AC815DEE5415881FB448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a78cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a78cb.TMP
Size 48B
SHA256 910f40cf5671b3631ba267c49843e458a1900890b23d8dac989529e8b5d6f7e4
MD5 9987d71cbe94d1f13e0d9b805aca241c
SHA1 3010dab8e576946ab42639eeefb7df53c05c5382
SHA512 b19fa61c52844eb332dcda7be3d893efc6b450075ea61e30dc8d1eea79d6058600079463dfae2cecb3ec3437793d2e5e4dc3e175616c04ed05e8a546016a9c44
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9bf81d4eab318626657d467f88623d04efae4dc81e9d097b1ed88d2a846cbaec
MD5 7b7a8a600ea85fc258e25791b9229aec
SHA1 15f1773a0a41ff6435ca79905cf7469878a1c02a
SHA512 5dd40422f9e6063c329fe9e62e46dbb1f6f832c158cf45f080951c49fa5f5bfec9ce37c65804d14fd16e5a17a7617373606a0af63cdb98a40925d0a015f59427
SSDEEP 48:KyOXQse8IXVhIpKKcM7ypGIPK/aU3xIhKqs07yD:KAVhWKKca6GYK/awxWKqsCg
TLSH
T142911351757A12022DBE790891D4D666CA8275B33019E82F3BE904BA4FB7F414EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bbdf506d-042a-48f5-9288-08b3bd23ef15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bbdf506d-042a-48f5-9288-08b3bd23ef15.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89f584b734e16b23f4214ef715a586c2d43f358df70d93b59d4fc59009a3f16c
MD5 92bd78f4c1b9a08adedc9204ee2f6f40
SHA1 593fd3a8d80c6bc11829dfec10f626149b449ad7
SHA512 c611c4001afda31020ad5bfb600e57ae771a78456a2b4793319f700d7f1df341856e63da307c9e0e37cef64cbae6ced49bd899c4a6a5e8068cbcda6e1b08522d
SSDEEP 768:n+3VFOkKL2IjF669yrqUjWiIwwxMtBPi9Pxt:n+3VPwjF66INWZTMbPg
TLSH
T1FFF2AFB0BC546AA3CCF6E782B2523787EFB44153E3C40F98D9DDA70D0A975991347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 738a765a0ddaf986f7d5c753bcdf34369319527f8ec236721102416af6a58a6d
MD5 c7cc473eecd91f17ef786de99474d6f2
SHA1 eca30497aa5338cd712896ddc97efdb5db6497d6
SHA512 3410588105604b2aa84e5f732ee8157b5cc562873ea1ab1caa99ff212a68d1bff194503f89c98eab70f055ddf65433bc898a8c5456aba5d6e1aa50663f457d96
SSDEEP 768:zrv+4UNbdl3UYkKL24jF669yrqUjWiIwwxMABUiler:zbsbX3QwjF66INWZTMAUsQ
TLSH
T1A203CF74BC58AAB3CDF2D682B1437683BF74514396C50F98CACD670D4A9B0D91347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 83e840c4c17ecdf548636897e8da81e3808db386d53e591ed4f9337004e755b0
MD5 fdea319f47bf143dfbd12c73d3658248
SHA1 13c5e9277c490690b1b1a5a1d13bd3f932bfbbd5
SHA512 e22980e850023f1fe5e87cb0801f65ddcbde12a961bb308267643e92c30bf2d32cb0e919a1cdcc2c97eddc1c7b7c79dfb728c1b91b123b88ce2125b00dffd187
SSDEEP 768:qrv+4UNbd13sXOkKL2IjF669yrqUjWiIwwxMtBW:qbsbL3s1wjF66INWZTMbW
TLSH
T10E03BE70B8686AB7CDF6E682B2033683FFB4515386C40F98C9DD670D465B4D9234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ab01cf4d46a832ff9045b001b43105bfdf00c7e6bedfdf6d51cc81886a318e88
MD5 923c6d59454e8d2af63be3d2269a4164
SHA1 26eca1b002145c1cd93e0a3c8c80367a9c2f49ee
SHA512 5a528ac1a498033ba07cbda7e71dcfb5a1696fdb4213e38c3c7d4634214d04bae14b1e24d2b983ee1271ea3b8fbf28f47246a4d483e3a236fb54b79d323332d0
SSDEEP 768:8FQZ36wgCyGnkKL2CnF669yrqUjWiIwwxMtBPi9Pxt:vZ3XkqnF66INWZTMbPg
TLSH
T126136BF168D75677C8AE9B83A33D2E42AEBCC153B2844A94B7C8950DCD560BFC247825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f6d75fb677d72e5e84c142e9737cf86572f7b6139d207942d8af4129173386fc
MD5 af37d50d814ca63513450cab75cc95ec
SHA1 2255c7a6dca2027b2149e81b02ece8347ee7ba0f
SHA512 26c1aad1c4a11b0e1c73ae501eda2c2d9b16795446b9a72d2a1cdb83fcc80462e78a3e24e8e7a67c06a2633cdc8964800e3b383171b447e664cc77253e28dacb
SSDEEP 768:u+34FOkKL2IjF669yrqUjWiIwwxMtBPi9Pxt:u+34PwjF66INWZTMbPg
TLSH
T18FF2AFB0BC646AA3CCF6E782B2523787EFB44153E3C40F9899DDA70D0A975D91347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8326361c471540d3f5920c6ba4f486944f643d62623f973eb9f17bf726665d0a
MD5 ca43119922f449ee90275bdb3fe7acfa
SHA1 f5631c599f9abafca0b19f1b3e6d2414d2ae2585
SHA512 c6c043d6e1e65d8f65047bdd6f4ddaee1c4e3b2a77abb077c98f2b3f3db4bc569867836a510a7836db90a9e425bbb17af2cad99084d604630ccf370cd4e02604
SSDEEP 768:8FLs3zwgyuGnkKL23PF669yrqUjWiIwwxMtBPi9Pxt:Ws38AfPF66INWZTMbPg
TLSH
T1E9136BF168D75677C8AE9B83A33D2E42AEBCC153B6844A54B7C8950CCD560BFC347825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7b0e87713960e6e99d091884f24d984d47b018f38ee0696ae8f6f3ead6e489f3
MD5 74043c062b4a5fd4a1c66f07ba5fed37
SHA1 b21aac49af7107282ea261a96eaf16c09f843e13
SHA512 d654b25a87a716b70a9afed04278bdf7e982590386cf8e861e4cae6495a8ca192e77232193d1d6a1fe8bcf3d434b0345fc0d58520f46e3028ea4eba14f8289cc
TLSH
T1AEE00206220000BAD028033000971E602AE2406012B202586F22055C0C227012A30F85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a2eb2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a2eb2.TMP
Size 392B
SHA256 def9de08030c545678863bd6c977353ee34f12a3ad39a1207bc0bdaa38c93036
MD5 eb68bdaa911bb3455d01f8d4889e4cb9
SHA1 5d26f0cd9e2f6068daddb618744c50af3d04a320
SHA512 63e79eba35a1e559119d26646c00e6abe0807704363bc77c3ea11f0c87fedb1371f5a8469992d0f7a2fbe99f707da876ff02b55770941958bd0a828baffadd1c
MD5 SHA1 SHA512

Submit Download

98decca5-d2ae-481c-89ec-56beec0b8101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\98decca5-d2ae-481c-89ec-56beec0b8101.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5492-263-0x000001BB154F0000-0x000001BB155F0000-memory.dmp

Download

memory/5852-1316-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1325-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1323-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1322-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1321-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1320-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1324-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download

memory/5852-1314-0x00000206DAAB0000-0x00000206DAAB1000-memory.dmp

Download