da0d4f92dc20db666587acbb30b37a2205c18ec9d186ea03c7a530027dabf34b

Analysis

user interaction
yes
max time kernel
75s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultimate.Ragdoll.Game.html
Size 14KB
Sample260819-e9e22ayve1
SHA256 da0d4f92dc20db666587acbb30b37a2205c18ec9d186ea03c7a530027dabf34b
MD5 0def41a4b93c47a5e88fce1e2addbc3f
SHA1 367e319bd2f727fe282f3990703dc7c782d2598e
SHA512 270c42814ed18113c41fa5b9aaa7574908088e84472aba2ec729e0bcb4b3fe135aa2ecfc25d35bbd4ec622eb8439f4405a537ac226b2647a45d2264e6c8a14b6
SSDEEP 96:TJ2S72MW22VlqWG2qlUWKctqrAl1f5aBfvDFP66FuqSX86WXymRm1jhH+OKZgZ:TfyM5wqZ/KlEl1yfL1gz8FROHegZ
TLSH
T1406280F754F2641641038091EF2A771DDF93950B9A17C468B0EC0AD9AFEAEA59C83F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3940	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315879141896037"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EE2FAA66-1499-451F-8B64-D18183D4F2C6}	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 548	3196	msedge.exe	87
PID 3196 wrote to memory of 3940	3196	msedge.exe	88
PID 3196 wrote to memory of 4368	3196	msedge.exe	89
PID 3196 wrote to memory of 4368	3196	msedge.exe	89
PID 3196 wrote to memory of 4368	3196	msedge.exe	89
PID 3196 wrote to memory of 4856	3196	msedge.exe	90
PID 3196 wrote to memory of 4856	3196	msedge.exe	90
PID 3196 wrote to memory of 5116	3196	msedge.exe	91
PID 3196 wrote to memory of 5116	3196	msedge.exe	91
PID 3196 wrote to memory of 5116	3196	msedge.exe	91
PID 3196 wrote to memory of 2804	3196	msedge.exe	92
PID 3196 wrote to memory of 2804	3196	msedge.exe	92
PID 3196 wrote to memory of 2804	3196	msedge.exe	92
PID 3196 wrote to memory of 1472	3196	msedge.exe	94
PID 3196 wrote to memory of 1472	3196	msedge.exe	94
PID 3196 wrote to memory of 1472	3196	msedge.exe	94
PID 3196 wrote to memory of 3932	3196	msedge.exe	95
PID 3196 wrote to memory of 3932	3196	msedge.exe	95
PID 3196 wrote to memory of 3932	3196	msedge.exe	95
PID 3196 wrote to memory of 1832	3196	msedge.exe	100
PID 3196 wrote to memory of 1832	3196	msedge.exe	100
PID 3196 wrote to memory of 5080	3196	msedge.exe	101
PID 3196 wrote to memory of 5080	3196	msedge.exe	101
PID 3196 wrote to memory of 4272	3196	msedge.exe	103
PID 3196 wrote to memory of 4876	3196	msedge.exe	109
PID 3196 wrote to memory of 4876	3196	msedge.exe	109
PID 3196 wrote to memory of 4876	3196	msedge.exe	109
PID 3196 wrote to memory of 1068	3196	msedge.exe	110
PID 3196 wrote to memory of 1068	3196	msedge.exe	110
PID 3196 wrote to memory of 1068	3196	msedge.exe	110
PID 3196 wrote to memory of 1096	3196	msedge.exe	113
PID 3196 wrote to memory of 1096	3196	msedge.exe	113
PID 3196 wrote to memory of 1096	3196	msedge.exe	113
PID 3196 wrote to memory of 5032	3196	msedge.exe	114
PID 3196 wrote to memory of 5032	3196	msedge.exe	114
PID 3196 wrote to memory of 5032	3196	msedge.exe	114
PID 3196 wrote to memory of 812	3196	msedge.exe	115
PID 3196 wrote to memory of 812	3196	msedge.exe	115
PID 3196 wrote to memory of 812	3196	msedge.exe	115
PID 3196 wrote to memory of 1328	3196	msedge.exe	116
PID 3196 wrote to memory of 1328	3196	msedge.exe	116
PID 3196 wrote to memory of 1328	3196	msedge.exe	116
PID 3196 wrote to memory of 208	3196	msedge.exe	117
PID 3196 wrote to memory of 208	3196	msedge.exe	117
PID 3196 wrote to memory of 208	3196	msedge.exe	117
PID 3196 wrote to memory of 4876	3196	msedge.exe	119
PID 3196 wrote to memory of 3036	3196	msedge.exe	120
PID 3196 wrote to memory of 2996	3196	msedge.exe	121
PID 3196 wrote to memory of 2592	3196	msedge.exe	124
PID 3196 wrote to memory of 1820	3196	msedge.exe	125
PID 3196 wrote to memory of 1820	3196	msedge.exe	125
PID 3196 wrote to memory of 1820	3196	msedge.exe	125
PID 3196 wrote to memory of 1408	3196	msedge.exe	126
PID 3196 wrote to memory of 1408	3196	msedge.exe	126
PID 3196 wrote to memory of 1408	3196	msedge.exe	126
PID 3196 wrote to memory of 380	3196	msedge.exe	127
PID 3196 wrote to memory of 380	3196	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Ultimate.Ragdoll.Game.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11843257298073713290,10733834001875890623,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,537517815111401643,10602901572376010566,262144 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,13289031666282306552,17054695329077143759,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7868690021897814811,14273546611506137011,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,88552411960476319,12380106636175016339,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,13407325347969488290,537947530369278332,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,1769342191965030010,422575867766395819,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,2971979638702322555,2191502568386155947,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6777879749133124372,6959217180314548584,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,6983416853687520108,5107191950982419412,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,6983416853687520108,5107191950982419412,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6432,i,14372781015870640417,10273881379492443500,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5856,i,8140836695216608346,13096547827869859532,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4204,i,12499674787105571756,13700129182684908369,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4144,i,10551591806522858361,12860787387129399556,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6772,i,11318374196436622345,15918468333022259295,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5844,i,14826897362475111649,1610784676108042711,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6544,i,15791807630838100847,5226451375014399060,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7215584713754624350,6339930927238932721,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,5030339302848408144,13060267558230779689,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,6636849548374131547,9121469927608443537,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,3426473811959123476,12755757848049831400,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,3426473811959123476,12755757848049831400,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6768,i,15634319500271036770,14274024125262549402,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6848,i,9213116849324521325,4642497270131621037,2097152 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,4778007318994003050,3151703698447598816,524288 --field-trial-handle=2224,i,3104489902794984311,15107071873359843177,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 25KB
SHA256 8f80f993e523f2e6c2d097552740fd26331658da23ffad31d26edcdd3aeec370
MD5 dae1850484b86d299c31bc08aaa563cf
SHA1 dca808d6d16965c40bfba4e4b3c8a819f843890d
SHA512 69b34f2652aa731ad29fe49a8cea85ebe4ef402573a10048598667f94b7a7855e534121f22d7749b81762b3176f437de607745df82b71484c4ab7c9f8bfd40e9
SSDEEP 384:nYOl9Z/81DjYTaXQMfCMNASNEVM9mYQdpx1sLt/zEkNKxgmS8AXACAU:pJ8NY2XQk0omjdKvKxgCAXACAU
TLSH
T19AC2E13F487A2046C71227F8EE5FC9B571C360A35AB32345C26748650DB0EA93F86776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 84KB
SHA256 5c5e0d52eb281e1ceae07f53c931982e8e014b9a535df9c98246157167e29285
MD5 1b0874b56457a14258e3bd22805266c6
SHA1 26ff3d095376d43cb78388e700707cdaf6ac75eb
SHA512 0d3023425d7d8a839940d39c441114335635704b43adde2b8d8fbe1a2e3a45e9e1e181c42f6a05b51ed98e22bb6e4a7ccf68260035a550bc5344542afff765b7
SSDEEP 1536:NEXBmkLoc+QejGS/itrb302ALfc39KHOPyDotE6cFSZeGARg+1LSOJsYJfza:IBMJSiiBEXGKHKyDOE6cEYGAR2OLza
TLSH
T1E6830236CB324A69D2A40BB68EDF3246F7758272D3F229D34882C9A0F4AD3155F4D4A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dee4e6fedb2df262668c7ccbd6649bb822a976d4e56e6ba6fb5fb64247b820a4
MD5 b42e35b1df390ac0331b52f87ca74a2c
SHA1 cf935f7d67d73cddbfb48e77b7dfd302e2461e86
SHA512 aa724e842633ff0b44a5021c42ad3bc36853d2db4e9efa7ab179f769c52f15dcc60ec5c5503a0dc1ecc754a3a879856636eb199785efa5cdfe57bf33433e97dc
TLSH
T19E8181FC2A5241AFE750C27A44F2C0183AF595E8F10FCED97E585D322553FA0C228BA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597dd1.TMP
Size 3KB
SHA256 dd09f7424bf6882cc5df7fc7e037b5902a98893a59d88dba3e867d023b3d1e47
MD5 11c36f09cbec1b92d813defee0eb853e
SHA1 3460df3b87616d3e80bfce4551d710d22d3ca75f
SHA512 3e2944008172fd612bdd7eed4ec41358fcce62092074c52604975629582c390f8a38b91c4d302a7dd956600a1ebda41c005616148a271c9e8ef2f2099d4f99dd
TLSH
T1A8714DFD2A52419FF354C1BA40F2D10479F195E8F41FCEC9BD904C302516BA5C269BD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_megaup.net_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d1929cc11d569e1180e26860a69cc195df4ffd771b4ffaeb96c5e5f3056b9195
MD5 e8d1b0f40302299c9d1a49df597221e3
SHA1 7129d5509ae6057333cf3465fe27b592e0caf671
SHA512 ce1370d1d875fdc222996672a101955d7d37abf667027959243991d3e6e9866b45316407cd0f6572cd509909f9f09b9865858c3aa8798f0bd65a285b994f4d68
SSDEEP 192:DhAZaRdnQ7sU0vGvxPgz5fsPG744rfTmSyFSWOvpOeiDiVkjAzjd9:DhAZadnQ7sU0vGpPgz5fWG744rfTmSyk
TLSH
T147029AF683E4866DC85552F05B24AE1ACE190956432C3D2AC9E8EE5FA3F2472D102B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 24221212ce49e4fbbdc43dbfb92335408a30fc6bb0ca317e1aba000c112f34cd
MD5 b9f5c11761825d128052c4cf7932464d
SHA1 40f0c21c50289774743ab28a2c3ff3747e496dc0
SHA512 b78c302914dc6b2da3e055ec7a262d5d58ba83a3b0e6e573a3042ed1663013348e50d29e1fa31c77e6aa90a91dce31c1b598d761fb3e25cea4ccfc92d9f65b3d
SSDEEP 192:sxZVR2yM/jK1Ml8Mks/f4sEc+IdpdJHW6+WNGYCkJJMdIgrJ:sxZV0Ms/f4sEcvzHbG629
TLSH
T1A542D8117A34A977CCCBE209FA557F53D6F95472A2940D44A9FCCA1C04F6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33b1c6173500ae4e41e66c04a1cbd01433f9408d4c80421110d3a2509ad08364
MD5 bdda23324bfa66e3a3321fb45597569e
SHA1 79a384e14f7309306163f9fb52559795d7d6de76
SHA512 2264e84913b48efd8b8f7bb2f4213ad5926c4e8c1d3a3d8eb1de9dcf761539e74081e45d701e19fbe00f956f395bf1e9b0f0983f051d091b37b199e906dc7d4d
SSDEEP 768:wt8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVrro+:wt8bqn+WvSCt6u1jaCZLbWVY+
TLSH
T19CD20B3B280CC77E4F845E5DEC266F966ED801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 80bc8a59ca0782d6fa760d0c99667c9ad91f3940e26ba02ada2209d3d3c1ec29
MD5 767f8b46821d84c93be94254cf154fc8
SHA1 24b1ca3163d4e9822e9c43973bae7db57968c3da
SHA512 49863f8c5ffbba35ac5fdfd3bf75f89fb4585a031413fd573ab82937d2e81fcceef7ff69addcfde8b93c19fe26073b9123592cc4255933caa2ff991ed513faf6
TLSH
T108A00269A2E44082D4880370A052C39462306810A511572574A541B9B9982405213466
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5966fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5966fd.TMP
Size 48B
SHA256 5cb7bc4940313c39edb9b24fc132d4159ace79c9f674fca09709a2816c7e8b11
MD5 b5a835af9358ae7c86258efc49e956ef
SHA1 04f97fa605794c1ef6debbfec8060a2b36853720
SHA512 3c0d8f1cdedf25ffa40ad787515584e0aa631353c14055d0f2d9e65e827349876b50e1f2f7936fad2b385053446c1698b164119605d94a29f1d8169ffe885ff3
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cb90c5fb9a3862b03c01faf6b33da67ff2d9c78a83c69179275056b236453f5c
MD5 7771f49e4c213abd405aacc2dff34abe
SHA1 3cf820fd07c3534772b121ea2d91e755bbe101b8
SHA512 f604f990d0bb15576677572b88829753838ac1b82fc2a0456f0dfa31a7d9b75f4e1bec209912f19062f2114a10e1a2de9c8dc250b9b949b06f4b341ab022d383
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdqTIl8YCeSgz:ynBtXt
TLSH
T1C991F022767B131238BE780DA65A873B8E5132E33859E46E77FD40510A77E212EBC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5973ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5973ee.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 909187fdcba04172d8b371d9c410e408f125e5afd6a7435f2bdc2504228051fd
MD5 6afe159a4cc27533d2c75b3041b7d072
SHA1 6ef4840f2f11340127c0a9680f3367f173ce2555
SHA512 628eb0fa2726539560b50020549d3121622ec172c2f49de4fb419e663a34595152bb48231fb4b80b39f6feaf5997fc2550e7d859e797ab7b165b090a351a3cde
SSDEEP 384:MZcIhsNAigJKJ7YsEa+UOH+MHv+5QiYYgXq3CMBu4:ah+e3aJOHZP+5NYYPjBu4
TLSH
T138826D726C78AC775CE6B245F88736178FB880A7D6D92B94D5DC9F0D00EB6AC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7939b3b3376a4b447a9325c7b50012653ba987a04e2560fc69b359ec90181b90
MD5 e5ac9824dc1300096108e538e3d51768
SHA1 ef652a0ab59b489cf6132c37df8befd6608eec58
SHA512 3bfef42ed02aef948adf57bd14209c9a8e7c0b3d9844954c503617563686692ba37ae4fdfb7c2feb18787ec6aae9626bccae2d08d25080ed43b59e6f636e003b
SSDEEP 192:vONJ6Db6QmiUyIs5HBa+joOmw+4sRgzCU6:vONJ6umHBa+UOH+WeU6
TLSH
T12E02E835683C6CB79EE26E49F88B37279F94203BD9966B94D6D81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cc2bad5ff75f44ae01bf65416e947e3013bafde492c79410466f7c5e38c8f6ce
MD5 0d52be1df967c2eb07a7aee9d92c969c
SHA1 ce7e8ce1be4a4e75c6b8cbd1167c4b7628794b97
SHA512 f5f0f5c3154bc59e56f2bae48dee56e6602bb3445988a830ba22216d7effddcff7adc0dffe7752a0628d163be0da6d9a09b797c465da0eba1d939927692297cb
SSDEEP 384:iiFiZcIKsNA8TUNTUlIlLgJKJ7FsEa+UOH+MHvp5QiYYgXq3CMBu4:pFQKZwgzb3aJOHZPp5NYYPjBu4
TLSH
T126C22AF218E79876D8AE5743A77E2D138EBCC0A3B5946690B7C85A0DCC971BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b3cea1d175f547c3131792c0e1ab05d6bfaf814f1bb932ede9809d3df3e55117
MD5 f77a4d4b24c886fb9c32382da7a7c15e
SHA1 e636dde993a04bb9082e42f251f60cb11cd5aa62
SHA512 deb14283caa75b61d0bb592a657ec8613f508ca4492db6ce107b6ec54e87e0256ad27badf4ea94c075d452466875ba06eaa261f2da5602aabef3c6a7f48b8ab3
SSDEEP 384:zZcIhsNALgJKJ7YsEa+UOH+MHv+5QiYYgXq3CMBu4:rhhe3aJOHZP+5NYYPjBu4
TLSH
T1EB826D726C78AC775CE6B245F88736138FB880A7D6D92B94D5EC9F0D00EB69C1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71957323d707cdabfb2a0652e29a8a21cb099aab473c55596a15f59263f272e4
MD5 f68b881e44514d1441f319d301123f47
SHA1 bcb4bbd45fc9ab1b20f23bb47997304cb4c8a1af
SHA512 46b307ad4e449792e55d41b61473b49ee54995faf9f0cf7bacff57ef106b964a12ed6703c0040a4a24923c6ae408da8b5490d87f6f397e2367c12cdc56ae7a43
SSDEEP 192:hONB6DbZQmiUyIz58Ba+joOmw+4z5FvCNzarqFHU6:hONB6/58Ba+UOH+MHvW5U6
TLSH
T14B123A36783C6C771DE27588F88736239FA94027D98A6B91D5DC1F0C01EF69C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 68da3ac9ca53b9588a97f3416cbc14e5ae7cc9cc90d09e6ad5cd341717e7b7b9
MD5 b8a4a9edf22a50d447146c60d3d029c7
SHA1 65326b0cba7eef1347d267ffba502f215655df9a
SHA512 9919b5afec4b0120783b34fd842a04f799117e7cbfb2c074c514d021126b82cf026e2c16d72f3bf3c8381816af9da1a1139e30ca3f1c1df2a972c001b7876006
TLSH
T19AE00206530040AAC0281274008327151BD2C020019203875A1142541C613402D20A40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bf82ded3dec50aadd054fb54267af2a0ad3d8570d3b39b8503211b6bd0f95fa4
MD5 2f05f3dcb501e64de32abbc019925333
SHA1 7080feaaf37a568cba35bcc9a3492c2b4b249c77
SHA512 df50213d5647e061e7134088da8d0a650d16a941ae053e54f606745d4864c52d8e7361275cfa92fc1e5991f8d677ff1e1f9e05dd565345f5b4dc48e5a9cf4b5b
TLSH
T1F9E001069241587EC43C127401832B350FC2802005E143A79B2542482D763803E30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 87978c4c244b8e3107c9e7480c82a80440c051d9f50e283e49e0d80a8afeea42
MD5 835a4a077edc661822447cfa4605e83f
SHA1 879bae115639bb38f0d9316e15b4619a47156906
SHA512 8dab57a94700e0dfbbce172526fbb0b1b8865cf32606d67627faf4cbd279009504597d3f46d1bba991ed6b6d5067a5c912a8d607d9403d4b532abe4997122482
TLSH
T162E002059340447EC438127400833B350FC1C01005A14397572143483D733803E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f529.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f529.TMP
Size 392B
SHA256 f824a0247b88ff9208f8627da008d1afd78f98e079dd8720d9c2a5efba7ca909
MD5 8129ef3ba80d7cc5eb489d4ced46edea
SHA1 ccc492ce959e42d34a7c42de5eed2d4f92d2ea19
SHA512 b3fff6c88078683e2f56817cca220fb83d447ac1af833f9c687a540a190d253ed364b9bba4a5d8e864311dc2d7bf5c2cddf6cc948d5802a447e435885f8dd78d
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da33890e04738136af03619c4cdb00f3406b831334a9fc3d802c983f2685ffed
MD5 ddf88f97047e3e10fb722f16ea899870
SHA1 7f5fb1e72fde1b0ebbdae8f6459de2925d96bde5
SHA512 b1303c4acdb1c8733695cf0bf76d45b3252c96a09cdd01a7a40fc62146462c3723abcdfac794f43e5686df107586a55e5984876bd67eec85482aefed14b7271d
TLSH
T1B2411899A6FD1148B3B37F5A9BF6686D887ABD772E06D05D10120D4F0A22E40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads