3ab8045442218bd36585017deff206d8501c0d3ba7b781a9d79dae06ffc79d17

Analysis

user interaction
yes
max time kernel
598s
max time network
417s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main/universal+spoofer+cleaner.exe
Size 68KB
Sample260905-zcbcsshq7w
SHA256 3ab8045442218bd36585017deff206d8501c0d3ba7b781a9d79dae06ffc79d17
MD5 e0248647e9980cadb54103bf6761ceac
SHA1 1055e678195109e0afcee1e3aa7df35eef0f4b76
SHA512 3473e4a5ddfa90b0130f9f6e2834915775bcd876383ded5acf1af0e2060da49e5cbf5ff6395cc9c6e6e67ddd3662fcbaf515a4b4d57bd3b7478a020eb6952dc6
SSDEEP 1536:45qdohCcbQ16WpY6Dk8ne8ovTeqmCT6eH58gqWBO6V5VSizyOnXvc1Pk:45VfbQkkYv8neXCqmCTb5kSSi7XvePk
TLSH
T1AC63096667D400ACE2B7D3B89EF39512F736BC0417319BDF0340415A0F26AD4AE7AA67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence phishing privilege_escalation

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	132	[email protected]	5000	msedge.exe	3
Email address	132	[email protected]	5000	msedge.exe	5

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
291	drive.google.com
292	drive.google.com
290	drive.google.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-876885714-46325919-1482798410-1000\desktop.ini	universal+spoofer+cleaner.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 = "1B1A0303613B38F0"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 = "1B1A0303613B38F0"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count = "1"	universal+spoofer+cleaner.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\BattlEye	universal+spoofer+cleaner.exe
File opened for modification	C:\Program Files (x86)\Common Files\BattlEye\BEService.exe	universal+spoofer+cleaner.exe
File opened for modification	C:\Program Files (x86)\Common Files\BattlEye\BEService_fn.exe	universal+spoofer+cleaner.exe
File opened for modification	C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe	universal+spoofer+cleaner.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-42C11B98.pf	universal+spoofer+cleaner.exe
File opened for modification	C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-5EAA410A.pf	universal+spoofer+cleaner.exe
File opened for modification	C:\Windows\Prefetch\FORTNITELAUNCHER.EXE-AF00A2B5.pf	universal+spoofer+cleaner.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-F264FACF.pf	universal+spoofer+cleaner.exe
File opened for modification	C:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf	universal+spoofer+cleaner.exe
File opened for modification	C:\Windows\Prefetch\CRASHREPORTCLIENT.EXE-C297728D.pf	universal+spoofer+cleaner.exe
File opened for modification	C:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-CF3441CE.pf	universal+spoofer+cleaner.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4272	cmd.exe
2172	cmd.exe
3396	cmd.exe
3168	cmd.exe
1788	cmd.exe
3804	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier = "Intel64 Family 6 Model 183 Stepping 1"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz = "6200"	universal+spoofer+cleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString = "Intel(R) Core(TM) i9-14900KS CPU @ 6.2GHz"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier = "GenuineIntel"	universal+spoofer+cleaner.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber = "302DA7CB94A53856"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "ASUS"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName = "ROG STRIX Z790-E GAMING"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate = "03/15/2026"	universal+spoofer+cleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID = "{FCF5CBA3-5A18-D6C4-85D3-6E541535024A}"	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor = "American Megatrends Inc."	universal+spoofer+cleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion = "3602"	universal+spoofer+cleaner.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4276	ipconfig.exe
4644	ipconfig.exe
2536	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331140845091252"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{42AE58E9-7420-424C-A067-2510171E428F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{AF93F396-B192-4243-A7B5-97850C20685B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe
4124	universal+spoofer+cleaner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3168	4124	universal+spoofer+cleaner.exe	87
PID 3168 wrote to memory of 2536	3168	cmd.exe	88
PID 4124 wrote to memory of 1788	4124	universal+spoofer+cleaner.exe	89
PID 1788 wrote to memory of 4276	1788	cmd.exe	90
PID 4124 wrote to memory of 3804	4124	universal+spoofer+cleaner.exe	91
PID 3804 wrote to memory of 4644	3804	cmd.exe	92
PID 4124 wrote to memory of 4272	4124	universal+spoofer+cleaner.exe	93
PID 4272 wrote to memory of 3468	4272	cmd.exe	94
PID 4124 wrote to memory of 2172	4124	universal+spoofer+cleaner.exe	95
PID 2172 wrote to memory of 2864	2172	cmd.exe	96
PID 4124 wrote to memory of 3396	4124	universal+spoofer+cleaner.exe	97
PID 3396 wrote to memory of 3856	3396	cmd.exe	98
PID 4488 wrote to memory of 3868	4488	msedge.exe	116
PID 3868 wrote to memory of 1088	3868	msedge.exe	117
PID 3868 wrote to memory of 5000	3868	msedge.exe	118
PID 3868 wrote to memory of 2408	3868	msedge.exe	119
PID 3868 wrote to memory of 2408	3868	msedge.exe	119
PID 3868 wrote to memory of 2408	3868	msedge.exe	119
PID 3868 wrote to memory of 4128	3868	msedge.exe	120
PID 3868 wrote to memory of 4128	3868	msedge.exe	120
PID 3868 wrote to memory of 2720	3868	msedge.exe	123
PID 3868 wrote to memory of 2720	3868	msedge.exe	123
PID 3868 wrote to memory of 2720	3868	msedge.exe	123
PID 3868 wrote to memory of 4608	3868	msedge.exe	122
PID 3868 wrote to memory of 4608	3868	msedge.exe	122
PID 3868 wrote to memory of 4608	3868	msedge.exe	122
PID 3868 wrote to memory of 1124	3868	msedge.exe	124
PID 3868 wrote to memory of 1124	3868	msedge.exe	124
PID 3868 wrote to memory of 1124	3868	msedge.exe	124
PID 3868 wrote to memory of 4400	3868	msedge.exe	125
PID 3868 wrote to memory of 4400	3868	msedge.exe	125
PID 3868 wrote to memory of 4400	3868	msedge.exe	125
PID 3868 wrote to memory of 1012	3868	msedge.exe	126
PID 3868 wrote to memory of 1012	3868	msedge.exe	126
PID 3868 wrote to memory of 1012	3868	msedge.exe	126
PID 3868 wrote to memory of 4896	3868	msedge.exe	131
PID 3868 wrote to memory of 4896	3868	msedge.exe	131
PID 3868 wrote to memory of 4896	3868	msedge.exe	131
PID 3868 wrote to memory of 1372	3868	msedge.exe	127
PID 3868 wrote to memory of 4376	3868	msedge.exe	130
PID 3868 wrote to memory of 1372	3868	msedge.exe	127
PID 3868 wrote to memory of 1372	3868	msedge.exe	127
PID 3868 wrote to memory of 1800	3868	msedge.exe	132
PID 3868 wrote to memory of 4808	3868	msedge.exe	128
PID 3868 wrote to memory of 4376	3868	msedge.exe	130
PID 3868 wrote to memory of 4376	3868	msedge.exe	130
PID 3868 wrote to memory of 1800	3868	msedge.exe	132
PID 3868 wrote to memory of 1800	3868	msedge.exe	132
PID 3868 wrote to memory of 4808	3868	msedge.exe	128
PID 3868 wrote to memory of 4808	3868	msedge.exe	128
PID 3868 wrote to memory of 2240	3868	msedge.exe	133
PID 3868 wrote to memory of 2240	3868	msedge.exe	133
PID 3868 wrote to memory of 2240	3868	msedge.exe	133
PID 3868 wrote to memory of 2424	3868	msedge.exe	129
PID 3868 wrote to memory of 2424	3868	msedge.exe	129
PID 3868 wrote to memory of 2424	3868	msedge.exe	129
PID 3868 wrote to memory of 1028	3868	msedge.exe	134
PID 3868 wrote to memory of 1028	3868	msedge.exe	134
PID 3868 wrote to memory of 3400	3868	msedge.exe	137
PID 3868 wrote to memory of 3400	3868	msedge.exe	137
PID 3868 wrote to memory of 5504	3868	msedge.exe	139
PID 3868 wrote to memory of 5504	3868	msedge.exe	139
PID 3868 wrote to memory of 5540	3868	msedge.exe	140
PID 3868 wrote to memory of 5540	3868	msedge.exe	140

C:\Users\Admin\AppData\Local\Temp\main\universal+spoofer+cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\main\universal+spoofer+cleaner.exe"
1⤵
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /release > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /renew > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete arpcache > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh winsock reset > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\netsh.exe
    netsh winsock reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int ip reset > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\netsh.exe
    netsh int ip reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff8b972c188,0x7ff8b972c194,0x7ff8b972c1a0
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,15902561937013082254,7541060752104106875,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - A potential corporate email address has been identified in the URL
    - System Time Discovery
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,7518376448483147080,16577380085030966200,262144 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,17893225322040788831,10823160591361066864,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,16699554370614861152,2884895868664980046,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,12176794706295341513,16303709990092556932,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,7772287149694084307,7282696540313927350,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,5006837099165172925,2271019417050802276,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,9569003683587044216,10404356504936943836,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,8370006279454242972,12325519855767071641,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:2
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4484,i,6719625011652423802,13111335856395875731,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:2
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4284,i,13736988092064853525,5363822783031748372,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4332,i,2748497149749207949,5869584963341684472,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4596,i,9376050792836153841,1975840319697902482,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4520,i,2342603646510924864,778739110558854774,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:2
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4628,i,564402747588590697,300335118607426120,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:2
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,14940122447756437667,5959266617264689584,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4433796123800743757,1273843840817530762,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,6142132655552228540,4896248019661789313,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5284,i,15365995887848287600,4631287739144222223,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,2065649651674331199,10912578725629373513,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,5591437785241961960,5111636051446327749,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,17090743210131741392,18262138254413033098,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:8
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,17090743210131741392,18262138254413033098,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:8
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7252,i,10125513927532697014,3030718213239745336,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7464,i,16947992676341984110,9497245424252334783,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,6775313314329355964,9699534009859815273,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:8
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,2563638865944459673,15313660063689049789,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:8
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7984,i,9417356124097835459,15673915736251818223,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8112,i,14518827276392683703,6732093132262081592,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:8
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,10213365549238664195,7595315096847734182,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4344,i,2543461090622327258,6949778615439007440,2097152 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8424,i,10930696776463115794,14640278354104952323,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:8
    3⤵
    - Modifies registry class
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8428,i,13726499134829309935,4295978291245984348,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:8
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,2121901854452596703,2459475604337622736,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,5105386054286510499,9246660475377308003,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,15335226817714212496,17035978676180574064,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,16959264334676114094,8398861006719067003,524288 --field-trial-handle=2268,i,13983454322603434412,7123169878538089039,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
    3⤵
    PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 25KB
SHA256 884933fb5789b478d2da68a4cb0bd5cc138d995f1fea9a957ba29cb3c00f1bf7
MD5 0f1d3218bace7a3a84c05b5d8a6f71ad
SHA1 977905ba4432d4e0c24e0da3f72aceb9c0525987
SHA512 0a6d79809ce57e15b722a807ac8586a9a52bb4db3abfc8dbb40be7dfd55ad4195df917042425f8af97cc0c2fe09379799298bba84a1ffad36a4e45e2dea58dc8
SSDEEP 768:j7jEMtcubweLke66yjm5QxI2aSCuH8cEow0U0gME:gMtcawhe6HaSCZcvFU02
TLSH
T1CCC2F1588E6ABBA67F92F0211479A595F0E3B8400750F5E4E1E02DEE44CA663FAB4454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 1578b77d8d65dc002e0cc4b7061aa2d3641e9eba0eef14487d1e7a9fe93aa68c
MD5 3b88ac879c94af46ee3d7848ad0c13f3
SHA1 fb7d43d514dafed43133e405c4be72d4f1142965
SHA512 ba99f3b2518a6df4acaa4c7c4dfe77e1991b0898a79d8294a20612b4df75f15372bd6f862381e0942e0fc864a661fc3ea4065ffb1bd267a04bd98477f761ce6a
SSDEEP 192:uTlgBJPe2N0/jUChXgNr+aojULSnyeS9+H:uT+BBcjVhXaboQLUKy
TLSH
T11102205721A223A6E7693578D0DE5A537B3B486207EF7E3F0104C1BDE67A3B2472C119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59fbfa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fbfa.TMP
Size 3KB
SHA256 ddcdf59127c6b7c62e68d25f95372b80ca2a4cec3b4d5e8fb1fe10fc826e91a0
MD5 4913e5d7211706a69d3198d957e67329
SHA1 2b691f1bb0a7ea39b66bd5c3b9f03698a7337d4e
SHA512 9456eb43aeec648f5cecf75fed6bfc95aef89e66cacaf7e96f64beeb5ae1f2ef9cd686c93c88b5fc1b935cf8a37c2e7ee143ec49119249c961a5a487a5d8e045
TLSH
T10761D62A02B34797F322323CD4E30A13F3338484197B8D77564405FD7A38B12972566C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 6338149fbdb0fa90326dcb12e036f3204ae81f6c0f2d196b536d720852b4a34e
MD5 d0eae6150369d04f69f3b7f426440fc6
SHA1 7a2bed57ba122096838523d251ee90d1f2593e65
SHA512 044f3fff12327ee23157e7a11c3ce913763a388ee5be272be2be13e0b0cdaf1e09d64d37395080f0af7d46a4308fd3858f928f1b3e7b3d290133e066e714e844
SSDEEP 384:DQoGAv+0c/VOCewxPGTRNqMbpzVhAgki6PSvCo1DY91q7JqwY7QO2Jii9F1TzTUX:Lo
TLSH
T1A062BDF7C3D8862DC95156F49B156F1FCE2D0A18432C3D2AC8D8AE6B93E2431E21569E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 d9d3316c129b5de71d5d2328425b67e27498c623dd94a7a3abc11fc396f9d122
MD5 8984fc7f8982992196895875c3d051b7
SHA1 10eb14aa938f82ba3c18d3fb738af3cb62393ed7
SHA512 c2b76cae326a048fc82fdf0f0a09fa677378ef41990789cf120cd65868a9a13ce2c55c2e3d4458d138372c503201ebe00fb41a9e45bdfd2ba29b9006ab956046
TLSH
T122D0231B250531F5D7BD3FD54055ECCFC32630314C43DDD460D0D458163545C4A07186
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 292dd06a283a48d54c2be7be00d91c647e399b6b8cc246949bd2c429ab5d3ca9
MD5 1467731bfae5beba6376b599629f902d
SHA1 bb239c2ac11175952954eec876ae9d820a7b5dc2
SHA512 a0ecf664e65913d1b1047a9c927238895537f947f56049126053b6f4c2aa13ee6b8150eecd5004de9de006f0efc4f674bb1906374c49e0b18cf92a63d7911d20
SSDEEP 192:sxZ9RzyM/jK1Ml8MycBzS/f6sKXk4w3XdpJSnR/HW6+WNiXZ/YwzA4WIg4COoO5x:sxZ9hqmzS/f6sKX43jKHb0/mGoOz
TLSH
T17572E852AA24D977CCCAD619B9307F53E7F504239A414D4C9AFCC91C05EAAFD260782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 40e27856ad7347c00ea591d456ef98e57319c51c3f042a069896e7bdb9db8889
MD5 68077c4fcb34558fa13e83cac23a1f85
SHA1 755282b6c7667d4d919f04ab55d98d777f21b857
SHA512 d79b3487533275bcb605bda99a06bb00b3255dee87dffe966b9ade6c1a07c8bfaf05e8b8bbc88940c974dc752fc3a6895c025eeb6fe3e62bbaf68e035e228abc
SSDEEP 192:sxZQRzyM/jK1Ml8MycBzS/f6sq2k4w3XdpJSnR/HW6+WNu/1HXZ/YwaA4WIg53CU:sxZQhqmzS/f6sq243jKHbgp/pXoOz
TLSH
T10772F952AA249A77CCCAD619B9307F53E7F5046399414D4C9AFCC91C01EABFD260782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 75af940475f28d64e4383e73ef0601e337b664a64096f1d72cc363a4cd5e118e
MD5 58a02096af797f409c8cc4d9073d58a0
SHA1 898eaf078f5d652680c554f622f22850edef4ab7
SHA512 2b4e5f2cda0b32f5875f0aaa1efd47c5e92f8526951885d2de24bf6dadf102024f59bc3685a84363f6067a94a934567ed77b4ee78be13b14580d983bc2f9302e
SSDEEP 384:sxZQsjmzS/f6sgWv024ejqpb8h0Lp/XZoOz:s4EmzS/f+Y02mpb8hKp5z
TLSH
T14B92F853A53099B7CCD6D219F920BF16E7F9142699914D48AEFCC91C01EBBFD260382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 cb2ed7e9a712380666be78f395a3e7373207ece5936d33a110b9d32703c9c711
MD5 f38e448c9ba000fd696c9677b049db1f
SHA1 ad378591928cab7f2a86a4682f4f4791f3d2d52c
SHA512 57e260144fed39709d3313558a1dbe25c43658558a975a77f67df8fb3e1316e5da5a0ebf92af50a7ceb7461608d1d45976e0debe45aa960f7bfc4e72630b2bb1
SSDEEP 192:sxZQRzyM/jK1Ml8MfcBzS/f6sq2k4wtXdpAbBBVnRkVdCW6+WNj6/1HXZ/YwaA4c:sxZQhnmzS/f6sq24tjHSb4p/pXoOz
TLSH
T1F782F952A6349A77CCCAD219B930BF52E7F5042699554D4CAEFCC91C01EBBFD260382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 05aa3cd1f1afee6f67130f30b964d21f6c0a94bb5115b700d5d46c66de63fc55
MD5 ea9290cc323360f6380c327a2ddfc044
SHA1 bea13292f884f6cc00bd008146b7aa7413a280f9
SHA512 26e3f871538a1a50c8a9d560c93c6d390622cee82b85e03fa3524c08b31cb53e3f8db4b03cc505a39e7e4b13960c6e46d114274c559dcbb2900519f1102cf59b
SSDEEP 768:YEsNGs7pLuLzYoWD4Af+88F1+UoAYDCx9Tuqh0VfUC9xbog/OV5OCIEnHrokjDM0:YEsNGQEzYoWD4Af+8u1jaCOCDnU2Z
TLSH
T1DCE2FB3B680CCB7E4F844ADDEC26BD8A6DAC018F96D8CD4447FA881C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 67423c3397084200a424e2e893477aefe2ceea458af93235a55e15eb2cac13bf
MD5 9c22f56c3b3f69b211d9da20f81c9a51
SHA1 0a48513a4b88dc5c49cdde2912c1970dacb3e6bf
SHA512 73f3db19beed9bd6ce284c804db9d15236a655a3b7d6e4b79b61555e159c326a6852e650b9ac6d47f229e6fafabdaf623d412be9077550335f5d6adcf8201a11
TLSH
T1F0A0029216CD5451D901477531C60550A2104821825797974290909CDD571F4421A101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595c8d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe595c8d.TMP
Size 48B
SHA256 3733b27cc04bd3cd556b1a2ebc088fe227aefdfde38052e28a3148268a80704f
MD5 ed9525d5dbf02c3f1a25d45e85297801
SHA1 8ebd451ce9541ca44680a5d713d708b048aba314
SHA512 daf6f9687b74d6bec2cd2c40d2bb9e837dd6a0df73d11bc922ad5e51f9913692500af95de50017de76b78d9eec7c7ddc3c8694105f7a4763ce75bebb2e1c814c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State~RFe59fc58.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RFe59fc58.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b38c27665c87fee85b0bcaab3304f00e6dc1db4910d1e8fbdc6e1ddc2688dd74
MD5 4655f1992457f0ac5bf7d165b9294a5d
SHA1 6162989ba1e55ae66be34ba4eeffead6dbc9b7e8
SHA512 a884bed3285a2cc925d100df7b0219504e58a9ac8d327e18e6fc163bf25f541b4d18825e6fd5de8acb64a780f57ef253fa5618cf10e99937a9aed26f141af155
SSDEEP 48:KAzIhK0YMHy1JIhKa88qlE5V7njkznCPICdkKxBZDkN10Ui715ytRIhKi0MA:KAzWK0YWeJOKa8FOkK/q6+RWKi0v
TLSH
T103B1A61630BB82123D3D2A5D9258961B4E4137A37168E93B3FAC54720E27E255EFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f785.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f785.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3831ecce351a93c95dfb09f03f4c61e70c56310772bfc4b8675222b06a23c1bd
MD5 60b677bd622e1065dc63fb126a0b796a
SHA1 0c92c805dc67a033ab983bc996b50dbac10cd924
SHA512 1c8e174c415c74b0a5d59d982aabb1a3bbb700a5c46b275e25e8554a3eae20dcae50fb2c106a395818e16a000a86319a72df832919eec01fd079f31bab9401a2
SSDEEP 384:neZcIhsNtNKNhnuzm2f+2/d9Y45iFfux7O6R2FeoNASoo:chb8mmb0f07TRqv
TLSH
T1F1827E30AC786C7789F7E603F4877A135FF850779AD96A84D5FD9B1D008AAAC1317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 31c8608656255395a8653bfd4f5fa5b4c1f27aedf95b039e23ebaba87e9c0283
MD5 a8d378a83b7e0b9541fd6ee46cceaf69
SHA1 54da2d9093df8f9e54038df45b2ec0050b6e9fa8
SHA512 f024465473cb332034ed67e0cb8252b1a3af0a1c8c3bab9d4b264bd967889ed4a9f67b5dc039dcb0ab8ac45724b2153b6cb4dfec763374ec22899d439f65bdf9
SSDEEP 384:nsQiF8ZcILsNd8TUNTUlIlNKNDnusm2rDfwx+2/d9Y45rF5VhLWQVOK7QT7kG7Of:srFqLwwgmNm5xbZDhiQgK7Q/Z7TRqv
TLSH
T1DFE2177CDCA4993F98EEBB85A60E7A228DE40177C5F89988D7D90F0D807399DF306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 01b1e31bc2fe516df61eb615fcc7e006a37e13640643d70bfe10461b08300855
MD5 a690ae03d4976d5aaea723533336f015
SHA1 6e1d3ad9fc8ace2485804953c8082bb13cf29eba
SHA512 b9cda7516f018c05fc2b7ca2096967303e4d568b2477def4b11a269a0eebd302acc4d7d6442d95e62604b6c8028485552e0bcea190da546a1a5a047c9cb46807
SSDEEP 384:nEnZcIhsNtNKNhnuzm2f+2/d9Y45iFfux7O6R2FeoNASoo:EPhb8mmb0f07TRqv
TLSH
T1B2827E30AC786C6789F7E603F0873A135FF850779AD95E84D5ED9B1D008AA6C1317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f8856de8d79371ce6932abaa30ac5c59722f9410e1c91c020502bdfb33b2b54a
MD5 a4c9cfd6f98cf996e158ac56c643eb40
SHA1 a1f45fb2d12b5479d71cdb9bee6a7f02171aa565
SHA512 92565dd5022353e01a7cf0607fe89236bba75029f6c95497d9eba8accedf66ad824afe7beee19eb2e418002ff94f927c07d8c9378add6f1cd635322a7cd67364
SSDEEP 384:nEnZcIvsNtNKNDnuzm2f+2/d9Y45iFfux7O6R2FeoNASoo:EPv58mmb0f07TRqv
TLSH
T1E5827E30AC786C7789F7E603F0877A135FF850779AD96E84D5ED9B1D008AA6C1317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 23dfb1f3a3f6691036303a15d23148a99c82aad724d734089e38d2e9383aa384
MD5 8a3a80a90d2f4f4692410b08e31a424e
SHA1 dbe75b0cd64b744010d0127ecfbd39811861ff41
SHA512 627087c8a2f99248aad8eddcdd64c29ad9270c8c0d2aed4daa3c7aa40d96730ce4a14a12afbadd81b8c48bf6fef05c93bac5be44144c9e05f7486336e3d25930
SSDEEP 192:wONo6hZ5QmiUylg4Gc/+jV40+Fd9YD804Ny5cOqfuxU6:wONo6DPfu+2/d9Y4599fuxU6
TLSH
T1CA12D934A8687C678EE2AE42F0877A135FD4117B9AD56F84E6EC5B1D00CB66C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 674bcbbd1d6d6ab80735431779d077e205edf9378a6a82ff74ccd79560513be0
MD5 a9cb743dd6195be8414d42d27df17095
SHA1 73aaa5a3e18a4c737193d288273f999513ddc27e
SHA512 3b7730b454c6e3805657e255d03340ec41382e86e96828b740bf3cbb914a4f44fb6cd30deb62bb006361b426e1dd18710572291ea15cff852d468afa7e2940aa
SSDEEP 192:EON+V6hZ0QmiUy+gpc/+jV40+Fd9YDJ5wOZfheU6:EONw6o6pu+2/d9Yk2fQU6
TLSH
T1AE02C835AC686C778EE2AE46F4877B135FE4112BA9D56F84DAEC1B1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ba0bd24e92a726806bc81c287f93e5fc856f736ed03f61d88ce57bbf82bcaf34
MD5 76e1d7f9af3e75c256137d7a2d2f4114
SHA1 b7fe6390e92052f9290e0470520f0cefd725fcb6
SHA512 98a14a239c6fa27b22ea2210fa0a9decb9cbe40d70541f1c32e0c9f73fd26f30137cef112aa45de56acd2cb14f51c5c036444ee4119c3cbacdc9beb253e3d8d4
TLSH
T1A4E00103E20405BFC468833418D32B207AE6812003F211459AA201647C327402A20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 26ffeaac519381c95bc4db27d724b7851f7aa44cd675ae4a354d82c14ac109b3
MD5 8f021eae487ad8eb56c7a596162e1341
SHA1 0aeb8645bf61ccbb3db36c8a3e7b7a83d8998258
SHA512 613fe022bba7d0d0839c41fb75e010996c73f9425332749dae101ff48a1cf3adc89b301953c25f905d74a82b189e4f3003198cf3003df47e71845cae2595834d
TLSH
T151E00202F30405BFC468833018D31B307E76812003E311459BA101787C307403F209C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c7be66f9a121849d7eec681fd808c652edf568f37b18e4f05d6ff599b66cc71b
MD5 34c5e7997a4661f47bda8683e65bc387
SHA1 e38823274bdab952e47eedced5a1f4246dd51b77
SHA512 ca039a9f2eeed8f76781ce57b8ce75b879586a9eac8f7bfb0f34a0e878c8efcfe93d15f9743d6da4c363fd887fb658e49433214b587adb167f2bfd018cfff4c9
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe596bc0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596bc0.TMP
Size 392B
SHA256 4942f229a89449d67f28fe391643b0c6cf4aebbe5dfc932240fac25f07f99077
MD5 49b37a20c40de00db25a09434bf31121
SHA1 2e2546aec59da96eea467893e37682490c709159
SHA512 9fa02553c1b089d55043be9203f00879b36a715caefbed4bbbd5fd2360797620aee0ab41f223b4f7cd0196023d6d906c1002301a82338c096719f9ee88790f05
MD5 SHA1 SHA512

Submit Download

212e89f7-9b00-40c2-b888-b7608c64033f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\212e89f7-9b00-40c2-b888-b7608c64033f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 126fe8d06d38d4237eace6c1db9f2b21b244b86fb18ae221aac4f0311ab65e95
MD5 e73a39f5c777eb858cd07347fa75cce6
SHA1 70b2e16055d0546410e608a6059f7f257b2d1aa6
SHA512 82150676385468f4fd534e6b35bec331a71d54c7ec5b9892c2b8315f8eaa552c885c07c2394377ed4a7cb5bd382d09e55ea9d9054c1e9384631102779c8f2016
TLSH
T1CC411658AAEA1048F3B76F1A9BF6A86E487FB8332E16D45D00110E4F0A63A00CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

76fd711b-3618-4e42-adca-7ae5eadce184.tmp

Path C:\Users\Admin\AppData\Local\Temp\76fd711b-3618-4e42-adca-7ae5eadce184.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6c73a770-90a9-4e12-a9e3-09f01550683a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3868_1712952533\6c73a770-90a9-4e12-a9e3-09f01550683a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3868_1712952533\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d8f319c-ea84-49ab-b8e9-5996f7cff2c1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3868_403036878\4d8f319c-ea84-49ab-b8e9-5996f7cff2c1.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download