c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb

Analysis

user interaction
yes
max time kernel
539s
max time network
550s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
ZenithMacros-1.1.6-Unlocked/executable/LICENSES.chromium.html
Size 9.8MB
Sample260905-cvtkrsbe25
SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
MD5 0ff177fbf2a3873dd573077840e0b8f5
SHA1 03d06bc7cd894399a5fc6600a0210f6e3226f92a
SHA512 3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY
TLSH
T134A6A52F7B48037706C642627B8BA5CAF21E903F3B561654344CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330489994161881"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BB4CC08E-B065-498B-B999-9CA5823EAC62}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	msedge.exe
704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	LogonUI.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 2440	3476	msedge.exe	84
PID 3476 wrote to memory of 4800	3476	msedge.exe	85
PID 3476 wrote to memory of 2060	3476	msedge.exe	86
PID 3476 wrote to memory of 2060	3476	msedge.exe	86
PID 3476 wrote to memory of 2060	3476	msedge.exe	86
PID 3476 wrote to memory of 4928	3476	msedge.exe	87
PID 3476 wrote to memory of 4928	3476	msedge.exe	87
PID 3476 wrote to memory of 680	3476	msedge.exe	88
PID 3476 wrote to memory of 680	3476	msedge.exe	88
PID 3476 wrote to memory of 680	3476	msedge.exe	88
PID 3476 wrote to memory of 3788	3476	msedge.exe	89
PID 3476 wrote to memory of 3788	3476	msedge.exe	89
PID 3476 wrote to memory of 3788	3476	msedge.exe	89
PID 3476 wrote to memory of 2068	3476	msedge.exe	91
PID 3476 wrote to memory of 2068	3476	msedge.exe	91
PID 3476 wrote to memory of 392	3476	msedge.exe	92
PID 3476 wrote to memory of 2068	3476	msedge.exe	91
PID 3476 wrote to memory of 392	3476	msedge.exe	92
PID 3476 wrote to memory of 392	3476	msedge.exe	92
PID 3476 wrote to memory of 1124	3476	msedge.exe	96
PID 3476 wrote to memory of 5116	3476	msedge.exe	97
PID 3476 wrote to memory of 1124	3476	msedge.exe	96
PID 3476 wrote to memory of 5116	3476	msedge.exe	97
PID 3476 wrote to memory of 2428	3476	msedge.exe	99
PID 3476 wrote to memory of 2252	3476	msedge.exe	102
PID 3476 wrote to memory of 3440	3476	msedge.exe	103
PID 3476 wrote to memory of 1336	3476	msedge.exe	104
PID 3476 wrote to memory of 3736	3476	msedge.exe	105
PID 3476 wrote to memory of 3736	3476	msedge.exe	105
PID 3476 wrote to memory of 1628	3476	msedge.exe	112
PID 3476 wrote to memory of 1628	3476	msedge.exe	112
PID 3476 wrote to memory of 704	3476	msedge.exe	115
PID 3476 wrote to memory of 688	3476	msedge.exe	116
PID 3476 wrote to memory of 688	3476	msedge.exe	116
PID 3476 wrote to memory of 2644	3476	msedge.exe	117
PID 3476 wrote to memory of 2644	3476	msedge.exe	117
PID 3476 wrote to memory of 4224	3476	msedge.exe	118
PID 3476 wrote to memory of 4224	3476	msedge.exe	118
PID 3476 wrote to memory of 1124	3476	msedge.exe	119
PID 3476 wrote to memory of 1124	3476	msedge.exe	119
PID 3476 wrote to memory of 2784	3476	msedge.exe	124
PID 3476 wrote to memory of 2784	3476	msedge.exe	124
PID 3476 wrote to memory of 2784	3476	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ZenithMacros-1.1.6-Unlocked\executable\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x25c,0x7ffe30d7c188,0x7ffe30d7c194,0x7ffe30d7c1a0
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,16763684821713843912,17947639200931896308,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,5685088823694411702,9406949966411803145,262144 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,6680591042152638330,2630212885220378115,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1416310737356514536,11144429680690143762,2097152 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1667302045615135311,13660503395926652072,2097152 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,9476726861569221112,18015457717860878633,2097152 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,9806519934443075220,5891200600604229904,2097152 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,6969226118551357331,6059136573733851241,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2169367832446977561,1853269130148484068,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,5693638552471827681,4343898572162610576,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,5693638552471827681,4343898572162610576,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,11690652863911869672,12006809271872468596,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,12934222849545241712,4459432462402472788,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,13379152495344409564,7778794707943068934,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3048,i,11083134511191685992,16580415468024563020,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14460151002192969665,15844918982690628817,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,8519795918964334098,5761886898679624436,262144 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,8407901618450093518,13068076361658991379,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,6848212336993532747,418758046126409887,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2176073447938032776,10712854494914764872,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,2676978927004336459,11312625317481496856,524288 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6704,i,2811606316283575070,12766439645775115291,2097152 --field-trial-handle=2248,i,14750120458627948082,14012054152448178573,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3984

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3972055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 edcc8ba061856d3ff4167fddab141c3a57d85f9251e54e9dc95d515fcb56235b
MD5 0793ce1580b79e4299d8b0e010473beb
SHA1 055430ef6e1f80b14d71b6f3ee5f257422fab6ed
SHA512 6c025ba3506afd15b5b50c119a4529297bdad05a25c7ecf5ac10dc697a011556e0e3d9c7511e41365b02f1f3887ce9003c1f67626f1b99f631d8f0cc06977546
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T12EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 808672f14296b04df293c3e185a70b626c4f9187d586574837ffdcb84f0f83ed
MD5 99d365e71486a534b82180c5d6636c48
SHA1 815f2a2c6e02f3a3e4be1d48e83daed5a835def7
SHA512 66ca632e7baee0590eb9c37c4e509ee7e956b62e1c263a061700bb08942c34170fbd8a79b67dad2181a243235ae0462829561971a3fca809a755bf6414c31d49
TLSH
T104D02310B82CB7D2F123003D00304702344C8177B223B301B020040D8E300C3B2CA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 14ab94b867a8720f104697d221187c92fc0ec03d3018d99eaaa4eb318c4aa700
MD5 00cf992a60776fb79a602dd4e99a4088
SHA1 f67bf92a5bdf7d426a4385e4f4459749980808b5
SHA512 991f0c4518ee9493c01897042b5f8fa5e2b73662e815563de210086b89b1bbf8c37499c1039797d21d46640e547991558fed35b17247794e57f1d61cd462bcd5
TLSH
T1E2E0209444DDC35D910C69879354477DC2C03F2E92CCBF551710C88CF541140A2B1D60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7a82ced533dbe2e36b4e0eea586e3be8bb613cfbd2fddaee7fd165ef2a2039b6
MD5 e8a74db90c65f90427672bfbb369acf6
SHA1 83dc580d38fcec4d31b291883c530137a408f59b
SHA512 1e55d6e4228eee8d0e142de9331176d92e9e57e002e59675297efdda1dcc1ee4e6388019dd4c1f5a17ca88bbfc3abf19cdf6d3fa8d9f744385588514b92d082b
TLSH
T1CAE026A904C8C23EA248A58FA16B870ED2C13F0B92CC6BCE17018CCC3002090A3A3AA0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f23b19eb379b0c5bf288f282df80e944b149a02db759881fbedd626b01942ae1
MD5 0a80cbb49c66b13201f0ea37d20adee4
SHA1 5224169611566bfb96da082fba21be348b704989
SHA512 e7db9e62f1a61b9e6686cbcc8c6414f73e198355ed012ef2779f316e5cad5a59933c3daa07b27f7ad84b3d80f43f962c6186718cc4479d24963df599e98d1820
TLSH
T1197140348616C4B3D7461D7050C12D0D727A8AEBFAF31ED6239C4239237277453E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3ab99b96dd5d9ca9e8f625af4c6f5daf724b1d9e36d345ddc0a18b4623d375b5
MD5 cace5fc8f669e4173d40c5e8f535f1f0
SHA1 1e284b453b789e3f1e7792156168e1f53c839d18
SHA512 967e10eef34367c630b324e4732ede53e1dfd94c223a7fc307f5d5bd82e6f2fa19127efe1c871a980c5b8a3ae68ca73a8a2dc679b4671d77cb54553adf21173f
TLSH
T1B38150348656C4B3DB461DB050C12D0D727A8AEBFAF31ED2239C9239237277457E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b551.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b551.TMP
Size 3KB
SHA256 1d378e309c36826ca164c7236271427d03c8e7244685bb1a5c4668b988240d99
MD5 c91198d64dce369d83c708b87a63ec7f
SHA1 59162fa76454eaf3c7ea8402203a670420278790
SHA512 c7b5751823052d462bb10aebd4c1ae2bdfc13ad68c9f4f8667f1978c95d60d5f47727adbe37159398da2ac7dee79eae71aecbf40fc1016e62ef592e7ce9153c3
TLSH
T1A97140348A16C4B2D7561D7050C12D0D727A8AEBFAF31ED6239C4239237277457E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 94373b5e48ecd28c472a4c0742d6f98c44ec837533d10f62f84f3d23d94fcbf6
MD5 fb675b7643c786f4239c22e332a56c4a
SHA1 648e0e19c608fe54d71a3158c06ee65a7e2b5350
SHA512 045d81fe1dbd8158cf869e0907569ad164dcf63f90606807a2eb0268267c2d142ee510f660c3c68a53df34e06088201104424e9879edd871e6de76ad457e5a58
SSDEEP 3:MsEllllkEthXllkl2zEFllcB:/M/xT02zxB
TLSH
T1D9440404FFD0041DC51710704111C7500370F410075557537CD1C4D35CCDD444C50400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 1a6eb8887c88cbba9914393d232bf372c94fc44fb1c0aec89c3e3ff1dfe4bdc1
MD5 44e034078a871efb01bed144319a8358
SHA1 98d84bb83168c8c3d82d9da03770fad22295fb5c
SHA512 0256e6e4ee5dc2a04dab788afb1528aa50af18696f6face36934cbf8acbf1707f549ba363d67c027c8285a4586462a9c6446d92d41386596aff8054b9f5b6fac
TLSH
T1C31171F387E5855EC91116F05918EE1BDE2D0506821C7C1985D4EF27D3F3075E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a5d4ca89c3949483c77701b6a6a8c04716c57026828888e775cd4c0ec3221c3b
MD5 f55ef1de8284650351d94949c2f7b97a
SHA1 26f8054533eef77097128156d4de801e9fc4cd8f
SHA512 db14aecfdcfdcddcc623e10732b1c72cbd45e9fab0b03aec0480216993d9f0e06faa422ff90f594c1276b05de266db37d42e17f37e3df3efe037b1e1b54b0ab4
TLSH
T19C4149F3C7D5C5AD8E1116F19A246E1BCE1E0915832C3D1A88E5EE2B97E2471E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0bc0f775e22f28c466cf0ab77a1b51aa91d1fec078f1e83c7409f4282d922af3
MD5 2c806c78ef6b0ad6c392ceb300d63e7d
SHA1 8bac00edd6a474db175e57359a7d1fb5635e6e06
SHA512 abccb0efd48d5ca568430df598f51353f8198eaed09655b6f886ab9e6dbebcf7e4fc738dde6b38107338b25de53091e1080bd2205157f5fb9455c8850bf22791
TLSH
T164117DF3C3D585AE8D0116F05A24AE2BCE1D0516421C7C1589D4EF27D7E3075E00155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 957b34d7882e10e8633c163b1d44fbfe347cd964a6d8668896b67a5d36934485
MD5 c0f0af54fede728e25eaa4902c7e5f81
SHA1 fb279a09311a0362f3447ceac38b7c523ad5e4be
SHA512 2049385e8a0a6321f06e89b8279a419750eddf34dcf791611d2647d7f79df0d95c4d0ca8f273516947981d7927edffaca5960ead81812415885154fd21a4046f
SSDEEP 192:sxZaRRyM/jK1Ml8Mk4/fPseC4jIdpdqHW6+WNGYIkV9qIgrJ:sxZaHM4/fPsN48AHbG19
TLSH
T14F42D7116B34A977CCDBD209BA55BF53D6F90572A2900E44AAFCDA1C05E7AEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6fe20ca62005dee03243d9703b0c0819e678d2d38ca85b33123325b4dfe6268e
MD5 24f9d31c0594c9e386f50293e3c029e2
SHA1 9ea2f3ca2cb3a030eedb3906ec1d1e61dfc31034
SHA512 14ff99f31fbde662cf131d701a31736b3b7a7ca5764bbd18a59c5a39b2f0de6302cc0750210829ab982f0c09b592f62c2a0f1ce56679b5068a426e5e70aa36ef
SSDEEP 192:sxZaRRyM/jK1Ml8UQMk4/fPs1C8jIdpHqHW6+WNGYI7kjqIg5oSJ:sxZaHqX4/fPsc88KHbG/Su
TLSH
T15252E8156A385977CCDBD209BA45BF93D6F5047292900E44AAFCCA1C05E7BED6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2cc59df615b9949386bf79e4be2c079e276d8c990ad6339f3dc93a5586894cee
MD5 4485257e911059ad8e64bf59d1111a21
SHA1 e68dd15cf87f1b6532101c194556481e9bd0e953
SHA512 9c86e384758fdc87049d15746a9f7b282316defa0ef3bb4205486eefd547631624cfd6e07a47ddc276301874ed21eb3cb30892bc8346f536bb7de86b3a88d093
SSDEEP 192:sxZaRRyM/jK1Ml8UQSk4/fPsJWpVgC8ZIdpHE9HW6+WN7GYAFdyxIgboSJ:sxZaHqR4/fPsJWvT8y8HbyMku
TLSH
T17A62D515AA34597BCCDBD20DBA55BF53D6F80472A2914E44AAFC8A1C05E7BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 384bfae089767559f871348affc944f2d1b73e81edc8aab4cfac1e4395bd6c66
MD5 e85c5c4ffc925c35d7c7162ae2f70d6b
SHA1 8dc1858d9ff334b34642439902819ad7b1a0227c
SHA512 a2962153326973c7aeb99d9ea28fe3d7818e44d8f0650743214fa7f8a8eaa5d57321125de80d82b855821af82ab309e9bf7c48b87d68d0f1c6f7841036f046c9
SSDEEP 768:mksqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9NroQHDW:mksqxXlWvJD6Tu1ja54LAs9m6S
TLSH
T1FED20B3B694CC77E4F840E5DEC2A6FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 2KB
SHA256 c9db38e5a21bb48d9ff03c00c99d98afe89236b076d6af24f32b1c2755985e6a
MD5 8566adc5ee52bc705f0f4e478a85f07f
SHA1 fb097c812f567c23a1ae441cf818ae8ac661df1a
SHA512 48524d2cc4d8c6c69b2499b2a5d63e07b1e7504dc8606d26c83c3b1592832f097ca5e917d825690e0ad558342ea8c098aff5a2144d39dc341fd0e911c9176b30
TLSH
T1D341B68C4D918B2FEC58817304B2A8A433B0B8CC6B5597176C3C22367D1335E365B2EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d06f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5d06f8.TMP
Size 2KB
SHA256 c4f1269d3e828019e793576bb49c4f0b3e7ffeaa980b6e5bedae946977ef5c78
MD5 0f61406b8bcd95fcf6b9b911065b7417
SHA1 36c91ecc8ccbb17906664a46791039672b4d2cb0
SHA512 1718b0077dc3ebd3e08567aa105ea71d0f356778b99e85f8a7d2c85f74a17ea42d4bbeee9ec452cb95590b30f39e5284822717afe88233e7b5d3f990b1ade3e7
TLSH
T11041DA894E81C62FE88040730ED3A4B87339990087227F4778BC5636A8A27ED3E4E1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6225b596b3c55a15c0f76df83c467497f09beec0465fc5cb3b7c9f62fae95fc0
MD5 7179d5977043dff0639e5a9c8ad89a48
SHA1 e978297125250034950b419a95ce7bc61499a7cf
SHA512 74842eeb5d9f33df96467be2725189b9fc9629ecf57267e977820b7446044ee25717289ffc84a76f964559265bee5015d6540d9099acf4193aeaf6832dd182da
TLSH
T14BE06FBA2AE70C00A8FBC3EB08B344A60410F828C891EC8F1029928310622A02826C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d6f31672655a9d968a4805ced03ff634f62ad2e7bd888a0ff4f99eb234d256ca
MD5 aa83c10942e2fd8f768bb3d36d5361cc
SHA1 be386f0e42b9aa56a166094d8b3812432d6445c4
SHA512 5d4df8d87bb78b7bacb6ddfb6ec013d65ad634dada33ed3f4189caafb257326b0b2f6cfce34f59e8d30950ffb96fd3dce9216c8c18a2bb98ffbb7f9b76c147e3
SSDEEP 96:KYbaKYIKS0QKJ2ihan2K0Isk8I5PWCkK+BWMkyqKZ0L/WKE0K6GMK7SHMBIs2p:Ex7jVjd/CMBIs2p
TLSH
T1B2E10216713F024338BD3918E35685368E4272A73819A5BF7B7840A65B67E221CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c42e40133f37b9d0b65bff9eec56d434ef026ca710f4122408677ccff7a5915
MD5 6fbdf0a70237f3bf8d24ff948c9350bd
SHA1 14086adce3aac5e147a3c2865ed0ffeef6dc05a2
SHA512 ed90a3d68c4c76994cefd4d17bffa4254c2250ec5f25a64995ae98b54ec54348cf30c0fe2bcdd3623a51b1e85e7d957e9a0b4f52961b43d416efd673712be68a
SSDEEP 384:yZcIhsN0SQbr9DVRNMOKx9/P7O6R2FeoylpoK:AhThHMOKx9/P7TRNZ
TLSH
T168827DB15C385C775EF7A546F88B36038FF8906797CA5E80E4DCAF1D05DAA98130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd2330b90fa30f4f2231c2ba80aef5ecbd4744e2984259133d19313cfe923dfa
MD5 2df5c1cc0a6bd848e871587af68dbd60
SHA1 076cccfc206b0758e7d74c8990e855c1d5de04a9
SHA512 f3dc2a0012e611c8756670bdd97581c19e624d9ebc83c08634a0ff767d4e439e19263e4488c76ffba1a40bcd56cb157fcac4928677287a8e7d4fbff353a6162a
SSDEEP 192:tONI6JkRtQmiUy9rW+RNMOmEoIh3SRCU6:tONI6UrmW+RNMOKY3U6
TLSH
T18502F9356C786C7B8EE36E09F98737175FA4106BE9852F80E6E81B0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 75b30eb08b739a9595af80a15d3dc9cef8ae4cfb79a3674607635f927b3a9ae4
MD5 390f31973a23adcc80ee5a9a2235312e
SHA1 6c60b21d90f24cd05d5ee426624d14eecce520be
SHA512 57ed92a641b560f8f1884b2db1a5f923ed13e4f5d97c73a893987a2bab5eee3ec8d017ecaa962859cdf75c9079e84c595b322f687a3d6f1bd4ce4642f44c7707
SSDEEP 384:aZcIOsN0RQbr9DVRNMOKx9SP7O6R2FeoylpoK:YOGhHMOKx9SP7TRNZ
TLSH
T144827DB15C385C775EF7A146F94B36034FF8906796CA5E80E4DCAF1D05DAA98230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 368ecb7311b1bcf54c63afcbf0701f7c03f2bad57b1d10d534c9ee79cc7052e9
MD5 29b1847b806049a8e4d2adcf58b18ef8
SHA1 2e0913ed30a9111f10aa0f58439a0acc5a3be52b
SHA512 044ba5fdc8d6f3882e0c8c1fcf7db2e4e1788e34abc22110142831a6bfa636bf16176d55c8e74c1c6ccde609a207b5d0269eb818a94c1fc9296f203389a53753
SSDEEP 384:QZcIhsN0RQbr9DVRNMOKx9/P7O6R2FeoylpoK:uhGhHMOKx9/P7TRNZ
TLSH
T119827DB15C385C775EF7A146F84B36039FF8906797CA5E80E4DCAF1D05DAA98130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e46f9c2a209ca09b79cb849a7721f4cef6c2c031c7edb4063b23e260b0ac70a
MD5 e4ff4584b9dcba0343ebed755869b883
SHA1 88cb14286cfe0fe94e2bb8eef79da9d721aad1c3
SHA512 3b98dc6091f5887e45995ee490619a36ec7d3b314262488974ea4d72d5dbd2f17722fca1f314319e67cbb9452139f131abac841ac2eecb3b584205081ebaaf6c
SSDEEP 192:ZEONN6JkR64QmiUyWrR+RNMOmEo9X9jcVcJqOOuJU6:qONN6UNnR+RNMOKx9vPU6
TLSH
T177121B3168385C7B5EE26945F48736534FA55167EA8A7FC0E5DC2E0C02DFA9C234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7819411a90611ad022cb7e95190d1e8f50a07473d73974b0f6337ea0b6b33740
MD5 23a967bc8f4c54a44b2819a3b85f2d6b
SHA1 fd527f5626b85eef0a5bfa54a3b4fd14dd021d5d
SHA512 e7d011d241ccec5dd5715ec5321b9eb93fb481a099ce600b1071645b3cbf85392656dc1af96b4bcee6fa7a17a6a89c22cab0c34e0f75180850863558fc0d62f2
SSDEEP 384:zZcILsN7lZbQtDVRNMOKx9IEG8ASttJ/olFOK+Y4Mkv7O6R2FeoylpoK:rL9hHMOKx9IEASuaK+Y4Mkv7TRNZ
TLSH
T12AB25CF0D8A55CF704E6E4C9A982F6136DB81077858D8E4CE6F8BB3D319F9B81316815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 76554964a693323ce894bb399a1026db2e4e583e365b895fa69512509e884d3d
MD5 a80b0f8d699078bb3c856d55050fe537
SHA1 5611b967b257ecad0d1d6f3d608ba7e274e9f772
SHA512 3957530cfe226e4010367d595e4eb516f209154107f167f7f2bc2b3f25f1b35ff4d9cecdc4670e469658e880ee45ba8ff7763cbb735b7bd771170df80b59d406
SSDEEP 384:nZcIRsNAlZbQ9DVRNMOKx9IEP7O6R2FeoylpoK:PRIhHMOKx9IEP7TRNZ
TLSH
T12A926DB15C785C775AF7A146F88B36039FF8806797CA5E90E4DC6F0D05DA998230BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63e36b12b03d8efce5c962ef75f8fed71d0df82e4c4fddc3978bdea98e62943d
MD5 60559378202c8478acfc5140a50e6337
SHA1 833e0223f44cf6ee4a8b3ba60cc1f4ead30458fa
SHA512 232168e272b7f4bfa8d13b1aeadae8f84d8adad4c56384de31f0f2b9d623e8411ffa7d0a6d0dad0d1699f819d556289da28d34ba74b7c4c3e2cf30adc796dc5e
TLSH
T131410959B6F91108F3B76E5AAFF7A86D483F78372E16D06D10110E4F4662A40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads