ef06322f836bc425100e8a7e0d99c55fb4ce21d14912cea1de0625750e24ce96

Analysis

user interaction
yes
max time kernel
137s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ModEngine/ModEngine.exe
Size 16.3MB
Sample260818-v3arqsae26
SHA256 ef06322f836bc425100e8a7e0d99c55fb4ce21d14912cea1de0625750e24ce96
MD5 1637744561923c9b04cd19a858119344
SHA1 af79bcbcab03797ecf3b533f1737e586f7018f7b
SHA512 8cc40eb6f4cefb3c782d29da091023095cc366d6cde76e554a21fd8895c4c63d2b542b8e2e7b1e11c8a844c369cac980d20e717160a9b5e9479a1898662bf80f
SSDEEP 393216:NALETwfCcrv2bd2DOzOo0rOaBFob2QY6jiYG6+w:JyCd56drOa62K2Yh
TLSH
T12007339234DD51ECD3A38F32E506334EDA553AB21DB6854923C43E071563DE6BA0BEE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
110	discord.com
111	discord.com
113	discord.com

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\imagehlp.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	ModEngine.exe
File opened for modification	C:\Windows\System32\combase.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\win32u.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\ole32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\user32.dll	ModEngine.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	ModEngine.exe
File opened for modification	C:\Windows\system32\shfolder.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	ModEngine.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\GDI32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\shlwapi.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\shcore.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\shell32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\imm32.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\profapi.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\CFGMGR32.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\psapi.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	ModEngine.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\advapi32.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	ModEngine.exe
File opened for modification	C:\Windows\System32\sechost.dll	ModEngine.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\comctl32.dll	ModEngine.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_514610584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_624938316\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_624938316\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startModEngine.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315479107659871"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ModEngine.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ModEngine.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{231BEDCC-6665-49F5-A8FD-0585054A5C0F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{0AADCFDC-A648-4ED3-8274-303C58CF971D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3700	ModEngine.exe
3700	ModEngine.exe
4668	startModEngine.exe
4668	startModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe
5272	ModEngine.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5272	ModEngine.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5272	ModEngine.exe
Token: SeTcbPrivilege	5272	ModEngine.exe
Token: SeTcbPrivilege	5272	ModEngine.exe
Token: SeLoadDriverPrivilege	5272	ModEngine.exe
Token: SeCreateGlobalPrivilege	5272	ModEngine.exe
Token: SeLockMemoryPrivilege	5272	ModEngine.exe
Token: 33	5272	ModEngine.exe
Token: SeSecurityPrivilege	5272	ModEngine.exe
Token: SeTakeOwnershipPrivilege	5272	ModEngine.exe
Token: SeManageVolumePrivilege	5272	ModEngine.exe
Token: SeBackupPrivilege	5272	ModEngine.exe
Token: SeCreatePagefilePrivilege	5272	ModEngine.exe
Token: SeShutdownPrivilege	5272	ModEngine.exe
Token: SeRestorePrivilege	5272	ModEngine.exe
Token: 33	5272	ModEngine.exe
Token: SeIncBasePriorityPrivilege	5272	ModEngine.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3700	ModEngine.exe
5272	ModEngine.exe
824	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5272	ModEngine.exe
5272	ModEngine.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4668	3700	ModEngine.exe	89
PID 4668 wrote to memory of 5272	4668	startModEngine.exe	90
PID 5272 wrote to memory of 824	5272	ModEngine.exe	92
PID 824 wrote to memory of 3708	824	msedge.exe	93
PID 824 wrote to memory of 1848	824	msedge.exe	95
PID 824 wrote to memory of 4384	824	msedge.exe	96
PID 824 wrote to memory of 1848	824	msedge.exe	95
PID 824 wrote to memory of 1848	824	msedge.exe	95
PID 824 wrote to memory of 476	824	msedge.exe	97
PID 824 wrote to memory of 476	824	msedge.exe	97
PID 824 wrote to memory of 4732	824	msedge.exe	98
PID 824 wrote to memory of 4732	824	msedge.exe	98
PID 824 wrote to memory of 4732	824	msedge.exe	98
PID 824 wrote to memory of 5256	824	msedge.exe	99
PID 824 wrote to memory of 5256	824	msedge.exe	99
PID 824 wrote to memory of 5256	824	msedge.exe	99
PID 824 wrote to memory of 4084	824	msedge.exe	100
PID 824 wrote to memory of 5596	824	msedge.exe	101
PID 824 wrote to memory of 4084	824	msedge.exe	100
PID 824 wrote to memory of 4084	824	msedge.exe	100
PID 824 wrote to memory of 5596	824	msedge.exe	101
PID 824 wrote to memory of 5596	824	msedge.exe	101
PID 824 wrote to memory of 2304	824	msedge.exe	103
PID 824 wrote to memory of 2304	824	msedge.exe	103
PID 824 wrote to memory of 2304	824	msedge.exe	103
PID 824 wrote to memory of 3108	824	msedge.exe	104
PID 824 wrote to memory of 3108	824	msedge.exe	104
PID 824 wrote to memory of 5748	824	msedge.exe	105
PID 824 wrote to memory of 5748	824	msedge.exe	105
PID 824 wrote to memory of 5748	824	msedge.exe	105
PID 824 wrote to memory of 1780	824	msedge.exe	106
PID 824 wrote to memory of 1912	824	msedge.exe	107
PID 824 wrote to memory of 1780	824	msedge.exe	106
PID 824 wrote to memory of 1912	824	msedge.exe	107
PID 824 wrote to memory of 4128	824	msedge.exe	109
PID 824 wrote to memory of 4164	824	msedge.exe	110
PID 824 wrote to memory of 4164	824	msedge.exe	110
PID 824 wrote to memory of 4164	824	msedge.exe	110
PID 824 wrote to memory of 4908	824	msedge.exe	113
PID 824 wrote to memory of 4908	824	msedge.exe	113
PID 824 wrote to memory of 4556	824	msedge.exe	114
PID 824 wrote to memory of 4556	824	msedge.exe	114
PID 824 wrote to memory of 4992	824	msedge.exe	115
PID 824 wrote to memory of 4992	824	msedge.exe	115
PID 824 wrote to memory of 4992	824	msedge.exe	115
PID 824 wrote to memory of 5492	824	msedge.exe	116
PID 824 wrote to memory of 4220	824	msedge.exe	117
PID 824 wrote to memory of 4220	824	msedge.exe	117
PID 824 wrote to memory of 6452	824	msedge.exe	118
PID 824 wrote to memory of 6460	824	msedge.exe	119
PID 824 wrote to memory of 6468	824	msedge.exe	120
PID 824 wrote to memory of 6828	824	msedge.exe	121
PID 824 wrote to memory of 6828	824	msedge.exe	121
PID 824 wrote to memory of 4616	824	msedge.exe	125
PID 824 wrote to memory of 4616	824	msedge.exe	125
PID 5272 wrote to memory of 6224	5272	ModEngine.exe	126
PID 824 wrote to memory of 6364	824	msedge.exe	127
PID 824 wrote to memory of 6364	824	msedge.exe	127
PID 824 wrote to memory of 6364	824	msedge.exe	127
PID 824 wrote to memory of 5012	824	msedge.exe	128
PID 824 wrote to memory of 5012	824	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\ModEngine\ModEngine.exe
"C:\Users\Admin\AppData\Local\Temp\ModEngine\ModEngine.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\ModEngine\startModEngine.exe
  "C:\Users\Admin\AppData\Local\Temp\ModEngine\startModEngine.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\ModEngine\ModEngine.exe
    "C:\Users\Admin\AppData\Local\Temp\ModEngine\ModEngine.exe" -start
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://modengine.me/discord/
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffe1cbdc188,0x7ffe1cbdc194,0x7ffe1cbdc1a0
        5⤵
        
        PID:3708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,7285756352320655604,6443436254913592200,262144 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
        5⤵
        
        PID:1848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,7669888846684709019,5242284830977745243,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,13436089379810828080,756312986996717315,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
        5⤵
        
        PID:476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,12669148587748538023,2632643069910571485,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
        5⤵
        
        PID:4732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,6721899272146697720,15350138886479683837,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        5⤵
        
        PID:5256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,6347176650457093394,1759413301941695970,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
        5⤵
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,4293319477726932636,16132757251915504395,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
        5⤵
        
        PID:5596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5376,i,17369838864692283156,1202012666733472346,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
        5⤵
        
        PID:2304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,14997005313224294526,8955849967761225570,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5536,i,5732498271886187651,16921121920039868226,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,18189888743433849858,11021180147202858674,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
        5⤵
        
        PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,6348049476455409807,16136950535953084778,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
        5⤵
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1272361153882937720,2236851539553424207,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
        5⤵
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1272361153882937720,2236851539553424207,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3628,i,45574238641250177,15385667435880760591,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
        5⤵
        
        PID:4164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,2457928316361056653,15550673895222114403,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,12682238564264976254,12537028325417193473,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3688,i,16263820545899865141,15711676390242486328,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,6709444326627485693,1664272480362101614,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,13957915252746719273,10110007606135853805,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:12
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,187130995084643771,14673688516105445676,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:14
        5⤵
        
        PID:6452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,9464581224412306897,10951648346835888645,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:14
        5⤵
        
        PID:6460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,5274052911845574027,5927384392101040975,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:14
        5⤵
        
        PID:6468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7939524064094468847,1710920401209643203,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:14
        5⤵
        
        PID:6828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7700,i,15614365385905774960,17062256686278906754,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7732,i,4753956753156865949,4167640215869870342,2097152 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
        5⤵
        
        PID:6364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,4408283406334062654,11333321744740969759,524288 --field-trial-handle=2540,i,11828565455774004783,2403186237865441787,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
        5⤵
        
        PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://modengine.net/gopro
      4⤵
      PID:6224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 60146541acf8d07a412bf599e54a41692f214cd77bbbf8328fd3efcf20c6b633
MD5 39a15f7256797f4280c690d0f532d6fe
SHA1 8b6035968577ea74d575c2bb92f0f8ea1905d23f
SHA512 57da7ac928d04d3fd994783850b2e8d7c8b15105b9bb08bfca6b19fefed9e285d7ff435baca56cf92dfe003780611618b1f2a2f3f4f00e25223bd5a50ab90699
SSDEEP 96:am+F++Il1vbG/5RfFDzV20nN9OBH6/ueHa9hvirKQ4JgmjGtIiZpsE:amplNa/Jp7NuH6/CYCJMCiZv
TLSH
T16E02A23587D22192C779B7F14DDA1A0632F1A12649135E072F8CAC7CBFCBF8781905AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92c12d2e420c54b153ae984b3ded7319e6966068e45dcaefa22ae45f65c93479
MD5 021bbf87d27ba5766fb21fc300725af0
SHA1 2d48d90a429a4155e98df5468828875e60d8e7c5
SHA512 5e6205d6178d3f031e66ac64241ffacb151f71aabcba99e860d8db5aca9fd83c87fe8660ff2806828e34f0478b4f837ee7e9489f5657eba0db4bc13eae346c4b
TLSH
T13D219DF3C3E8567D8D5542F466243F1BCE2D0C54431C3D5AC9D4AB5B93E5471E28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 01902d22b89749016f58252ef53e3446e3d38a3e93d3cdb4e2970d9ecd909622
MD5 b7235763ea7db96cbcfe7171e11eff31
SHA1 10fd49b8e5c43a24f407a2196fd8d88d755278cd
SHA512 734a337c721892a6b732348e3d157a5ad3dd12cab49e2c4fa734b8f849c2eb8fbd7d66f5119c031b495197bd64ef8ebf9d3581162f254b0b3bca2de40dde508b
SSDEEP 96:DYOyCLCJsu8upaVaeaXzW97VEmhUi9u6Uue7ulwJ:DDyCLCJsxOaVaeUK7VEmhUi9yr7GW
TLSH
T1C5A19CF3C7E88A2DD91152F0AB146E1FCE2C0914436C3C6A8AD5EF5BA7E2471E141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 624d6350888939f33e95da5748d31669c07909e75bedd1546a31787c9ad66ac7
MD5 a61115a25c26f7b9012e790886551d35
SHA1 5c8b8388f6499b8c0da776b177134dbfc94e34b6
SHA512 4e655b25bc8bea88d1785b685d780fcb278c0e9555fcc8127db9fa2965934cf58a66c582f95e57bc4f32c38b2fffb092bc07dc86ad14a90156f051457c38029c
SSDEEP 192:sxR4RvYv/fOsglbqZijQzoD8pcJk+/g6+WNNDmm/eB4RVGb4/+yV+GwIgDwBJ:sxR4Cv/fOsyb8mQQ/5p/eG68mq
TLSH
T1FE52B81AA9246D375CCBE31DBA15BB53D3F95032A0D55E48ABFC8A1C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0bf4e5dc2bd41c496e41247e289a0abcd695ab9ca0b850ae2779bc252f46011c
MD5 aacc884db2fa8a1b77eae86c6b017b38
SHA1 da3e52eb12a7b4bea00d7093307316b29cb69db2
SHA512 a33a6a22a593f495bb706ea3adef967a129148cd4ad45f5fff1f09c8b91953b059071e3ca8ee99bd9cfbe534ca0e155318322f3a99639fb3b88aca327cb8cb03
SSDEEP 192:sxRnRvCv/fOsZluqZi9QzoD8pSe+/g6+WNEmm/zVG/bbByV+GwIgVBJ:sxRnYv/fOs/u8sQ8/5U/e8ml
TLSH
T17242A6166A24A9374CCBE31DBA25BF53D2F95032A0D55E58BBFC8A1C04EB7DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 011950ef4d443b45ae49beed8c658a79ae0b5f8c34a93f2623aed77ba1d5388b
MD5 f3fca0d65427199abecb60639d01f12e
SHA1 2a7b27db3f055429a05211315875b93b2938d194
SHA512 53f309bbcd3d889f6cfd35376a8b7b86ab64f152800304a38659d48c0b84a2d45328d647b7759c78f21cbd67b2e1cdbab4f2ffe32d29c0ff4fbb3177d46ead0f
SSDEEP 192:sxR4RvCv/fOsglbqZijQzoD8pSJk+/g6+WNNDmm/eB4RVGbJByV+GwIgDwBJ:sxR4Yv/fOsyb8mQm/5p/eGw8mq
TLSH
T1E652A61AA9246D775CCBE219BA15BB53D3F95032A0D55E48BBFC8A1C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4944e1ba635029a2038ff046df6c44d95001661ab0edd723f0534c94642dc6b9
MD5 6b15bd9dafc74fe8a64c87f2cbf8a3ca
SHA1 acbb0364bbc9acc5c75966ce7bc7347d01362bbe
SHA512 6ba63bedb220e02ad008e471286868a251437bb3631667a747a14acc9a0cf354c5e299026559431d177e02f71da0f0a91323a6e9f92f34c9b043165de81410e7
SSDEEP 192:sxR4RvCv/fOsgluqZijQzoD8pSJk+/g6+WNNDmm/eB4RVG/bbByV+GwIgDKBJ:sxR4Yv/fOsyu8mQm/5p/eGE8mA
TLSH
T12542A61A692469774CCBE31DBA15BB53D2F95032A0D55E58BBFC8A1C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 54e9d06d0faeaed189f079b98e2c26c868a8e6d68cd48e5fc8563776bab222db
MD5 ab4dff04273de8773fc2875d387e8a75
SHA1 68ff672e53c8447e9f3172208a4160ae49df8496
SHA512 be4c1ea0f1ba0f39c3f33f93e5c83c4989aad2826322f40f140d6df7f4a3972dc1cb23bd93c331fa7e2bfbc398bde0b578167435fbf147577cb5e2c3b9340658
SSDEEP 768:UQYiF37pLuL78NWgv7fFJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbU5pNKRroz/:UQYiFxE78NWgv7fFJu1jaUU5fKqz/
TLSH
T149D2DB7B740CCA7E4F804A9D99297A9F6DA802CB96D8CD8047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 306582b81377c25d10608c899b4528c8d546d1b4a2790a453c20d6fca9cf16d1
MD5 e5b94dd10a64d5b3cc4fa3e1055e6910
SHA1 09ad48dc87035e2559c7fc65b4e5108f087c5357
SHA512 52d64eda0b4735f5b5c4b361c67a0e6348ea16e996e3ca8fb40f9970c452dfe3ad2a72205c6c4c1ea551cf5d53119cf50f01a251a2f194bf86e510c283b51258
TLSH
T1C4D0A7ABF5A424E0E7674B965632149EC7A02CC8488AE098C152246D5CF6B53E331F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 ecb117664cbde6f2e47b84ca5e88e6b4b979d74948a9a08675ab810e98288f61
MD5 002c6ebe8e6eeb38967e0f9aeb263a2f
SHA1 7a7551a3085ada61b75747b958a1cbb1cdf92a20
SHA512 2b2b28bbbe17519af77f33712f8a6c5058e7021f8edcaa9ef2286215b066953e878a7e8981cc267dd80f6fde66eb21e306ebf3a767e160197a20255ceca5ea3b
TLSH
T137D0A7ABB19864E0A6AB8B91162214AEC7A02CC8489AE098D15104595CD6B53A632F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c6c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59c6c1.TMP
Size 138B
SHA256 10ca0ddcf8a9e5a165b473bc991c2b270cff3b4e54479747d3ef5806fa98ee51
MD5 04beadc1496ddecb0d07ed01081ca431
SHA1 771fd6ea0feb609a96f7463c06e188dc0f6e0923
SHA512 bd27e9481f671c5364460b5525ebb7d74c144a39058d98c84f586b6d2c7bc3ae4e2190616499a70a6ad3a0a4480cb288f1412ceea3a0bb7efb6bfc69fcdd722a
TLSH
T131C02B9BA5C009218B1107D10332008CC7042CCC0C82D09C90A33054213AF33A337FD6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec371bb8fd298a7ad86d2f1bdd551f0101c8b4214c8e3fa1bbf79c7544bc8b4d
MD5 b2bebe616f349adde5d7a2262a07c554
SHA1 d73eec2679a654ca173146e6ef85f60f22c43bec
SHA512 9b18dc905b9246cdea27db187663c92a2accf12729d8cfed6077b63cb1d1cbae4013240ad9e01f68057ecef4c4226f1094c5a68cd1e84e07a8b1bc478967b405
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkr0xFzJZlWNiYgtlK4UgDlcLTqN5eHBoBZBsb:Cm7KmgIIJ4tWGm7g09OGlkr0xFzJZQND
TLSH
T126A1A216357E12503C7E790991BA892B92C274A33214E42B7BB811B60F7BE079DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7f43.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7f43.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 08e2d152cbfd6aa69f6cac3c081c23584c2cb15a772cb3d3ade4ef66bd9c1ec3
MD5 2ce0c6577728a9ba14f2c32498b578f6
SHA1 a58067be355e83a6ff37f7320d53ab4b972d06b6
SHA512 032c8fb9792d0117b708cdb8b994d456eab81388cfbbaecc65da78cb30b80cb363cdfd1732ed1ff4e7134c84aa3259ea0547bfd00ec049ba700c7d17825d69e0
SSDEEP 768:mh3u+fUllYya77Hucys6BRvi82oP4/z6himo6l0uTHiKBum:mh3jfc3imOz6ImoS0cHRBn
TLSH
T1C3F2BF74A855DD73DCDFD299B5463B836EE4923385CC5DC4DAEA9B0E0183A6E031F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 81685c1a526e0bb0555b3b1abb28fc9b3fef6d5c2b78c1db5d73b9d64a2c8d66
MD5 4de2876fafab7ead1807fe56ccebc327
SHA1 46d554c14b7525a99a38bf557a0ac69d3077d354
SHA512 8b04190d33c426aba89e9d6d2d2c249899910cb3c2d85c941e99f0a276f89d35f7a19e5ed29867cb4b1b617757e46bb779bbed7140cbc93d9cda93b55bf13749
SSDEEP 768:dF8X3IwgP+FUMSui7Hucys6BRvi82oP4/z6himo6l0uTHiKBum:AX3ZFf3imOz6ImoS0cHRBn
TLSH
T1A41319F598C38976E89E9387677D7E429AFCD163B5889880B7D54E0DCC825BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d0b7885c53aeed5a1414c31bc0ca7673f544113606c66d415b6fd0caa2448d51
MD5 2f74afedc58de881b63e32a09e4a0ad4
SHA1 dff45865047be5d99d1cbefffca648ae5035de25
SHA512 b70b9c95e5c2f69f92e06bcb5c6d23b1355713f28e54efde98acd23be297edb3649ae1120dfbc52de6b4f5db812471b3f8da9518b5a4549ab888e6c2f94aecca
SSDEEP 768:xGrv+4UNbdS3OqjlYyh7Hucys6BRvi82oP4/z6himo+Q2bwn+h:xGbsbw3Ol3imOz6Imo30w+
TLSH
T1C903CF35F4089973ECEBC288B4467A537FF4522345C91AD0E6DE5B0E028BA5E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f2d52a54e6c3a94d327804c73fffc73acf0b1b2f10615dfac2fba72b33e2a9cf
MD5 ba385d4f868213b4e0b886cfd344b93b
SHA1 2d16be5401bc03442d951b5620eefee6341263eb
SHA512 29f1901b98798c3b5a077362397acebd881f8d391498cf94aecb905f72dc21a5d6ddb60721a0ac35ef9a226f25c104ec4dbe4bdebf0fb9f782590139fd9da192
SSDEEP 768:Dh3p+SUllYya77Hucys6BRvi82oP4/z6himo6l0uTHiKBum:Dh3oSc3imOz6ImoS0cHRBn
TLSH
T1F4F2BF74A855DD73DCDFD299B5463B836EE4923385CC5DC4DAEA9B0E0183A6E031F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4d6586423b9916da471b3e1a98a6278ffc1c256353157bcdfc903bada6776fa5
MD5 429c3bd77fddb180e5243f8457665d0b
SHA1 cb3494d9e7371941ba6040535505984cd99c7077
SHA512 4047e59cee5efd64ede0ae73b48dc2d56bf0a447e6528f17653cb30d477e9078dc0771229aab047f7388bcc892095dc5cc1d9d38633775f3b01e10cc4c44cd66
SSDEEP 768:/rv+4UNbdS3PrlYyaJ7Hucys6BRvi82oP4/z6himofl2bwn+h:/bsbw3P3imOz6Imot0w+
TLSH
T1AA03BF35E419DD73DDEBC288B4467B937FF4626344C94A80E6DA5B4E0187A5E230F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 3dd8c2e54c34d8ea980d9904221166c374f19b72fef5502722b3b2dceede147e
MD5 b53b3bd86592174089454994ac19f043
SHA1 012a13adba392471ac9ddf218425b7cb17a0a56f
SHA512 6d88df55cc0cdcf2b40ee67e52ff095baab4a2720f64092fd8b1d022b93d8abfe84b427ea864a4b459037af0b962e933be8aad1295765deed4d37197d6eafa56
SSDEEP 768:dFtK3XwgPuUhGzuJ7Hucys6BRvi82oP4/z6himo6l0uTHiKBum:xK3In3imOz6ImoS0cHRBn
TLSH
T1B71318F598C38976E89E9387677D7E429AFCD163B5889880B7D54E0DCC825BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9d991e71674f6453102c8a8e39294bd0872913066fde24863f4459d0490e3dc1
MD5 8e39c00c8953bb216c3803c69c4fca2e
SHA1 97606e6849651513193d1753175805e0a6b77a0b
SHA512 dbcd8a719a71ca69e1f3c94a3a8da6856e816d7ea749b4a89cea20cb5bcffd877ffed8c06dc9f454c0c192a891d7d8c06de6666685ee86deaf07ad6f4e77c1b8
SSDEEP 768:trv+4UNbdS38+SUllYya77Hucys6BRvi82oP4/z6himo6l0uTHif:tbsbw35Sc3imOz6ImoS0cHq
TLSH
T18C13C034A419DD73DDEBD288B0473B837FE4522385CD5D94DAEA5B4E028799E131F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fd177ceffa1c254217e742bc17c48c3695a8249125b6db3babd3e6f04b412315
MD5 1d229c5988d823a0c0cd2887a906a476
SHA1 b8bd641d5b8f22b0ace9e1541e8fcc11553b590c
SHA512 1f127aa8f77584cf8fc0852cdf29482ed1214f02d62938637f5087bb966acdd3b8cd72c4dcc8e364d1b8c81376a4cb595433e8270163bd432b8813b92711accb
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5ac516.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ac516.TMP
Size 392B
SHA256 9fddae4d9d522ce1f5eadb45e65d23e9e7716c7f1d67f776cbd40dd214d0cef7
MD5 cd4ec31f1eb026ecd9826f4072633712
SHA1 7c98a52aaa01abfd8e006fb2687f3aa3f1ec0656
SHA512 a5ba9ca3b8a1294ce2e1b8a93debd2122586cb4f334807a00072ea2645f561960f59a803972d1ebf3cda58630f1809ca7476871e4bb774a3da0e817c2f87822a
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

dc90034e-b13d-4d06-a365-029d1168c3fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dc90034e-b13d-4d06-a365-029d1168c3fb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir824_2122882412\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3700-8-0x00007FFE3DB90000-0x00007FFE3DB92000-memory.dmp

Download

memory/3700-4-0x00007FFE401D0000-0x00007FFE401D2000-memory.dmp

Download

memory/3700-5-0x00007FFE3FB90000-0x00007FFE3FB92000-memory.dmp

Download

memory/3700-2-0x00007FFE401C0000-0x00007FFE401C2000-memory.dmp

Download

memory/3700-6-0x00007FFE3FBA0000-0x00007FFE3FBA2000-memory.dmp

Download

memory/3700-7-0x00007FFE3DB80000-0x00007FFE3DB82000-memory.dmp

Download

memory/3700-3-0x00007FFE401B0000-0x00007FFE401B2000-memory.dmp

Download

memory/3700-0-0x0000000000400000-0x0000000002A38000-memory.dmp

Download

memory/3700-9-0x0000000000400000-0x0000000002A38000-memory.dmp

Download

memory/4668-15-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5272-23-0x0000000000400000-0x0000000002A38000-memory.dmp

Download