hxxp://steam[.]onl

Resubmissions

20/08/2026, 10:19

260820-mcj9gsal6v

20/08/2026, 10:15

260820-map2ysal3w3

Analysis

user interaction
yes
max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://steam.onl
Sample260820-map2ysal3w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2200	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316945655935583"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{260C5A89-3260-4A50-9D6E-FD832A9B8095}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1228	3624	msedge.exe	84
PID 3624 wrote to memory of 2200	3624	msedge.exe	85
PID 3624 wrote to memory of 1704	3624	msedge.exe	86
PID 3624 wrote to memory of 1704	3624	msedge.exe	86
PID 3624 wrote to memory of 1704	3624	msedge.exe	86
PID 3624 wrote to memory of 3004	3624	msedge.exe	87
PID 3624 wrote to memory of 3004	3624	msedge.exe	87
PID 3624 wrote to memory of 4216	3624	msedge.exe	89
PID 3624 wrote to memory of 1876	3624	msedge.exe	90
PID 3624 wrote to memory of 4216	3624	msedge.exe	89
PID 3624 wrote to memory of 4216	3624	msedge.exe	89
PID 3624 wrote to memory of 1876	3624	msedge.exe	90
PID 3624 wrote to memory of 1876	3624	msedge.exe	90
PID 3624 wrote to memory of 2284	3624	msedge.exe	91
PID 3624 wrote to memory of 2284	3624	msedge.exe	91
PID 3624 wrote to memory of 2284	3624	msedge.exe	91
PID 3624 wrote to memory of 3492	3624	msedge.exe	92
PID 3624 wrote to memory of 3492	3624	msedge.exe	92
PID 3624 wrote to memory of 3492	3624	msedge.exe	92
PID 3624 wrote to memory of 4436	3624	msedge.exe	96
PID 3624 wrote to memory of 4436	3624	msedge.exe	96
PID 3624 wrote to memory of 4436	3624	msedge.exe	96
PID 3624 wrote to memory of 1724	3624	msedge.exe	98
PID 3624 wrote to memory of 1408	3624	msedge.exe	99
PID 3624 wrote to memory of 1724	3624	msedge.exe	98
PID 3624 wrote to memory of 1408	3624	msedge.exe	99
PID 3624 wrote to memory of 228	3624	msedge.exe	101
PID 3624 wrote to memory of 4088	3624	msedge.exe	102
PID 3624 wrote to memory of 4088	3624	msedge.exe	102
PID 3624 wrote to memory of 4088	3624	msedge.exe	102
PID 3624 wrote to memory of 1308	3624	msedge.exe	103
PID 3624 wrote to memory of 1308	3624	msedge.exe	103
PID 3624 wrote to memory of 1308	3624	msedge.exe	103
PID 3624 wrote to memory of 516	3624	msedge.exe	104
PID 3624 wrote to memory of 516	3624	msedge.exe	104
PID 3624 wrote to memory of 516	3624	msedge.exe	104
PID 3624 wrote to memory of 1224	3624	msedge.exe	105
PID 3624 wrote to memory of 1224	3624	msedge.exe	105
PID 3624 wrote to memory of 1224	3624	msedge.exe	105
PID 3624 wrote to memory of 4340	3624	msedge.exe	106
PID 3624 wrote to memory of 4340	3624	msedge.exe	106
PID 3624 wrote to memory of 4340	3624	msedge.exe	106
PID 3624 wrote to memory of 1720	3624	msedge.exe	107
PID 3624 wrote to memory of 1720	3624	msedge.exe	107
PID 3624 wrote to memory of 1720	3624	msedge.exe	107
PID 3624 wrote to memory of 3528	3624	msedge.exe	112
PID 3624 wrote to memory of 3008	3624	msedge.exe	113
PID 3624 wrote to memory of 2448	3624	msedge.exe	114
PID 3624 wrote to memory of 4832	3624	msedge.exe	116
PID 3624 wrote to memory of 4832	3624	msedge.exe	116
PID 3624 wrote to memory of 4832	3624	msedge.exe	116
PID 3624 wrote to memory of 808	3624	msedge.exe	120
PID 3624 wrote to memory of 808	3624	msedge.exe	120
PID 3624 wrote to memory of 808	3624	msedge.exe	120
PID 3624 wrote to memory of 1672	3624	msedge.exe	121
PID 3624 wrote to memory of 1672	3624	msedge.exe	121
PID 3624 wrote to memory of 1672	3624	msedge.exe	121
PID 3624 wrote to memory of 4708	3624	msedge.exe	122
PID 3624 wrote to memory of 4708	3624	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://steam.onl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffe8ea5c188,0x7ffe8ea5c194,0x7ffe8ea5c1a0
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,8180471004242026145,1541538231280164724,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,10514083807026524750,8866491807393645792,262144 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,3676386263369482913,661372341379681299,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15589812784367687145,12992977278665259962,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,18234994917583765680,16490852521417631322,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13939454064265009561,13418134327517094079,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,16430438927145349828,98054308934580542,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,17970682836184192062,16136953167167032907,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,2088279469146001728,11313044827970315253,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,7696061056878358564,184561894236235297,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7187240720451765959,1901842403683259420,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7187240720451765959,1901842403683259420,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6316,i,5621368436219410489,5996282942296483994,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6468,i,16833208399015065298,9626597759466934246,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6560,i,2946145990830138990,13303331035049506689,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6796,i,12380382551764865720,13575175846921925251,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4364,i,12625669733111915131,17088625066245536569,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6656,i,11263128615265802095,10356111897108549868,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10860509282748104618,7119426820975668335,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,7705504893657836940,9551588026468630792,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,16451823403011132363,472820936213011041,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6324,i,1321307368823132221,12356998085243886728,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6932,i,4759945104184356857,9300404151441907445,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6360,i,8492936025527352613,14479665621477176918,2097152 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,5515492353152222962,16066092079978365397,524288 --field-trial-handle=2372,i,15464240302045801101,384259424891656236,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94596abc-592d-4be3-97e7-fb323bea15bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94596abc-592d-4be3-97e7-fb323bea15bb.tmp
Size 392B
SHA256 6305a90c6caf1a22e3fdb02bf4a0229bc252b62f8049e6e9acd9e810cb98877d
MD5 8707095a39e04693e3bf7f5fea80d6e5
SHA1 d21cc932dbe274654bd8cdd58e297ac42aee0290
SHA512 a794c8ff1eaa777ef75de9fe7dfb4ed7ce6334142d3a0c7a2ec98c51bc1cfc5e6d5ac4b3add8b27a9c75959aed545833c07b67188b68aa2ec63ca84dd37ab286
TLSH
T1ADE002035300109FC034433440D31B307FE3D1701266434B5E2101AC1D223020F20BC0
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cac55920f8823c4ceaf21e9df262ea5144feec125c060a5abe9067d5317a32d5
MD5 758e232e0cd6d9a81ac6d391eae4c336
SHA1 87b9bddbaf74e9eec5f3f50faec56838c804652d
SHA512 070c7f645a47bcff78d2d6cd584b80ebb96040ad737531962fdbfe7971fda7ba4ce3ef9b1d1ab66f8279fd13535f41075f904d2b233a1a35c9f128131f7dafbb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7i:fwUQC5VwBIiElEd2K57P7i
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 aac5e1cdee1993e70c63ccb75926ae86c0367dc166473df35f1c2c83becefcc9
MD5 e0c064fcd6fb91c81fee17d43aa3a767
SHA1 8021e1ec1412dce5e4db607b3555585e95d9f9d7
SHA512 9c61d5968e3a68019c57435955b9a85885e3fcc309fc527356345fd99fe311cdc477397a3cd8307132db9edaefc1ec8f3b35599cf308de0fe41b8ed55d2526a4
SSDEEP 96:iIsYI5LvksWunHGZfljy/QGGQ2/A9WKPwD8fgLNxaONR4bT:iI5IB2yy2q6ID8AxR4T
TLSH
T10AC15F3902CFD09AFB91C93189C10E19397E9483468F8F9BC36774FC5602B866063728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0ff0d6c3baa745078c900d104a0263fb67804d02e78bb761e1375d34db362ba7
MD5 d935a1a6e42c1eab29a08348af4574f7
SHA1 4ca8b99b232a97010c36bd51412dc624601c7bdd
SHA512 377f256c2ea2f0f00552f64347cecc2163089f32ad7cbb89cd3231631a2d0a70b3755a75c024b9cd433cad13019d5cd0185c27768253ca3ba9bfeecf9a16c0d0
SSDEEP 48:gsEEqtwsYjTwbiSKtthxj1mNs5gEAJkVYQNq9oUP+loAjtzM/wsvQoWe9uiLn+4G:ahtwsYAKtHx8Ns5pN3fDja/wKy4fXQb
TLSH
T10291B43A428FC06AFB90C53298C21D0D3A7E9093478F8F56C3B335FD56067979263A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589f48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589f48.TMP
Size 3KB
SHA256 ed6802c8ca7fe143e12a9d024d83e169d9679bd2a433476d315ba978cdead07d
MD5 a82a50158e5907bbb26ca27829004b4e
SHA1 5f4713c3f4bad3c88f2e73ad7b12001b85630202
SHA512 80774f56cd93f850a2438e4f3429c22d349a552f32ed33546e8eff33705baed873a33d886b52ee255ab46044a7b02b14a5003791770664a5ef8d7f441de28fd6
TLSH
T104612D3A028FC160F3A0C572E5D11D0E3A7F40970B4F9EA5D3B339FC951ABA595A3448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 63c73382b65c8838f36af53b3e5e5fa5848ce379a871727e795997f30a418f07
MD5 eb98913571d089ed56011fa632082525
SHA1 a8a2d2b4130ec0d5b998b7aabf7a52d1c80578bc
SHA512 7461f47ea6b90b1c7aab417f8b437cf9f826c56a51190ebf0dec32558fc6a4799878cfb59e88d57e2dd848b30333919968839d2181a3c7d4b0f97eb0a816ad66
SSDEEP 384:DYEsLukVsmJj81fWOVdMcuyk11yiu7vNSTGSfFbZ052093ItuX00vQqVro2+A6/N:PAvlBPjh6F+b
TLSH
T1AB726BB7C3F4A62DCD2256F0AB156E1FCE590914936C3D2AC9D5AF1BA3D2870E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a518ba946650d5a713d9048568b2ead9236c55ecca088c795d0b933651497a80
MD5 355d60f18ae4fa0e2f6de701541b1572
SHA1 5fc61c20a3a798a21fd0704a71032cf4483d77cd
SHA512 a56530fa1988579ed4b3ab663c2b5ed6a43cced4f1f563b22bb91cea4aa74c34e941592a2f19c413576906a6af3cb1a81b96cbcb5e396dc1138adbbc757bdcc7
SSDEEP 192:sxZvRnyM/jK1Ml8MkF/fVs0HyIdp63HW6+WNwQA/YHhQofZIgrJ:sxZvxMF/fVs0H7QHbw/Q9
TLSH
T18152D7166A34A977CCCBD309FA55BF53D6F90472A2901E44ADFC8A1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2acc55655f7f368c67703e1dc0515fec651f13272c0a681dcb6eef5db1925aa9
MD5 48a40a746b91ae9a11cfcc6e994f1833
SHA1 c8670d2501328987dccdcd7cb940a6f2cd1ce2bd
SHA512 9899c0d95cd8316c95da07a828999fa3e539f6b59fe63bbddefe0831e2910756b43def6947b1e0a73fdc48c9e5fcf50783541fc2da590559b9a482b57709d334
SSDEEP 192:sxZ1RnyM/jK1Ml8MkF/fVsNag2dpM7KV2sENFybH+XRHW6+WNebiMd1nQA/YHeu3:sxZ1xMF/fVscgWchHbE//ml
TLSH
T13262E852AA346A778DDAE259F601BB57E2F5043295901E84AEFCCD1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8df303c7a5ec9ec15f93c8078e9535450c749f0229cabd56b24942ee447337cc
MD5 2ab607ff68e4d461aaec5232b92f295a
SHA1 94baeb4b36b11561de9117960e0cab3346cc9791
SHA512 bf061c3654d392fe68501f3474e5b9d1ec515880429b84b34ba81648a6681863dc69af74d51b5b8582f9abdbf91704b4c314def2bbe423b67a6c8e219ff9cfb7
SSDEEP 768:yZUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RJroVg0j:yZUZYTMWvg0Pou1ja7eLZmRiJj
TLSH
T10BD20B2F280CCB7E4F844E9DEC2A6F967ED801CB5A584D544BEA884C03C77EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4de6a1352ce5cde3ec0469f5b48e70c64b938dc0b171f0fca02f4e216d4fafbe
MD5 3352221b83137a56821a574afa19aaa9
SHA1 4b475eec66035da15b6ff3f5e37eb342d1f125ce
SHA512 a89e743c3c1cfa5f865036523c4d2f3a79539bcc52903bdc5d81f5a399c93478c234e7b55faf533e3eb86466cea55335483e0ecb6f853e39290fbab5e4b49741
TLSH
T1E3A0023915D40441D00403B0E14545A432708820490F135254B504E988D47C08222105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592afe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592afe.TMP
Size 48B
SHA256 e1ff4e3bc6e31f29932308b2ab9507c3111d8325c40c7a3652c12648d56e473c
MD5 421a3e2aef74b0d6716ed0db6bd859d9
SHA1 3af941008e7738019e92ec83a2c4b6afe0b56c01
SHA512 710f5d79c448f0903f14eba53887605573ce0ec813017c0f2cee8025117ed5d8f71e007a8433acb803c3f99f44856c50d3532fc4ca47be1c23a5975ae48281bc
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 8KB
SHA256 7ecd65d8e4cee97d90fd0b71aa751993f2e84aa77d82205975b67ed568be68c8
MD5 57dd9d2d8aa5d70ef77f75e51cb6ee7e
SHA1 7b7ec9fab6f384232d86d38c5d173704ff0d06ce
SHA512 7d65b7442bd15553b130f4761d8874118fe5d611710ca422f629d5ccb79e1ec1abd2b538648d420da168d9dd2ef11bfb2f8912e07044fe596114858fc14cc910
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+0hTKK8k2OX:Ect51j5bRVo
TLSH
T193025A1271FA13013C7E260C8194D62B6E45B1A33118A96B3BAC10B74E6BE219DFFDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e971.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e971.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 10d7ee15727f09ba793dfdb7e6a79b56137cbed7419216e7f14f0133d9947535
MD5 055f6f7721f4367ad84727123a805651
SHA1 71479e5466f6bbeb9e8abfcb84141fcbcbc67f63
SHA512 a97928472647cbad055e1c6534382f4f4637d0fcc600c6b0bf940e77a6ec25422877c1254634fb259e6f0751c6c99c787873260431caf0e32893f0d517187c10
SSDEEP 384:yiFiZcIDsNe8TUNTUlIlFHE9NdtzX5od+W8yLXWXjivIpNhCop:5FQDbwg4FOtWTi4hCu
TLSH
T138A27C734C68DC7B6DF6EAC4F54A32139FB84067DA89AA90D6DC5B2C009A5DC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02a9f3ba54bf417b2c8048746cd7cac315429c862a235cb23bba0ef1605d2aa3
MD5 63da4ac3c47680773c1e6451e6a1143b
SHA1 350899b55da5485b379d55f09f47e745ec018a36
SHA512 c4cacedd0bbe0a824309da70cbf281f19e1c2472c00cfa36c3ca84e7b1d0a77ff9d859c92736baecc72621ea70c0f49128dfb6f4e83561a6be0272e8d239c331
SSDEEP 192:yON861VWQmiUyiDgGX5Obd+j2jzoryXm0/a23mDU6:yON86WvgGX5od+W8yUfDU6
TLSH
T10802DA35A8687CAB8EF2BE49B48737135F982067EA556F84D6E81B1C00D769C2307C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7d825433f83b991e27c56ffeeb485662cf9e5ffcbe3a703d778ac147171674c2
MD5 564c33bfbe52d95a814ac7d2bca1fa2b
SHA1 6022c24feb1b0cc3d6dc159ec610fbf942e69a54
SHA512 782f22ac6f1efa22567736939ea9e2e0ffd3a397d315f53927667676f62551f39bf9848e8cbb3478f437f8f0d9d88cbebc500b39368f543b3bc416d0dff04442
SSDEEP 384:hZcIhsNOVHE+Ldm2zX5od+W8yLXIXjivIpNhCop:phPmqOtITi4hCu
TLSH
T1C1827D319878AC671CF6F1C5F58A36179FB88067D7C86F8084EC5B2C019A9E91317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d236a63b9edb662167193bd532b6e332d332f224a46d4435c747e68502668b0e
MD5 5990819d29c72a6458e83e7be689fb80
SHA1 462a8ad8b7e132370734d512dcab8d86199f2276
SHA512 5e2786f03b19385d59449b941d5b27fa6923558c6db55b58bcba386a3262dd85ab4feda025de8c59cf5a882cfcdfe5654e035246798139c8303a8855b99a1a0d
SSDEEP 384:VZcIhsNOFHE+/dtzX5od+W8yLXIXjivIpNhCop:th7FOtITi4hCu
TLSH
T147827C729878AC6718F6F1C5F54A36179FB8802BA7CC6F80C5EC5B2C019A9A91317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01f38deb55c5625b28f0929987c99524622bf722b798561aedf11cb8b662e765
MD5 83e03490cbc5f4724080b85001c2a458
SHA1 3062ed17fb0708e66be07e20870a79c88644a3aa
SHA512 9a65e0a491f924465cf6947505611e2e898bf3c56e0590a54c5a8be3c3d0c810030009c1e81d1dc4bca50f8e06dedaab0ed4d85d41f12a422cecacbef435b87d
SSDEEP 192:/ONn61iWQmiUyNDfGX5Obd+j2jzoryXmOXY7xjJcqRjU6:/ONn6rmfGX5od+W8yLXiXjU6
TLSH
T12A12E931A468BC6B5DE2B585B48736135FA9512BEB487FC0D6EC2B2C01DB69C131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d21e24de8cd09cf13a0cefcc2f18d807747be64612e53f02b6102749ab2edab8
MD5 7c1e1bcfc29311ed4d02e7cc33f94719
SHA1 be23ce19d24a1664d71631c43469211bdc8c9c10
SHA512 803ddc7daf092a2231257e2662784986b09856bd80c166976469c547a10ade4dab022afeaf719a06a270643eac9919d1762453b1b38cece36a77b3d583e00c67
TLSH
T19AE00902930020ABC038433850E36B21BFE2D1B117B7434B5B2201BC2D633822E60B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6786a408cc3f7889655c92b5b0414deb5e46656d9aba4e9d5fbd5b2a3b7283a9
MD5 a0b905d0c0058d1db5af2697caa8968f
SHA1 814e0ecb4c9ad9f90e014675a40d18809cf354cb
SHA512 336ca022eea11273ff5d490f8530ec2dc81732bf4eed6c10e2453bd039c308afb56139abf512055d64c93a03970da0bbfaa62b79450c9f93b9a44c0b3b5380c7
TLSH
T172E00102930020AFC038433450E36B217BE2D17012A6434B5A2201A81D623020F60BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe585aec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe585aec.TMP
Size 392B
SHA256 bfb60a70cd08d4fa983b89b71c2feec8eb283ea655206414a0bafa965987dbbf
MD5 d7c7c07a76c0a19118dbab3088adfa93
SHA1 4638b48c6fbb7cb628d118332a6e48d69840464c
SHA512 901850a00976ef57aa0af1ba02ef9b2729939f0469670cecfad09881472389f8d0d0b69c43664402c2a3d681ef5f0d2590473e87eab61117c17a4db5c507962f
TLSH
T146E002025300008BC020433040D317207BF2D1701327434B591101B81D123010E10780
MD5 SHA1 SHA512 TLSH

Submit Download

ed5cf269-271e-439e-80f2-c84884d78d27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed5cf269-271e-439e-80f2-c84884d78d27.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ce95d3654bbd49c7c2270d59ebfcc5bd8de62ece08dcdb7819ce8457575e3b6
MD5 58a7e04af8e0aece189744693e97b931
SHA1 ae9414d26228d9141776b37620f620bb4bb8bf62
SHA512 20b9582a55c7c254ca686b1579d8957201ef2f655737c72cf1daa29512438c91978eecaeee8749b28c2cab4e57d5bc5a377d1da13d592a6ff1dbc2e6fa6dae0e
TLSH
T13241099CB7F91048B3B37F5A9BF7996D487ABC762F46D45D10110E4F0A62A40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 20fa0e788f0ca6847a43cb32440f9c4b69395cf9811e22fd0dc133a243d6f99e
MD5 f8e62a76870470c72b504d29fcbb864f
SHA1 c3574b9db7412395783eb5dbf91e48b2a0fb84a0
SHA512 87a126b5dbbe1640c96624f9b5b4ec06934573ba871aa1b2e089fe3907f1b88ee64107204df5fd15557cdb0eb0e8561d3a1cbd2ada01fab1861598a7d79bb90b
SSDEEP 96:CcJRQaemglIw0hemglicJKskb232wvyopJE3u2AOJruDr3JnIut:FwlxsoxX/ZCKsB95kBIs
TLSH
T18432EF546BDA265AF3F7D971EAB62720AF36F9029A048A0D408041091C72F05DBBEF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 f45146450fb077e32cc993fc6961a44f5c3e004066b05ebe52ea4b480bb08d17
MD5 1ddee141d891e3d3bdae98fef5303e0f
SHA1 c4321b4a0a13b9398952f49c0fb81c37b7d05021
SHA512 f74493345bb3b4e1386e2e793e1ba201c6488589532ab4ee6e774cea580bf5e045362878c47a0eed33b39a8dd19e9b3c883ae08ea2d340414e461afe0b3275e5
SSDEEP 96:PGEJKskb232wvyFpJE3u2ypJ7+NuiCOJruDW3JnIut:r/ZCzsBA0p5NBIs
TLSH
T12232CF556BDA265AF3F7D971D6B32720AF37BA059A048A0D408042091873F05DBBEFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads