97785da17da8b64b99b94bd734300065c6dd853500672f6e5e162926e22be21c

Analysis

user interaction
yes
max time kernel
1799s
max time network
1788s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 271KB
Sample260824-sd3ecadh78
SHA256 97785da17da8b64b99b94bd734300065c6dd853500672f6e5e162926e22be21c
MD5 917c149fa7c40bafd6f7503b0589314e
SHA1 b72643721e63a0ee3555a84c1ff71d43230cf06d
SHA512 1efee30cbfdc817e79f69ecc40faf29912bd7f52d2c9301a82e6c815b65b44aeb467673c649e9eb86a1b4433279e4450dbef3a522048c3cf4e65da8bb098b9c5
SSDEEP 3072:ZuDAJzqymhIqme+klrzALpA/EbQZX7I4WXYhy5hvj:ZuDAJzqPIqmeTzALpZsZIOwvj
TLSH
T105445C726200B43BA413DDA0A6BF6E0E3C35F12BED1A46F865A5E431DFE2DB2101675D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4520	takeown.exe
2392	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2392	icacls.exe
4520	takeown.exe

Drops file in System32 directory 44 IoCs

description	ioc	Process
File created	C:\Windows\System32\ntoskrnl\Pad1	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.text	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGE	7zG.exe
File created	C:\Windows\System32\ntoskrnl\RETPOL	7zG.exe
File created	C:\Windows\System32\ntoskrnl\CFGRO	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\1.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\3.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\4.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rdata	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\0\RCDATA\FUNCTIONEXTENTLIST	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.edata	7zG.exe
File created	C:\Windows\System32\ntoskrnl\POOLCODE	7zG.exe
File created	C:\Windows\System32\ntoskrnl\KVASCODE	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.data	7zG.exe
File created	C:\Windows\System32\ntoskrnl\CACHEALI	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\2.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\7.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\MESSAGETABLE\1	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PROTDATA	7zG.exe
File created	C:\Windows\System32\ntoskrnl\INIT	7zG.exe
File created	C:\Windows\System32\ntoskrnl\Pad2	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.reloc	7zG.exe
File created	C:\Windows\System32\ntoskrnl\CERTIFICATE	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.idata	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGEVRFY	7zG.exe
File created	C:\Windows\System32\ntoskrnl\MINIEX	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGEVRFD	7zG.exe
File created	C:\Windows\System32\ntoskrnl\INITDATA	7zG.exe
File created	C:\Windows\System32\ntoskrnl\Pad3	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\5.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\BITMAP\6.bmp	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.pdata	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGELK	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGEKD	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc\1033\version.txt	7zG.exe
File created	C:\Windows\System32\ntoskrnl\.rsrc_1	7zG.exe
File created	C:\Windows\System32\ntoskrnl\GFIDS	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGEHDLS	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGEBGFX	7zG.exe
File created	C:\Windows\System32\ntoskrnl\PAGEDATA	7zG.exe
File created	C:\Windows\System32\ntoskrnl\INITKDBG	7zG.exe
File created	C:\Windows\System32\ntoskrnl\TRACESUP	7zG.exe
File created	C:\Windows\System32\ntoskrnl\ALMOSTRO	7zG.exe
File created	C:\Windows\System32\ntoskrnl\Pad4	7zG.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5096	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320573099866214"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{A74B95F4-43C9-44B3-A3B1-2266B30E2BC5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	takeown.exe
Token: SeRestorePrivilege	1904	7zG.exe
Token: 35	1904	7zG.exe
Token: SeSecurityPrivilege	1904	7zG.exe
Token: SeSecurityPrivilege	1904	7zG.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
1904	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	OpenWith.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 5084	4320	msedge.exe	86
PID 4320 wrote to memory of 5096	4320	msedge.exe	87
PID 4320 wrote to memory of 1368	4320	msedge.exe	88
PID 4320 wrote to memory of 1368	4320	msedge.exe	88
PID 4320 wrote to memory of 1368	4320	msedge.exe	88
PID 4320 wrote to memory of 3376	4320	msedge.exe	89
PID 4320 wrote to memory of 3376	4320	msedge.exe	89
PID 4320 wrote to memory of 1128	4320	msedge.exe	91
PID 4320 wrote to memory of 2420	4320	msedge.exe	92
PID 4320 wrote to memory of 1128	4320	msedge.exe	91
PID 4320 wrote to memory of 1128	4320	msedge.exe	91
PID 4320 wrote to memory of 2420	4320	msedge.exe	92
PID 4320 wrote to memory of 2420	4320	msedge.exe	92
PID 4320 wrote to memory of 4844	4320	msedge.exe	93
PID 4320 wrote to memory of 4844	4320	msedge.exe	93
PID 4320 wrote to memory of 4844	4320	msedge.exe	93
PID 4320 wrote to memory of 4364	4320	msedge.exe	94
PID 4320 wrote to memory of 4364	4320	msedge.exe	94
PID 4320 wrote to memory of 4364	4320	msedge.exe	94
PID 4320 wrote to memory of 2196	4320	msedge.exe	99
PID 4320 wrote to memory of 3092	4320	msedge.exe	98
PID 4320 wrote to memory of 2196	4320	msedge.exe	99
PID 4320 wrote to memory of 3092	4320	msedge.exe	98
PID 4320 wrote to memory of 1480	4320	msedge.exe	101
PID 4320 wrote to memory of 4372	4320	msedge.exe	104
PID 4320 wrote to memory of 1696	4320	msedge.exe	105
PID 4320 wrote to memory of 2224	4320	msedge.exe	106
PID 4320 wrote to memory of 3612	4320	msedge.exe	119
PID 4320 wrote to memory of 3612	4320	msedge.exe	119
PID 4320 wrote to memory of 1784	4320	msedge.exe	121
PID 4320 wrote to memory of 1784	4320	msedge.exe	121
PID 4320 wrote to memory of 3332	4320	msedge.exe	123
PID 4320 wrote to memory of 1224	4320	msedge.exe	126
PID 4320 wrote to memory of 1224	4320	msedge.exe	126
PID 4320 wrote to memory of 5004	4320	msedge.exe	127
PID 4320 wrote to memory of 5004	4320	msedge.exe	127
PID 4320 wrote to memory of 2828	4320	msedge.exe	128
PID 4320 wrote to memory of 2828	4320	msedge.exe	128
PID 4416 wrote to memory of 4520	4416	cmd.exe	129
PID 4416 wrote to memory of 2392	4416	cmd.exe	130
PID 4320 wrote to memory of 1532	4320	msedge.exe	135
PID 4320 wrote to memory of 1532	4320	msedge.exe	135
PID 4320 wrote to memory of 1156	4320	msedge.exe	143
PID 4320 wrote to memory of 1156	4320	msedge.exe	143

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,9962258844413856936,12017900698165307373,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,13517291768564322047,9501689013319450516,262144 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,9952520292802133351,9490467397699291386,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9179252736986065356,4584829634376349417,2097152 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7413986078553452197,17698476670270021200,2097152 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10426604927788141395,800674112480603030,2097152 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,9219465120635657935,919544674938631428,2097152 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9902470673145756276,10762359134514389980,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,17357988388513800811,17448195364904374007,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5659074173115521841,12241067271024596577,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5659074173115521841,12241067271024596577,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,1158133443258837611,18238990629392020677,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,986897395606757877,1663183214746828969,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10648452852718026189,827632033697310272,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,7496107981404674305,1766613760461060496,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,1011648391642385208,8865492177145773809,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,9174115224067056131,2801866991037339415,262144 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,451974303717882608,10234358939937911688,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,5851425020529187041,9746099534179246395,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10951397726241914341,6887294156069894268,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,11070445858435347731,11008298532028805060,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,9285269254860091867,2619664188333835955,524288 --field-trial-handle=2348,i,15489785708755432896,9925332832929859800,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3620

C:\Windows\System32\ntoskrnl.exe
"C:\Windows\System32\ntoskrnl.exe"
1⤵
PID:4352

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\ntoskrnl.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\ntoskrnl.exe /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2392

C:\Windows\System32\ntoskrnl.exe
"C:\Windows\System32\ntoskrnl.exe"
1⤵
PID:3372

C:\Windows\System32\nslookup.exe
"C:\Windows\System32\nslookup.exe"
1⤵
PID:4840

C:\Windows\System32\ntoskrnl.exe
"C:\Windows\System32\ntoskrnl.exe"
1⤵
PID:3764

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Windows\System32\ntoskrnl\" -ad -an -ai#7zMap11216:68:7zEvent6591
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e1852309e9b46ca0721aaedf5a0420437b62ec86bebab95e075194e967040c12
MD5 f78bc1c364293699f095714e73ed7a22
SHA1 af0d182afc7f12e8f870ced3ff84a8deac11f33a
SHA512 16c3005ac1f4357601c0d2cffcd39b160e38d1aa968ed725320d62efd757541ed451d9cabf8c6844fb854fa65467a1520bbdf4190f8dcf69860985b2967d0181
TLSH
T17CE0208846CFC23F950464CB9678530D8154365E97E4B95E1704C484F001840F7816F4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8057a34f095529dbe20c80864a0223abb2072ead24c0261354c4844ece129c12
MD5 cae75bbcfbddd79a621545090a7f2c5e
SHA1 bef306286bb6257e4d8d7108fe01739abcc9209c
SHA512 d845e2eafa0a30844ae036721adc66787d4957c5be28b4132645d82e42bbe8d5365dd3f0a36afb554d503a8fbbe5f501f2683203218fa2a6381e206c436d7112
TLSH
T107E026C446CAC2BFD610ACCB997C630CD2A03A0F93C8A99B1710C884F081888A3836E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ce61ba14b5553ddf7cb1830c517ebce49eb2ea02e6e0fc918d6f8c50453bf5ec
MD5 2391f751df72d0aeafa4afee875a0a6c
SHA1 8b65d1c90f4d7e8b5b70565fa96240f2dedc9b56
SHA512 1e221c3eba56b9d01ba69267e0ce31ce8c3058643a9ef5afce910cde66b5b986a0932c7db0078361b507f1309266e99c1fa6894c8abbe0712183e837a9f8ef1d
TLSH
T1D2E026E445CAD23F9A04ECC75279630CC2803B0F92C8ED8A270CC489F561840A6825EC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9ab64468b16448b4b36a7eafc77e53488299b1552938dad7f91c1c6b415fee18
MD5 12c822d54ec8db945bb5cb7bc3c37bb2
SHA1 5c38a6561fae3b6468b14e29fa32e7339d59604f
SHA512 d70b7ae07f05c5e43c2f6f33d2cfa88f2bc2fc6e7e3eaf97366916ce4c1c9159a3c2e33efab27edbb0098bc6ff543c44dfa8717f42797efa4598e1fa7ac2e1e2
TLSH
T11C61B32905F634B8F761C23096D21633FD718CBC795F9E5105EC6C72F90EB290756908
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cd3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cd3e.TMP
Size 3KB
SHA256 1a88b5c0e2f91c9658fa8d37da3249f89486f8ed053528d4f646b787efd529da
MD5 3ba1b0b58ede1aa67a19a138986d2364
SHA1 ce0a38f0ea6c664ec8beeff7aad1b01dc8641f59
SHA512 9c6180c62a8d2794277ef4d0fd55a8884940eb59463870099b56254f829ae2ee0109970fa3f08e6d42b0d54f0a1d5f3c60f03d61ccc3508618eda7fd033b17e7
TLSH
T12F61D52909F634B8F761C23095D21637FD718CBC795F9E5104EC6C72F90EB290756908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 12ef1104996208e8568f9eda959e57ee929aca395a7156b219f8d9fd03a3062f
MD5 ac20a1bf061064879dc5b7ea40be705b
SHA1 dbd353dcf253ac5db967dca2f16730c0578835f1
SHA512 9910e1bb1d2d23afa2235319476264e84ec2b7e51168a82cc3a0bcc230748d99b29163dd2af7b3116a0216635ed02256f811ae72554c1a751773f2e49a26bc1d
TLSH
T17431C0B7C7D4876EC91116F09B24AD2BCD2D0516422C3C65C9E4EF5BA3F2071D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f3b85a4daaec394007b73a07fb862091671135d36e0fbfa87cee961a35d9a9b
MD5 542004a93c4d066c83e6b285c01e408b
SHA1 02e2463d22cf1b0a6250fa8fd4aff0c0ff6bf00e
SHA512 4a122b47fb08806e6240190c62704e0394a6476fef3f8501f0d16cfa837fd753f39bf1de46813f4efe73c74ae336bc3901b17e779bac5043c29a8c7f51cd5cad
TLSH
T101319EB787D1836E891156F09A24ED2BDD2D0517423C7C6589E4EF6BA3F2071D1027AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4ef7fd3bbbdb6ebd0bb455a7b1adf7ffc5775de065a8597ffc4dabe34ce9e748
MD5 0ea5a7feaa8d5afe626a99d2376a9315
SHA1 e82e0e532d1d9008f4603611b40e5dc047ac7183
SHA512 32996e85ff22e67c8f990a999fa4722bc58cbba8995899fe8d38cc584579c3c07d54f35b588028b4bf5159a06ded28721a7c5c91c2e0038a627c2e55cf201a4c
TLSH
T1E4319EB787D1876EC91157F09A24AD2BDD2D0517422C3C6589E4EF5BA3F2071E1027AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c6d18096241efdf30725318bd7a0d8ceaaf76ef06cedc46849260f9936144c44
MD5 051ebfcb23be1177e27ce301b68bf530
SHA1 cc281e43edee5b8863d2d948bf50acc9fdea700d
SHA512 267b55b34a8b1bc5b7406ac3b94fbf5bc68f0ee582002a7281f09f2d98bbdc584fe1302086563d0cd3f8f98f1369cc2b20dbc51add48c4ddd2c6ad8724bd3533
TLSH
T1B741BDB7C7D4836E891116F09B24AD2BDD2D0516822D3C56C9E4FF9BA3F2471E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fc115a910f2a0234e7c99b0e7d86683ef1a5ab5fa54fad7cd367ebfadb1a8466
MD5 fda8471cd483331197fd2e88b4c6e8fc
SHA1 93f20bd670ba36597dfaaac95d9d12a1de3eebb6
SHA512 ea70e361baf0e5df9e23914918a9e2f2fb45f7fb470f3e358ddfe4fe1d6a00c5589003224169c2b004910e7b8853ef9e8e4c46a4a8cbec2d5b13b58c63d9428c
TLSH
T17431A0B787D5876E891156F09A24ED2BDD2C0517422C3C65C9E4EF6BA3F2071D1017AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8c659f183eee97e784cddf139c01f41caf6afde187935008d1a90f4f2212d10
MD5 3d92aa4b93a1344017951646c314a0fc
SHA1 c8ea0270a42281388423b3dac4429f4d1bf0ab38
SHA512 7cea97c0ea1bc5cd64113c73ab9fc765c95c6766e3ff5e9a25955497806e189462c30c4125aa9e29672e24b95f33bb49bc06dcf3885171703f9e8604298c4140
SSDEEP 192:sxZtR6yM/jK1Ml8Mk5J/fasNyJIdpdVHW6+WNGYHjFVwIgrJ:sxZt8M5J/fasNyC/HbGp9
TLSH
T10042D6166A346A77CCCBD209FA557F53D6F90472A2900E44A9FCCA1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 97ad8c4fce78a590805beedb1f7da51da1c3619f0fb258281da20c94aa056191
MD5 a19888df5dbbdf68fa1dc091aa63a65b
SHA1 d85d4b61de08eae1ffd627cae1c31e6bcea1926b
SHA512 8658f5cfdc857b3a39c7a5282aa24c9706595deb2955569e2d3e2dc474f9896c9089fbcb882fdcd36a493c2f7da34d5b21f3c47809ef0ede503a5a51367e1a85
SSDEEP 192:sxZtR6yM/jK1Ml8UQlk5J/fas9SJIdpHVHW6+WNGYH0zCwIg5JJ:sxZtcqu5J/fas9SC1HbG3R
TLSH
T1BE52E716AA346A77CCDBD209F9957F53D6F50472A2900E44A9FCCA1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f167cd35a7a29386b7e37527c4a89c103671d1e0209494e83ce0db8f4f859946
MD5 09cab57e207d4ca2a12cbb32c1db61f2
SHA1 b35a033ef44e4fde500089cba551e0fc769f196d
SHA512 70442e286b6a09888335dc181f6a60d9ab67e572de61ad3b4399144db06f5e6704f1e535122f8196b209822501554219af119dc36af167b07c5b6865fd0dcfa0
SSDEEP 192:sxZtR6yM/jK1Ml8Mk5J/fas9SJIdpdVHW6+WNGYHU3VwIg5JJ:sxZtcM5J/fas9SC/HbGaR
TLSH
T1015207166A346A77CCCBD209FA957F53D6F50472A2900E44A9FCCA1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 03ddce6390c2cd5d344c4ea26a576be3f4a54df2ec89d14c3de799d0857d6a61
MD5 925796b34e5f84b293aa1e8ee72fcdb8
SHA1 c8e9344b9053b1643cc4734a7a48443cdb164690
SHA512 04dabc654843a22662a1deef82efd5a67e5e604b28f64f4771ccb3a0f449931fd0bc54c1a2ef399934517c6343c7fa107a16eec0f71636e20c09e25960d9109e
SSDEEP 768:QXUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RvroVI0t:QXUZYTMWvg0Pou1ja7eLZmR8Rt
TLSH
T111D20A3F284CCB7E4F844E5DEC2A6F867ED801CB5A584D5447EA884C02CB2EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 5f6ca41b258a647534b68669fe9ca7ed4ce44596bc410e1f92dcc89c05f6327d
MD5 bb377a65ac6be4ce70367a42696d273e
SHA1 05a348cbf42929e071cada68dcc2f289d0c6dd37
SHA512 a1bbb3d07aea2b681b4c8198df2311e2832a46640af5fddad59e0cdf01ad098f7a2e06b6dd7b76ada43e2da39086b43cc7e1d013101ca7bdb94382376ee90194
TLSH
T12851B74D0D555A2BF8A842B314B354E037B45CCC5A519A13ACBC6131FD83B6D291B2ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6b20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5d6b20.TMP
Size 2KB
SHA256 6736ca21409eab078a0a51f814a1a4119ccc507e2c0ba34c8d24a2e16baea862
MD5 be3aefebbd2f651f733bb5bc9c62071a
SHA1 5e020e1ad8a5f3279ab9b664883d3537d4d3e6fb
SHA512 6ae0bd40e47785cea73ad197ef50e5211c8ddc56114e4d295135e6bc33ff4a28848500d751be82a3b3f0bd2e913dbbd7a113b4d9b172874bf215d68e3f7e3604
TLSH
T10551849A4E824639E894417709E3A8A437391900C619BF5374FC9632AC927AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a050901e43c689425818abf3d713ca64f0f6bc62163e9b3ff08edcfe663769c2
MD5 512a334f96b1c575b5b2b025f40f63ce
SHA1 dd97919089473aea62cab718cc290a0dfe272734
SHA512 0749084b165750b49f19a37f62cc11917d02a44df1838eab6dc55b61dd9b0625119925e3a90ae366ab860342f9a8b8ed33527aef848678e77aa982d2582350f6
TLSH
T146E0C0F73DFB1910AD7FC3D74471E4A401013CB8C64CAD8E00AEB2A310B23002806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d88e26617eef3aa42bee7d315d89cbbec03c9f238fd10eba2c6cdc337a062c1d
MD5 aca179fc86bf501658310ea0c85ea953
SHA1 6e647c7247bddcfe492d9a8b49dd06b284030864
SHA512 80ae8f65a3dca108cd5b5d1979ac4ca260a0a5ffc456792a5aba8bda9646e22426e98a584d37c398f10fa5539df2bc9897040ae2bcf564f680b00cd00b4adce0
SSDEEP 96:KA1eK2A8e8KziWa+EKLqUy8K7iSiKkKf6f:EWDXgfnA
TLSH
T198D1195271BA82523D7F2B088794C7669E8173733418E52B3BAC40B65E27E249DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c290ad62-d24c-4d86-b3ea-565a65b81f03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c290ad62-d24c-4d86-b3ea-565a65b81f03.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 532913c58a6702533609f09730752362b3cec5839648582663b7dfae64c41180
MD5 cf38db4864bac0378a09b0e8b7fb475a
SHA1 faac6fde6f455608c7329ce5cda9562c1caaff3d
SHA512 f1abeff6c2c5cefe83d73ecc8b334ee585a8fbb78b6c6dac01915c07a91b8e8c4e524efaa1d779a4e5a2c043d5a622093d6d83c264c175ee00bf78f07f9bacec
SSDEEP 192:ufLsNhEbQOkPj8Mt8R7QmiU1pxqR4zX5Obd+jgjzorYyRNMiX1z4Qdq6gO2:ssNhyu78y2RqezX5od+s8YxiXLPF2
TLSH
T145421A32A878AC679EE6A555F44B31039FF84167DAC52F94D6EC2F1C00DA29C230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c73b546b669c4d9c8d3ad4dbba569784f3ca6530284eddbcdfdf26d13d9c3704
MD5 c51143536315cf5eddba8a51000d6979
SHA1 434ef283f3a6635c9ed6c8a8980ff68a7a8780e2
SHA512 ca750c7b29d302b3bdff9f5dec845da2e25185cd96de81a6ffed86fec9ab3d0294983ee845a5be43f3ba971458bebadfaccd774583a41bfa10e09f4ac5f59456
SSDEEP 384:diFmZcIVsNz8TUNTUlIl7u78y2RqezX5od+s8YxiX/PFxoR:UF0Vawggw19Ola/PXW
TLSH
T1D1924B7358A8D97BEDF6AA55F54A32038FF44077DA85AF90D2DC5E1C009B298130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 25e6ed77f56ae682fd994115ce5edc0f1a43a3628f370c3ab6c1fb5b7023f53d
MD5 4a4a11eb20b9b56328a34701b9381621
SHA1 d6b2ccc09e7e6ca5ab759d877c779d10b6e61ddf
SHA512 f63ab23b9516458497f14516a9bdda5ca1cd41424d0ed5d7bd1ab4ec083e0fdd88e36cec693321dad2eeea4e638ef093d2d9c29fb21c2053ceb5c3cbdc55e4fe
SSDEEP 192:yONn61VWQmiUyaLgGX5Obd+jgjzorYyRNF/ar3PmU6:yONn6WngGX5od+s8YBDmU6
TLSH
T1E502C735A9687CAB8EE2AE49B48777135FD4106BEA952F80D6EC1F1C00D765C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 65e4be3c9c417051753ee4e7174175de37d86758e8ba880e7b8a8abd9c3a8427
MD5 2f073255f14858d3bb38fc644360761d
SHA1 6cb7a1114927cd4f46acc29191151263fa185e97
SHA512 3f6c49671469473933952b88b34a63509d0fd194df9f3978578e8c58435bf3f2971bf6f64420bc000219f99c9b643ff27036548109257b65da7e1e4e4fb5ac92
SSDEEP 192:UON861dWQmiUyTLqaGX5Obd+jgjzorYyRNMiX1XjJdq6U6:UON86ewqaGX5od+s8YxiX7PU6
TLSH
T12512F932A868BC679ED2A555B48B32135EE5412BEB857F80D6EC1F1C00DB69C131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9481eb3bf3221de3628f1c7b6868e7a36e050254177aab387a2c40ea207e94f7
MD5 7ea89beb6cbf929bf347c3bd89835e70
SHA1 19ec182cad035d4ed06d883d0d1e95523d3d32e5
SHA512 042c254d60e5f9554f6311f8f259ca9f7f81ec305c96009e24f5ef3ff31276e1628736ffa773acf1747dbd95f7112ddc093d31296aa25b68b3c8a8bc9d2a3fc2
SSDEEP 384:DZcIhsNhnu78y2RqezX5od+s8YxiXLPFxoR:bhZw19OlaLPXW
TLSH
T1C2726C32A878AC7799E6E156F44B36039FF84077E6C56F8082EC6F1C00DA698130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 22aed1e455d67e85b72823ed9a3389bf8c1b2be6628ae250837d9e868acb18f7
MD5 23ca777873b6bd978a00f159dfc8d2fb
SHA1 9e5280bc0f0eeedf0351fce8260d8d98aebdf785
SHA512 c03348a7370bd55af00c58d6677ff6275fc7159d35e08b5686e8165374bbe199b5a96315b282a2a3b8d1d33e0fdc20ece2b57d0b6a172d186eb97cf1819d7bf4
SSDEEP 384:pZcINsNh7u78y2RqezX5od+s8YxiXLPFxoR:hN5w19OlaLPXW
TLSH
T1F2725C726878AC7799E6E155F44B36039FF84077E6C56F8092EC6F1C00DA698130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e4a0acef5d0f098b715648d973e59a3be1943960be472dd750808c119241a1f5
MD5 77c1d497476cf7195c561e861b03cbef
SHA1 0c5502b8fa7d0840175ee98462a7128e54ae4991
SHA512 5a8aeccd1495eea76309aad44fa3a32d1575929c08ac83d3c6cfd56d01dda96822400f19f34bbcb36c0e257098591250f0fe10d75ce698c2ca14efe49ee2fd9e
TLSH
T14A412858B6EA1148B3B76E1AABF7A86D497F7C273F06D4AD10010D4E0A22B40CD62737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4988-408-0x0000026D216A0000-0x0000026D2184E000-memory.dmp

Download