2813d42843fdd939c3c52f07969e65e3e360877c586047d0fd30513cc53c413f

Resubmissions

19/08/2026, 12:13

260819-pdp78sap5z3

19/08/2026, 12:10

260819-pcg58sap413

Analysis

user interaction
yes
max time kernel
111s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76a6d3a8-5f09-493a-a756-250950647145.html
Size 5KB
Sample260819-pcg58sap41
SHA256 2813d42843fdd939c3c52f07969e65e3e360877c586047d0fd30513cc53c413f
MD5 8a3ab21923ce73616ffff7a8fc4d9771
SHA1 3f61fb30adbe0f31ffe4f2e191f730aa5f084f3d
SHA512 b8d1061ebc484740483cbc07ad79b260d376a29c8ca73e8233f1db2bdbe877fab36ee4b1ca92b04c0415fb3baa6011066dfd9410cf01f64603db7cb130e021f5
SSDEEP 96:vkMw2efkBxY2QE/wJiN1sJs/6iYdHRH/eTRmytuB1XMHoMHVH/8:c2efkB+2QE/wJ61sJkoxfasmuB1XMIMy
TLSH
T1B4B1B5673DA8C4B901715687BA3AF10DFC5321175AC5D09230ED84AB5F30EEB8CABC98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3284	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316150645515690"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F9261DEB-A4F3-4047-82D2-9B52D36E3013}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	taskmgr.exe
Token: SeSystemProfilePrivilege	5960	taskmgr.exe
Token: SeCreateGlobalPrivilege	5960	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe
5960	taskmgr.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4928	4964	msedge.exe	88
PID 4964 wrote to memory of 4036	4964	msedge.exe	89
PID 4964 wrote to memory of 3284	4964	msedge.exe	90
PID 4964 wrote to memory of 4036	4964	msedge.exe	89
PID 4964 wrote to memory of 4036	4964	msedge.exe	89
PID 4964 wrote to memory of 4540	4964	msedge.exe	91
PID 4964 wrote to memory of 4540	4964	msedge.exe	91
PID 4964 wrote to memory of 5944	4964	msedge.exe	94
PID 4964 wrote to memory of 5944	4964	msedge.exe	94
PID 4964 wrote to memory of 5944	4964	msedge.exe	94
PID 4964 wrote to memory of 52	4964	msedge.exe	95
PID 4964 wrote to memory of 52	4964	msedge.exe	95
PID 4964 wrote to memory of 52	4964	msedge.exe	95
PID 4964 wrote to memory of 3676	4964	msedge.exe	96
PID 4964 wrote to memory of 5564	4964	msedge.exe	97
PID 4964 wrote to memory of 3676	4964	msedge.exe	96
PID 4964 wrote to memory of 3676	4964	msedge.exe	96
PID 4964 wrote to memory of 5564	4964	msedge.exe	97
PID 4964 wrote to memory of 5564	4964	msedge.exe	97
PID 4964 wrote to memory of 4552	4964	msedge.exe	99
PID 4964 wrote to memory of 4552	4964	msedge.exe	99
PID 4964 wrote to memory of 3348	4964	msedge.exe	100
PID 4964 wrote to memory of 3348	4964	msedge.exe	100
PID 4964 wrote to memory of 5472	4964	msedge.exe	102
PID 4964 wrote to memory of 2504	4964	msedge.exe	106
PID 4964 wrote to memory of 956	4964	msedge.exe	107
PID 4964 wrote to memory of 5216	4964	msedge.exe	108
PID 4964 wrote to memory of 2632	4964	msedge.exe	109
PID 4964 wrote to memory of 2632	4964	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\76a6d3a8-5f09-493a-a756-250950647145.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffa8dafc188,0x7ffa8dafc194,0x7ffa8dafc1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,2369264696423193164,13059639068669687506,262144 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,7963627100563814187,3831415094346228172,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,15893610916752421980,11231527754051007747,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,9918183345014165974,15008977047692289486,2097152 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,6776082640196990567,5586908050218150734,2097152 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:52
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,14397095295494600706,16874262190661561925,2097152 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:9
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,2735233219267902910,18428501268694251799,2097152 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,8135238364458097999,4847803370008868004,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,16073084610589551678,9836941099004002737,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,4143517509597163933,15092936408636668456,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,4143517509597163933,15092936408636668456,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16219577383461677585,7333052334762619472,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3274539286427722529,2487226987081355968,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,2188517818371815095,4831463350798140219,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,9002813861131565948,16295441904442558824,524288 --field-trial-handle=2240,i,11268010068982944529,16999023843309474548,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:14
  2⤵
  PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4724

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1544

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:4756

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:6140

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 30KB
SHA256 f4a93cf3834c5f3bbbab2ba619425fb1415050a847f5bc12cd6b0bab5e68074e
MD5 ca6e0dcaf6fe11e3b4d4d299ecbab7a6
SHA1 a637b13aff3baacc733eb221226c36b71a3d3a7b
SHA512 fa037f9ac77644d641bb6cd1b18722be3cd7d039738f8770d6a09cf7e5829b1602a772ab643ce8cd683a0d11e62c5ccabbd555fff25f77c39034793510543ed9
SSDEEP 768:6cTk8CBQtB21Xhcdn9rnKQlFCw4jiQAlMIOVh34HcD:TjCGmhcdn9rKkFxcnALHS
TLSH
T129D2F1819E540000A3E255A639CC5EF4F6929719B31F2EDF523879F108E747BA6B6C8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048
Size 156KB
SHA256 e9fd2101c51c4b18f3029adbdf7e150b38ff69e465bf1e0089d8abc658625478
MD5 3606ffe8f7e73ecf95216ef63d27a326
SHA1 5fbb82a19ef583a84616073ab9de78192d3ab508
SHA512 638d2aaebefcc90d573bc5a13dfd644c38a7cbbebd99b35405d231c0e30f0548f7696ea841bc0c36a6c7fb820538d70b59347cd6afaf82ab9374ec7d2b6daa02
SSDEEP 3072:afUFIej+aeG/ds9nzFg212Uqnc+l0h/cXkxV75EdluA:RF3aaeG/cW2icUvWrG5
TLSH
T159F313FC8826F6C1C7E74009EE3585E18A4DDC2055FDB5C8AE416E747CBBCE569284A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
Size 130KB
SHA256 29db9aa5e03272db021a276cb26e9340fe0216468612f93ca2be26148dba7584
MD5 dc773dbbcc153b13ab7de02cc72fc32d
SHA1 47d15f0be88bfa2e450a48475352786f9eb88f10
SHA512 65bfc9bfbe8bc0036b9c724eeaf31ee8117fa5de1c4ba42d11dfdfc879e4ddfd8727e3f1a60f12fd61493994be84c1e04b9628bd5e81b15d69c40c5defc35e6a
SSDEEP 3072:VrIImkEdWDqX0t7VnBfGruGHPtDfDKZaB1mGI/9L:i3tWWEt7lBfGrNHPtDGZaBY1
TLSH
T16AD312BDD3B577985F153025EC68C4B8071B9CAAECAC3D5C1F23B0F8ABE95197188548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 183KB
SHA256 548d406b084d646b5854d5f9171a75c4a5e8a5816127b9ea09435d090dd66231
MD5 b765f6183184b7c1b3cd78d85a9056f8
SHA1 49c0128ccd5a8669d280a9d3ad9bd2f7ee9b8692
SHA512 bb6189995f96a7aae4403e4836f6fa6b76cf07e8691e20771076231926b8608d6fa88e330d1d2b5bb3787a85ecdbe78554ac055b4d06b371e3b995b76a3927ef
SSDEEP 3072:QcZuvASCObgiEERjG4b0rAfEbl5Dxv68tYIzZEHub5jN66ErGzi6mqd2wx2bCaSs:QWuvFDCERjGbbxCHGAa6+i6mq1SC9lO3
TLSH
T17B041335C3FC246E07E625B00BACC325C67DE211988E95D8FB155BBA0684EBDDC274A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 183KB
SHA256 a4cf94fde47beceac54be46c41dd5102b35e8c60190ee5f84212e9ee2d253d52
MD5 2cea572d17490ec1be9bf76d7ce733db
SHA1 8ebe4b28961abe03e37595ef31c21acb7a79aa54
SHA512 ff5f2ce0511ed468411fa7906973522ae2514c2f270e02eddbb596de4f4bbdeef38ee768e46d0980c2fb51d8af3be11c7abf405d9937dc0eec981bb959aa52a1
SSDEEP 3072:0c/RGMMyxSFLDmtA9ulb/dhB6fbPwnzsuMkDwl40CRmKcaV6i12Q38W0NzTKtumk:0IGMTScm9ulbB0PwgIDwlSAK36iwd5+M
TLSH
T17B041366A85E1371D4FAA4B38B949A45A06F1E4110D0F0937A8F31C2DCE1B9F0A9397E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 151KB
SHA256 75c79a37c34bff59e8dc0092b922365a756ae606d41b6f22bf704495a2bc316d
MD5 1bb36cb605e998f5306e50c6621a4ff3
SHA1 32a9e122b321890109cd3d4626c8a0dfd0e8770f
SHA512 16686f3acb5dc42bfdb58ab721bbdb7284062a48952b36032f04929fd5b29592ee12987822f23270727e7f3f156b4ca55bb6322db9568c8def08d1e3caf9efe4
SSDEEP 3072:dvS8Z1xvA3DeaonAuQcYFaczczb8ig+Yl2eZGZgC3:BR+3InAracWb8hnl2jga
TLSH
T153E3134960F50A73EB9D63713C84947E324BF99A6952FCFBDB80272463A3DB96360016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 56KB
SHA256 c7696ba1693dec8f3629e207c85c356d115c01107f7a5ca998e4b2951772e97e
MD5 7c7cdbbe71b35aaca74a92b7b0d4dee1
SHA1 8be7d6ae9d7734b503bd0ba8b0f2b2ecfd6915cd
SHA512 9414b36b1b8a531fb3f6462f5a87247f5039dba0182225fdc3d877d4628b9dc0cef772a73f2bbbe559ebc0708ee572036e037ed2c5b5ee13069de12e648dfad7
SSDEEP 1536:wxh+dSsjgu11IWQFMXnoCcSzd8M/EAGvK3TULoc:N8s0u1nQiXnwMJxwLoc
TLSH
T1A843026418DBD1DA8503554D2DC63A78B0362B28871CF23307A59630AFD72AC86BFE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 104KB
SHA256 c5788038d25aa463b155a47c8027dc2db23500d8f0cd36060979dbcb1d68d7a7
MD5 d79f84241141400a1d0c270bd7cc0316
SHA1 72acc04dcc3469bc21953e0ae5d8a355559807ac
SHA512 8d68553043b8af913a9846dcb2be920f41f172a5c8eab62a9f0a02f0d195d016d908642963e81027e428265a1ee1c5bfd102572283e004dd6da92c49449321d8
SSDEEP 1536:w51ZsfflsStzF8NmAyLrt4tNr5VXaqR+HDg2o0MK8wJQucvyt4UdICTeEp8y+W3:wJkdsTUd4tN7Xf+NMbwJ1diCT98yB3
TLSH
T18CA312922DADB1E13CA2CE3E10508ECE66548160BC5D612FD439F9E7E72E7A3C573684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 67KB
SHA256 07cc3050a55895dd8da34863326f97c2711e22d0456c06f647ed196985d9c67c
MD5 f90f8df8bf96f84aafd972af61d99b6a
SHA1 44ed0329eefd09b5579843be3f0bfe475f6881ae
SHA512 682c19df95758e4d103b77b2ae627a42c089fbb5a14c36347d8a0bac65d98f803324831915d04faaaaaca30efb8f6d45f921b0abe867ee7d17c92f46707f3cd1
SSDEEP 1536:LaqIIoR2KgRvvnSFyrLIOfzqpMziaei3Db1hle7S69:7IzR2jR3nVfuWmLi31hmSQ
TLSH
T1DD6312F1925A58C77F288DF81C74BB378C0A009AF346A8CA3161B8779175EEC453969F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 27KB
SHA256 13f9479a6c0fd97ef70349ec97711f01378711e508c9023dc0079f34aa1a3bfd
MD5 ea60725c47c067920466a5cdd3b0672e
SHA1 41fa6fb8802edd8e41a3e7fbade45e2c9f1bb6f0
SHA512 99c631474f1aaa7a220addf6ccbb3e7f94b41acaf5293e1f5ff7fb6fee491d206de6ac8f6ff71f846210f7b56f1fe3d128aa21cf97b61f7503f6a4728874a47d
SSDEEP 768:TfrJvlIhd9Jn5qQHWvadQ1KvwPulFzZD66sS4BD:TfrhlIL5qa2KvFIP9d
TLSH
T120D2F062AA7B1411EC12E04C6369CE936A0B3AFC73D409A1F550CAAF0273DDFA0608D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e12ebc65dac60c893c710843275e25071431826b57698accc6a178ecdcc73296
MD5 69cfe97eb916a8644ed354ccbc885243
SHA1 25f35187773bd14a5b23c03e2ece36c543ca8c7b
SHA512 2fa1e3a32b32db86df99eb666d5f99b9a9e4c039b2107b5cb73432a6811f70f4213bb10a83aef4bda77f99d267255f64be0c80b56ecc03f87135919a541ba766
TLSH
T10451A86D233F35CECB7441B994E4658532F4A45B8AA7EF22C0005D7A59D6F10EDC9853
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599b5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599b5c.TMP
Size 2KB
SHA256 9c3b14311f6b2dfbc08216f12aa47dc04811a38baed4f652f21b6141b9d7a96a
MD5 6cc4c932c05425da8bb15dbea1796fad
SHA1 f69fc1e7b5c7bbb8250256c751f399de2ebd14d5
SHA512 f28bb72732e550483f67a7159445dc695dca55b715baca5da63a215b477aa8b1eb2a7113021c75e3613e328e824069aba2ec1cceeef10d0bd8eaaf3e522e17b4
TLSH
T12351D96D237F36CECB7440B994E4518932F0A45B8AB7EF22C0001D7949D2F10ECC9453
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 aa24b584b87bbe45b12dc4125d1aa419fba51dbb2a058cc97cc68edd3626eac4
MD5 544a25504154ede748d5b802c9377d3f
SHA1 2007cad6666f16056b16f554c7845b3ca1595d8c
SHA512 fa1cbe15f51ee43cad9890e6c2f71085dbf313d330ab3de33efb0c5c560ae117314ca6c996fc8f29b1bb93d089179be31b6981f98450621c2a1c848a6f95b2ac
SSDEEP 96:DEOxE5wXaVaiZjhqzzGwB/uQZKZ88Zw/O7xxzbV0:DPxE5wXaVaiZjhqHGguQZKZ88Z+O77zC
TLSH
T167B19BFBC3E8837E991156F0AA256E2BCE2D0556432C3C5689F4AF5B63F24B0D10169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eaf75c8a9d01854ed62569cb928d9e65bc52a2b887e7f1dbcf9961748b3a0422
MD5 c27d9deaa2a8ffd277fbfa47166e8631
SHA1 36d9b74c5c2d6853c6e923133d178e96758c55da
SHA512 52d60f78259a56f04feb136c18a95d51ac7a6938ebcc6195936e719ddb41f4460bca24488fc3dcf58988d1a963a92509ed8395bdb364727f91bf8356276fcf0f
SSDEEP 192:sxRHR3bT/ftsgbRDde5lS9zoD8p4t/g6+WNIYCNJVuOQGIsuIgIJ:sxRHhT/ftsgbRc5lMU/5IVv0sGs
TLSH
T12532D8155E28A93B8CC7E25DBB65BF53D3F95032A1941E48FBFC861C14E6ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9cbc4e1a2ae90875d2ef5bcbcfffee1ea3a7690f9ef57e0743a613d4f8115570
MD5 9828ae4f2e0f47ca115663ffa789c0bb
SHA1 6f0cd332dfc087980af592568fee44078bfa6e9e
SHA512 c9173a6c252800aa9109f687fbd7ed05f2a83585af47095e934d751ad8670667dd02175d2b7f7390d073b694230f4d784400e7e32423d528c869554a584e984b
SSDEEP 192:sxRIR3bT/fts/lb0Dde5lSKOMzoD8p4m/g6+WNIYCdJ3uOQGIsuIgDCaRJ:sxRIhT/ftsNb0c5lNOkr/5I110sG+ab
TLSH
T19F42C7159D28A93B8CC7E25DBB65BF53D3F95032A1941E48ABFC861C14E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 58543fc53e7d541ec6c6620447333263a815ba46ab078e7961cdb42f1edfa429
MD5 846702224ee00118395912ee7b799b52
SHA1 a0fd67789a78aae7f4fa1564c8e8fa0125575041
SHA512 fbed40fdd232d96a7df719ee6d706e5404e0982a9248932231e2b14f544f3ef3ca57a935a216ec1c1b21156bffd814be9ae5b4b28dc1032fc33c8ee01cb3821e
SSDEEP 192:sxRIR3bT/fts/lbRDde5lS9zoD8p4t/g6+WNIYCNJVuOQGIsuIgDeJ:sxRIhT/ftsNbRc5lMU/5IVv0sGW
TLSH
T1EA32D8166E28A93B8CC7E25DBB65BF53D3F95032A1901E49BBFC861C14E67DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 76b2359a2ed1e2492f3e6a21a8703a4b3facf222c11929e36a25a694499b41cb
MD5 8627a4a3e681ecd182e7efc9253a5535
SHA1 47dda8db9214485e5148aca3bdf13149d221f4bb
SHA512 8423ee84bcde6b1eea8eb9e0455dff9d603ce9db37c879bdc3365b79842affb52a91af87f411c44d6b9460f9182bb934c0b1c59797bae83a46c6e657e04489db
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRv8roZSQ:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0V+
TLSH
T19DB2DA2B600DCB7F4F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ee74201fa7f2affef4151c6e80bccff481b8b8d026744a0483aa63392405003
MD5 4a781cfe886778b022f91d610ad4fde6
SHA1 681884996d2bb4bbf924a33a38fb1c9b78d1568d
SHA512 34ff9bdd0b4d7a7d6598970027d49f1e9c7b7603c9171fcbb8f44e0efee6c2a69debefb56c4163614ce44da19a4803856182100b4022c4d4afaddbd6a8a61531
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrzKtZ+D8/gS:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpD
TLSH
T12C914111747A03843C7E652C94BC896ADA8174F3341DA92B3BE841960F67E425EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a2fba29bf0ab82d4e9fa4a7be9d9bd9832a0dca9081d274713c1db2dedb4280a
MD5 d7721c7f744c3df0dc0591e4e70ae8b5
SHA1 a476d1595809b86d2ac2b1acf431ab057849a6ae
SHA512 990b26b085e6b6a9f3057a13689af9857013ba9b3744165f10425879235f2a44a48002b2b47118b6d68c108e5233c5c7cb95c7b8d709c54540703736431bd719
SSDEEP 768:Brv+4UNbdD3otpptGNp8+p3bd66j+4BRv86aLITb2bwCl1:Bbsbp3XL8+p3Z6n4ym0ww
TLSH
T17603BE73E96899339DF2C684B1467A437FF851A396C10AC0E8DD2B4E409B19E230F977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ce1ce4e23852b8c517cea040d1f385aefb5053d224451b638f8bb97142916f2a
MD5 da9d66bb8a7b65dfac5211bf964baa9b
SHA1 e1d2439f08fa8743c152d6c27e71d84038bdd355
SHA512 f34228ba7520ad3b498514046e4f936fb1f8d697429443c64a0a41e45da8dfcdf4df047a30117d2876e1a30b2c14d83c7fe1908582994eb787c6cad67545a12c
SSDEEP 768:wNe3g3TpptGonp8+p3bd66j+4BRv86aLIWbftG8:wNe3g4op8+p3Z6n4yBftG8
TLSH
T18AF2BFB1ECA49D338CF5C684B2463B07BFF5516396C41ED494DD6B1E109B2AE170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 56fd7bf7954ade981eb190a06ddd90c41a2a3a37cca092025fa269dc993f849c
MD5 46545e0de828a3ea7f3be53bdace25ae
SHA1 db3e562edefa75c0ae2ead30b927da48e055c963
SHA512 066b275b695d270ea9c9cba4dbaba64bfbab015b478e5699f10a451dc329b03cba10def01176d894483a10d79ac4e7f77af2432737953cdeac42037f11f8ca22
SSDEEP 768:Irv+4UNbdCe3NmTpptGLp8+p3bd66j+4BRv86aLIWbftE:Ibsb0e3NTt8+p3Z6n4yBftE
TLSH
T18703BF72ECA89D338CF2C684B2477A477FB8506396C01ED4D8DD6B5E419B19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7b1531952247ac741eca879a6e6722f78a6da15e90296f17beaf328b52442f89
MD5 f34150637979d33ac66daee76739d030
SHA1 0239aca01f4a430a813b28e62214db3e595ea362
SHA512 7498ffcea4583525016b30e1a06a5aefea11d2efb5c1e5341a3ea7d657fb2e15938b5a3201950da513c745c03274f452de76b530e8332e9c7ef55dada982841d
SSDEEP 768:kNe3NxTpptGonp8+p3bd66j+4BRv86aLIWbftG8:kNe3NKop8+p3Z6n4yBftG8
TLSH
T180F2BFB1ECA49D338CF5C684B2463B07BFF5516396C41ED498DD6B1E109B2AE170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 65908cbfcfc1bf4e2a9f77442b6a1ca123913a8f5e852cc09528705a9b6aed9b
MD5 487bcceb959c78c35657b39ae892d777
SHA1 3c220633b2a6be6cff362c6ca80e66c86f09aac1
SHA512 b223ab9f137ed9a825fcfa13a9d430b9f45d83cca9147901f8314b96226c060a537655ad856c418f50348ea0c451035fcf8bbecfb115d3b625eb0b4aa6440064
SSDEEP 768:XF413GwgB3TpptKLp8+p3bd66j+4BRv86aLIWbftG8:a13CQt8+p3Z6n4yBftG8
TLSH
T1ECF2ADB2DC98D9379CFACB84F6463707AFF14163C6C06AD4A5DDAA1E109B19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 21f44b13cc8741bcf1c7a89cc5972469514ccff0cc6e3342e641f7624d6eeacb
MD5 dc66e635b9e3fe898faa683dedf4147b
SHA1 21b912de26c0b343b7bd803e5a4addcda9b3dbc3
SHA512 0949b8b84b1a3814c526d76b361cfd7c45e1e2c9fda7c7772666823d27b5806a93ee9c6a24d80721bcb9a6f83c6389fb2e62e9d9de54ab2f310adff04e433b68
SSDEEP 768:Irv+4UNbdD3ZcpoNp8+p3bd66j+4BRv86aLIim2bwCl1:Ibsbp3pL8+p3Z6n4y40ww
TLSH
T1A603BE33F9A899739CF6C648B2467B433FF851A396C10AC4D4DD2B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87c61e90-3205-48ca-8306-ce35f01c04e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\87c61e90-3205-48ca-8306-ce35f01c04e2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5960-331-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-340-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-339-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-336-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-337-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-338-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-335-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download

memory/5960-330-0x000001AF62C70000-0x000001AF62C71000-memory.dmp

Download