d7508c0022d959e4566d2cc1742cc0b7752b6fd1e692ecab7cef7ac6b9d8eec3

Analysis

user interaction
yes
max time kernel
132s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prestige Launcher.exe
Size 232KB
Sample260910-ccxjpscm9s
SHA256 d7508c0022d959e4566d2cc1742cc0b7752b6fd1e692ecab7cef7ac6b9d8eec3
MD5 a802560cc00c14f811f003991a717e8c
SHA1 c6bbd6f188ff975ad0a48e7d82644a3a1f45a8b1
SHA512 bbf381bc4b931b207ce3f3a61cd880cdafd2e300adc9b6745ed5223356104598e07e546bbcd6dd5a3d871979673d2ae13b3c048db8f150f8da8f8081d0291d34
SSDEEP 3072:RwjdFkl6R2AsMLLSjusIjpqRCfl1BabQHB5RWWKuQNUrYnpZi+4Muyspp:R4+6RFLujusSDnTG/i7MHspp
TLSH
T1E834BE97B3E130F8E577823486A14A46F773B93507218BEF03A4426A5F272D59D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	3944	Prestige Launcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1716	cmd.exe
5156	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1980	msedge.exe
4376	msedge.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Prestige Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	Prestige Launcher.exe
3944	Prestige Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3944	Prestige Launcher.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3944	Prestige Launcher.exe
2380	ShellHost.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1716	3944	Prestige Launcher.exe	93
PID 1716 wrote to memory of 4560	1716	cmd.exe	95
PID 4560 wrote to memory of 6056	4560	msedge.exe	96
PID 3944 wrote to memory of 5156	3944	Prestige Launcher.exe	97
PID 4560 wrote to memory of 1980	4560	msedge.exe	100
PID 4560 wrote to memory of 4552	4560	msedge.exe	101
PID 4560 wrote to memory of 4552	4560	msedge.exe	101
PID 4560 wrote to memory of 1796	4560	msedge.exe	102
PID 4560 wrote to memory of 1796	4560	msedge.exe	102
PID 4560 wrote to memory of 1796	4560	msedge.exe	102
PID 4560 wrote to memory of 4484	4560	msedge.exe	103
PID 4560 wrote to memory of 4484	4560	msedge.exe	103
PID 4560 wrote to memory of 4484	4560	msedge.exe	103
PID 4560 wrote to memory of 3328	4560	msedge.exe	104
PID 4560 wrote to memory of 3328	4560	msedge.exe	104
PID 4560 wrote to memory of 3328	4560	msedge.exe	104
PID 4560 wrote to memory of 5580	4560	msedge.exe	105
PID 4560 wrote to memory of 1004	4560	msedge.exe	106
PID 4560 wrote to memory of 5580	4560	msedge.exe	105
PID 4560 wrote to memory of 5580	4560	msedge.exe	105
PID 4560 wrote to memory of 1004	4560	msedge.exe	106
PID 4560 wrote to memory of 1004	4560	msedge.exe	106
PID 5156 wrote to memory of 6084	5156	cmd.exe	107
PID 4560 wrote to memory of 2884	4560	msedge.exe	108
PID 4560 wrote to memory of 2884	4560	msedge.exe	108
PID 4560 wrote to memory of 2884	4560	msedge.exe	108
PID 4560 wrote to memory of 3364	4560	msedge.exe	109
PID 4560 wrote to memory of 3364	4560	msedge.exe	109
PID 4560 wrote to memory of 4268	4560	msedge.exe	111
PID 4560 wrote to memory of 4268	4560	msedge.exe	111
PID 4560 wrote to memory of 4268	4560	msedge.exe	111
PID 4560 wrote to memory of 5960	4560	msedge.exe	112
PID 4560 wrote to memory of 5960	4560	msedge.exe	112
PID 4560 wrote to memory of 5692	4560	msedge.exe	113
PID 4560 wrote to memory of 5692	4560	msedge.exe	113
PID 4560 wrote to memory of 2720	4560	msedge.exe	114
PID 4560 wrote to memory of 2720	4560	msedge.exe	114
PID 4560 wrote to memory of 2720	4560	msedge.exe	114
PID 2472 wrote to memory of 1220	2472	msedge.exe	129

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	8	curl/8.0.0

C:\Users\Admin\AppData\Local\Temp\Prestige Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Prestige Launcher.exe"
1⤵
- Downloads MZ/PE file
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://prestigeclient.vip/resetPassword
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://prestigeclient.vip/resetPassword
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff84252c188,0x7ff84252c194,0x7ff84252c1a0
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,8721340210658630845,8557404520879304272,524288 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
      4⤵
      System Time Discovery
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,10605491609208893131,4343017902015411996,524288 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,7501864886280682942,1598958691887593462,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,10043262362746565559,14337507731037642685,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,5127210095382376575,9937868115985198119,262144 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,15818625255318255633,16091851005652373637,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14395117672139169334,2708918435024656621,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5148,i,6068211319605529048,13959935527496558512,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8569037934391517172,8391619956065962402,524288 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5540,i,3178833268862350045,9436954034007657512,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,17212226194474446395,3292164769783640140,524288 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,7916130783611824902,14324912414649681252,524288 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3680,i,7760567799348744939,12690583117418568717,2097152 --field-trial-handle=2904,i,5452165232903878434,16128389034293922699,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://prestigeclient.vip/resetPassword
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://prestigeclient.vip/resetPassword
    3⤵
    PID:6084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
1⤵
PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7ff84252c188,0x7ff84252c194,0x7ff84252c1a0
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,4509460755174586837,18364085492475066029,524288 --field-trial-handle=2688,i,13802488592582732454,16196901877296287740,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,14384886946893256384,783007652834324867,262144 --field-trial-handle=2688,i,13802488592582732454,16196901877296287740,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2379360509762468336,3752061914011285360,524288 --field-trial-handle=2688,i,13802488592582732454,16196901877296287740,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,3154595456557735716,18077750745029393077,524288 --field-trial-handle=2688,i,13802488592582732454,16196901877296287740,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,2379663214728397701,520593928293600246,524288 --field-trial-handle=2688,i,13802488592582732454,16196901877296287740,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,2379663214728397701,520593928293600246,524288 --field-trial-handle=2688,i,13802488592582732454,16196901877296287740,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
  2⤵
  PID:2316

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 829873663387119436b0cd5ff811cf75b46707e0f7b330488ef5f0ce7ecfe55c
MD5 a0ad7bc72d0c0b46e2bed6a8525c8f59
SHA1 f0b59b9772fa0f481a94cbe732bb9032f7aa9e4c
SHA512 deef33d4f86a07ac50e53fb74e1e44381aef9b5c35158495f0abae90cb72ea237384685eefef9eff01e25be10e6fbf7529278ef2f0202d497edcebd907755670
TLSH
T176D0C01552309EC4F010B13601F03200B1100433A50857891100D0288CB028305B3CED
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

238b7074-0ecb-469e-aaa9-737ceeb480a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\238b7074-0ecb-469e-aaa9-737ceeb480a7.tmp
Size 13KB
SHA256 0df18e08b68bf654d9ef0cf3051216b455b13072aef57d9236e13855bc27a218
MD5 88b1ce8816299d0e3950f22d63e34393
SHA1 f6800fce521c56dfe0aba149793c243962bfb314
SHA512 f9f84f94d28b165dd24ef3cec73398c8c2be3fcfb497e7b62badc0de25a5758046ff953f196258172c0180b7fe991586f03c9145628602c910552986ce30a2cb
SSDEEP 192:sxRRR9Cy/fZsjWpViDde5lSNzoD8pLH/g6+WNJZzvfutHRVxd3iGduOSgSIgV2J:sxRRiy/fZsjWvic5lSb/5jfI1+U
TLSH
T1DF52A816A928AD7B4CC7D31DFA55BF63D6F91132A1D05E44E7FC8A1C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a8fdecf3d71326d79164abb2f279fd4cc960650da1868b3a09f884f686c3b743
MD5 6d1d2a0d0ea9335a400c394efbb4fdb8
SHA1 8fe9d4a91ed760e6ee273c22b45aa41453e9fd28
SHA512 b2b704fb91b9d20f855cf9b83fc589e2dade04de41adea9591905546de4a12b9cf131db6ed765a5601ba1cb7c2f028b3c49101c9df0662cf942e42731a4e433c
SSDEEP 192:q7akjq8s2sttn64Gtmy1n9Mkx4n5dgxu3QeMHBMTY:q3q8KtTgn9MkxA5Ww3QcU
TLSH
T13B1319BC66161DE6D7DB1CFC28930B3A1BF1D525E5C5246B03B0B2D88158FA80ECE623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 34fe1c5291b98a44f388b447ffb46878c4fe74b2b6b57744bcc87f2c0e208e93
MD5 79da731c4c3dd4ad326e809a10462ab1
SHA1 7ec4e416c357cc22ab40def86b83ef65ef080ca0
SHA512 807d20c38bb9b6e72780557773596691155b7cc9b5d677db960c6e17a1136fb5d404c7fd69efd8c74d6731c4a870e9774219fa5a63218e6a5559b42043da9e74
SSDEEP 1536:YHqHm8oL/efL/AjHh+1mfoMDnTMd13nnnn:tHmPL/YL/04YTMd
TLSH
T1AA4460F71951605ACBA816F5D2033E3ED1BB811E7CD2E8A8E6784C852825F31B2FDB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 77367f3b732e7490c83c2a208f5ddcdd0a064964bc8bc14b24057f3d47fee282
MD5 4dba154fc55a3875dda99fce8071b274
SHA1 dc2e142e57f7ea83b94e443e3fc7839f0203f8a9
SHA512 73869a8246e32de5096dad3843258dcb3e1ee6a8095ce29c387db89ebafea066c1c84ee58c6aea8fef30979e2d1e849ee07c775fef833a09bdb5835b7a92fce7
SSDEEP 1536:Ki49G+PFuAukMZ+oyWWR8biH6Xeq0pmB2bDz+0vVKEOEm/ROsetRjUDDNcsXUJ6y:Kv9G+9/xogkiHxBi8OrZrdDkG
TLSH
T1CC2539EEC7682C82CF2B8B7074E0E9077E712182B65CD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d9d9a557f7225ead2bf3d1558714d179316a2c45cee01ee54de470d2f8623001
MD5 669b65e3c0a42bbb7f0dea3e9dea54f8
SHA1 fd67f666e6c5aeca5bc31fdd804ce7cee0537cd0
SHA512 1c5ceb11c3f7a59d2b3cadea6b2303a27270e3863c33e0736b0122be28a6206e61661a6e17d440d2f823aef9a722fb070d2922156178a62ee7161b645e85ef46
SSDEEP 12288:0tH3IlMoLiBQltqm8/9Amqz2FN24dZvHFHZTF6yqyjdF6DeOfYqIzvOd459UvekR:mHgFmZMyCRJRXGG9/yJW9lll7ZUInhF
TLSH
T12C167DEDC97858C3CD629A30B4F0E9477C7413C3F995C1D6889CC584026BBC5BFAA66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
Size 48KB
SHA256 50145bcdfc506b8a9a08ef44ba07c0bff8ea8f62f59ce2032b900b66ec0506d0
MD5 863e8ab459b105d601a4213dba72793e
SHA1 4a3a0815c6f95d9470adbb44cc92952447666973
SHA512 bfa80baae5c6e16fab84a3f2b85b90eadbe6d8c418e5accb89861c116e0eab8836532e66198e37344a334b47e084c20ea662c638fec6c52aed043b588ffae082
SSDEEP 1536:RQjEsPYDWfw8+TYMFI7/j829AhzcmnpVzBUkw/B4jVf:6E6Yaf0xKrAhzcm571
TLSH
T18223F1A871E0D390D2705B3DCC3A4DF26C9199A6700967D5E6BBC7CC330D2A9B09E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 de0267c73a6797944e492d2d872deaa099748890e8fb5add2ae001349b490501
MD5 db7aa8b6115264f3ae7f2dbc3c76350f
SHA1 4dc412962b21a7d83fed6f7fd920695d75d71367
SHA512 8e9c27be8652af6b0ad30efaeb0352e35be3c34b2806f500a8d2c1456e16a5c33d9a96ceb48924a0ef21147576f643e164d11d0d42c3120ca021c6c0a87e3e14
TLSH
T1BE51EA92432427C4E7A04E7225E1B55872FCD47E8507AEC97A026DBCAF05F789ED10A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa980.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aa980.TMP
Size 2KB
SHA256 c1866c4bf8967b3444341837cc798a633479b8a0b596dd56cfaf7ceb04fbff6b
MD5 6a0f8bf732d22d724a02f183bf9290d9
SHA1 f50ac34db5cda454d5e0182421d5c3603c6aa0be
SHA512 b94b90cc9eabd527f9fd263db86ddfeb7e9b46c03165bfd7402a54b35459a4a59bb1368e5773d29871861119447480ddeca8823d56c9c9a65378c1911210b8ea
TLSH
T16541A482532417D1D7A14EB365E1B65832FCD0BD8607AECA7A002D7CAF05F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

bed464ce-634b-4e5e-a8e7-79c431232dd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bed464ce-634b-4e5e-a8e7-79c431232dd7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 340B
SHA256 d70ada537ab076c2239a0827471af545d788b2bc0c854fa115f43b66a77f63ec
MD5 15cb6e9350ec48bb531ab8a5a2dbc29b
SHA1 584f4b487d4620b4dce2e45b682d3ede8d72cffe
SHA512 33af962328d0d2a0d9f647b9e19c713b8e3b7fa444c6c9559b3b493b248d1240360eabf7831d6523bb2dfbe159ffbf94e6c7e5080eeb852d32790a38ed6b35b4
TLSH
T1E6E0D8E559C7C12E959035D242645B08D68439C3E789BE031B448CC57A07001FA93546
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 339b5e3fd000830f244eb0bf69a519b92c7d4ca041258a65955c9603cf0cbac6
MD5 20efadedeb53beb46c55584eeb4876d3
SHA1 3c51454588ebaaa74b38fd646b0714ae0fbd28f6
SHA512 f79696908dc8d59f854feb652ea6774b09118b68295a3f64d314218254dcd35d1c162c89d0f94e6b40d6d9b558d789c4ad35a6b46f2439196ab47efd23e8da67
TLSH
T184E0262905C8F93AD194799BC26C4709EAD839C3A38C3B02578EDC446103242EA87281
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 5ed3fac2e26c9f8fe3f0d657d154778d8c6e6b377298935b9d4c9a7e26bb4e66
MD5 054b5105d098fbe30d8dd8f61c9e14d3
SHA1 43c550fb4d8098be1244a231dd87a6244181f5c2
SHA512 93384c99ea2d0cf3b77e5d1c7921b08b0acd883e31eb4b425c4461500b665946990c900db206f70cffc60718792124f21d88590b142032aeb5b03e9840fff09b
SSDEEP 48:uzBmw6QU1Pz3sa4IfHMQk69sd9xzfcwnzDo0LWQRa:6BCx3ZbDS9xdoAWQRa
TLSH
T12E9283670F347813DB410E3A256B187A9D3BF12C5F52AC08347450718CFD986A0BA8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 3a4d2620a59feff0e70fad00773bd8ae7da35cfc07425409a2177d79eef0a74e
MD5 05d5b06ba19875528f164453948309e1
SHA1 19c1d2653a075b39aa66938b47e0c137b86223a8
SHA512 fb2e099b8b3039b5890a7e746f0cdf6962c468229e3f5050dcb9835263e3f358952512900ea52985b079db571366649522b0b318925666a636fbb9ff12047725
SSDEEP 96:rrMJFhHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9wbbEOVpZf24JkMfXSFR+B:rrMJ4H+bF+UI3iWGVoWN3qL/UVVV63
TLSH
T1BB24FE1E5F243722CDBD913668E744A35C7DF03F8B1366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 257B
SHA256 6a8e653e93bb75b93bf5782e2312db412b351f2af3c4b6da99d153c92a8d2876
MD5 5dd42ea48966bd024f5c7fe3aaa60578
SHA1 27869c9f07cb7bd2a6c5cf86ac5fe6713dce9d06
SHA512 9693804fe463d11db002186f72d3ddd9d0fadc0c280452f5f6607df3758723eef460d4d20c525ecb503925f1eefb50312fa8606675ee5e832e22c93bafcd3df8
TLSH
T145D09EF735454036AF5086F0D815B69CFD33532CDD8A67C5DD2072265992466A90E854
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9d31ebd18e20a6f87871f0717dcd1e47fee398f084b532b33aa5f42ea01a76bd
MD5 5d1e0dd46f590431230812da855715b6
SHA1 2778111a430e53349a011a32504bb02547301c01
SHA512 a136015e5b962007554110c162e8c29d482495dd1d3666703e4d50b5ff97acc0be4bec2bfdd4905c7d43625471db80bdc0ccc4958b882427bb0454f9b7a0a90c
TLSH
T1A3E0D87945CDD16AA244228782286B08DBA43AC6D78C3F051B48A944B44A008EA835C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 6c57ecc178f546743085e017a1c83b6a4ebacc76d01c94d2feae354f4d5228c4
MD5 67f153c5901440a0b91954592ff26e64
SHA1 11578da1c0b0ae6b318b86467c052307e005f856
SHA512 dd8d329fd6d04ee3f3f77b6c99ae97947ed04fb982bcb544cb85b922a67460b0523e6ce39401c77d627035a8989789d9ef1d0ed5a33072a4751b43e139249d41
SSDEEP 48:Txk/LopFMaty423w/a9NUuTo06DwL22UQSMPTHJfghoHswZX4iFzO:qDeMatha9e1b6SUZg+s0E
TLSH
T1A9B2204E2F30B112C0B44B36DDD585A73E7D112DC767368D9E5024729DA269BFA0A07A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 33f38165eeda313a234bb0b181102b714c2e9b5adec118d34d99193172d994cf
MD5 3f37eea27a6179390cccd85b3372b527
SHA1 1ebb02ad3b47ffd8101d09fd91bc4b2563398236
SHA512 6d2cc7dc18fa4ff1922bb8cdbce382f7faf388ce991fcc196c6f22d7e65708fc023bcead9a258bd650d756ce73994780a1785a5b8d98ab10a7a98cc9fdb72c2d
SSDEEP 96:OIEumQv8m1ccnvS6zQliJR/mNLKfzWnFHJ9gBq4g:OIEumQv8m1ccnvS6DRe1s6v
TLSH
T1BBF212F326326141CD8049B4A00C5F8EFF13118653FAAAFCD79457E2E2F25E2B65A746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b09c1ea2-e134-427d-a063-219fef2a58d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b09c1ea2-e134-427d-a063-219fef2a58d6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9413bfed87a4ce9dccb5b3841ac5685fd369a749dc26dd3e96e9e0d77309a546
MD5 d0e2cc7d40073a800d1145b199b87c28
SHA1 03f8efcd482811a53a003b0ae08a44b543910967
SHA512 89f6cfe740e938ea10fc4a51c2317a46e0df72acee1584ced99b3216c405363bd8be5d0e06da482a0645b5e1ed3ad7fa2dd4ab5b265bb16909a5706c34bf0e53
SSDEEP 192:sxRRR9Cy/fZsmWpViDde5lSNzoD8pLH/g6+WNJZzvfutHRVxd3iGduOeGSIgV2J:sxRRiy/fZsmWvic5lSb/5jfI1YU
TLSH
T1BA52A716A928AD7B4CC7D31DFA55BF63D6F91132A1D05E44E7FC8A1C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7301b9c0a2e305b3f6371c7bd234136846d54406533dd318e10119ed8ae91146
MD5 b2c4e6a1b35242d0e443471bcc86223d
SHA1 fbd0d16e8983b7e056028a8cc3f3bde4c18951e5
SHA512 488fdbe8e671de98ec7e97561f90de2c35faac990e26b720fde9f3a764e08f15a7e4f9446f84eb75a7134501bbb56cdc351b3f84ced8ce1b7d298de920c843ed
SSDEEP 768:jC+vcN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8QqcJroZr:jC+vc7E7JQWgQ+f4+u1javVciZ
TLSH
T18BC2EA7B640CCB7F4F804ADDAC197E9B6DA802CB5698CD9047FE941C02C67EE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 6797e4da30d2e3c4d47266ad52704b0ef4c6b1ddfd2b10a18b87dc1454995ec1
MD5 e0cb9023b3140a36f9c8ad205a242f03
SHA1 b12a2d46165b55c15939a5bf8d26a9e05410375c
SHA512 ccfec5d0cbdd35fabf03c803ab26517e6e4c54eda0d9708381595732bb37ead866e3a685f92e3c982e45d7b974590e3d53c0bf2b426b587422ee9690e2bc71a4
TLSH
T10CE0262006C8E17FB29A224746248B4CEAE87DD7D3CC3E422FC8DA456547948F9D3180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 af457ed9b0ce1d1861dd291217bc5fa7b048f7bcb4fcf70bd1fbc41f23000759
MD5 d0fdcc9c8aaf1c7d533da78247a79790
SHA1 c7e76bb947e8d861357fc52534d6f0e042e4165c
SHA512 f29045df597f80a1fcfa5c2ebf0b329c47cb8aa763ee986834ce3e9db2d4c1c34f41d41768f75e656254fe8209f3b22e320f592a011c2fbe20d39e1019fd1b0d
TLSH
T185E0207027C9E73FA186318B8314DB0CD6E2B986D7CC3E112F4CE9456607145FA43240
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 20a8d2682f0d0d6ec3ab4dc6c64da413c689af74955c7b404ded3efae940b9e5
MD5 6076315d56ab9c41565dcbd69af5895e
SHA1 353bfc127ac2694bca2a0a675e11849e0648a225
SHA512 3d6a9c9d5e7189a552b665b89a257357b1e6ce16cea658daaad261bb7b7c3bca92f62a88c2330c97ab6901afc0913b6ae477b5046d85b71a917cca004173c122
TLSH
T1D6E0267547C8E63BA180628782789B0EDBF87DD693CC3B02578C5444A502100FAA7190
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f334f0639218c48839b74f9ec96b5a89faf755e02ff3913fbe32f9c465888835
MD5 9fb6a14829bafa2bfac3e01e44021dde
SHA1 2a33971585875950628b9297ebe26a7d5dd03b8e
SHA512 df32b405e450cc166820e7d1aeb37012d23590f409bfc190324862dbd53dd2926db9f29ce496a5685aa8b443794fcfd1653a2dfc4866810a4f6b2108b539087f
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp85:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkE0
TLSH
T1B9914600313B02C1387DB64CC1B99C6E86C17472341AE66B3FA9456A4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4a91d292a972b5c9690b01ff0e710cd5bc0213cb3f6cc100067766ae1c37deae
MD5 697e49cad2a91c273daf3d932d56e25b
SHA1 86508a7b9594015f3b66b8ce0d301e8c778a2510
SHA512 4dc22ce2e6629fd2b9d0365e900796ebaff7c30064ab3e1e401ff279114a71603895726af9d18e758b0723515af74c959e42598e4cb36974943c8f452c429c3d
SSDEEP 384:DNrRZyCSDnxTICsKMEhIKyll7svbFKfk7:xFZJSDniV7yI1l7svbF9
TLSH
T10944840A7B747001EDE6D9721CB080771E3CB16ECF22A6916DA254694DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 b96d4f9fa061cad8b95fd90c56a632c702daeed0f4f4daf827d0375ef0699dc6
MD5 b79f5eb5783f49873bb6f7d2246e6f3f
SHA1 392e4c40f1a10ce5abb6a3630d4a95495ccaf263
SHA512 28c3819894645fff46ae473c15b26b3931159b9645ca87996773b231edff67d53eca79add47c8550167906c67511f9cf9ddc0e32819cc16fd8cb567a37e362ca
TLSH
T1F0F0C2C76E021977CC12547150336783FF6189CB0424B46743CD246B5A2D2F1C9CC0D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 0f97dc030cbcad959baf5ac8bdb2a3cfe8290cdce875856b703f694a3d022fbd
MD5 730447148aff5d5472aeaf3b067016e7
SHA1 a123ec41b5d3b3ebbdfad2e5afe29112e8d0bcdc
SHA512 eea7bb214637259a0f7d788460c8ba88b9d67baf09ce47eef4c941f5d1fa0912e3531997cc1ac5d12225fad0d4f005c9ceed1ce43a0ea44669fa9a79f28e3f32
TLSH
T199E0202175CCF27FE154328B91284708D6843D97EBCC3A0B5F4CC449640210CFA4B151
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8213d620e47aa2704849c5f5bb859d0bc95ab691a5b8cd8108471d70d8e4f1c6
MD5 c2b370abfecacf011ac63ff74a28e5b8
SHA1 9151342b961e1a33e234855b6b1826d57672a96b
SHA512 e167a23833d4492d51671c92545be9d1071f4463eb2a39c674f3a7b40413bb43bf69736107ccb22ba7765ae05a8504c43d624d3e480cc5a6515a82c9c6432db3
TLSH
T1B5219256F330C004E25D867E506F9B351738E8528FBCED0F857920646E76A180E4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 ed2eba131960e804afa2f72e79fe5087e20396b20c6cee24acc34e3941f2e690
MD5 e959a4c45a4d95b87b3a9ed6213284d3
SHA1 b6243bcf671dea87a028d20411045dd143475918
SHA512 0519cd33010f91e5a98c6806ff016a2db12a8f2317f202414c4bf150a439d5b185cbd136a313815589246f8f01c93661187abd9007219e5ec93efe73f2125b8b
TLSH
T149E0D86065C8E16FD15021C391788788E6953D92EF883F0A6F4488486502141BA4B141
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7267f3231e29512c53542a09b0e5b183008536f4cf51eb7512a139acc3c57776
MD5 405788aa5304d6db94eca4fda61e59eb
SHA1 08ce0d3c334e8dcc44d078889e8f2ce8822ae0df
SHA512 bd5edfd869ae1601ab644ec4bece758fbd26dbc35e6cc2a3fc2f9acedac76f97cbca24773a2158bc3170a60d59c5395d283a87a47bae10c09d77b557f1e654e8
SSDEEP 3:MsEllllkEthXllkl2zEflSQvhs/ll:/M/xT02z/Qyt
TLSH
T10B4404447FD0044DC70010744051C3501371D4110531574734D104335CC75550C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 02eeb911c3c068d0f50b8f737c1183049c4a6c6ae3102eb5024e8d5b8fd1f435
MD5 cdd81a86ccef94acd6df4ccb7be003e7
SHA1 16f001a774c2b1d89d710355f1e0b95efc2714e4
SHA512 a46e302cd8111111c010086f5c5aacb576ac3d4892183bbd3ecbfe8beace9df828f92b0e260a90754d7861d70f5379f482a538148e152649ed1e9b4a49efc493
SSDEEP 3:MsEllllkEthXllkl2zEflJR+/l:/M/xT02zmR+/
TLSH
T138440404FFD00C0DC50030704151C7501371F4504531575335D304337CC75510C10400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f57b16440d883b528efe2591717835bb27a9c905597304af20a4bbc613325e0f
MD5 6afe3e0549f404b458652fb368989d32
SHA1 6fbc355834dde2da19507ddb54e764686b1ddd55
SHA512 da5ee2202c20379c33bc75d3d4b049aef52eb1b1993bd1f23bfbb623ac9848acf407253eb4e7f0dfa4d106d7b0dde0fcb89217863d0c9e2b8870cc0f5b516ac7
SSDEEP 768:rrv+4UNbdD3IW4ONp8+p3bd66j+4BRv86aLIT82bwCl1:rbsbp3bL8+p3Z6n4yN0ww
TLSH
T10D03BE72E56CD9339CF6C64472867B837FF811A399C10E94E8D96B4E405A29E370F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 62f7849572f37e2a667d7bb67699f98eb784c83e1fe9244d1ec1c72918f71768
MD5 da20bc60841137449b6bb3d02af02cf9
SHA1 0d7c5adbdde9d618070f90c7c4342f7d189538f6
SHA512 d4e9ff226d52a75322454a5c416dbf2713190bec05c9e77cb2530c65051a6e8cb588fa7512a10fcbe6246ac38ec776a5e8c60d9205a109338a00a06dbe940d3b
SSDEEP 768:qrv+4UNbdD3Z1C44ONp8+p3bd66j+4BRv86aLIW82bwClP:qbsbp3r7L8+p3Z6n4ya0w6
TLSH
T13C13BE72E9A8DD339CF6C64472467B837FF851A398C10E94D8C95B4E405A29E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 7e5ed859fcdd49abaea10607fb48c75f9068925ecf18e2dca021f742784df282
MD5 c26000b0c764681318e8123aa8a236bd
SHA1 98654741ac0a7c6b1b798d9915b036ddb222f9d3
SHA512 a70a10873cecde42245aa8002909013fedcc1a333f717bfb7e24ae10ea8d0e7f3c2e88b9ea8c95cf1b9402b836386cc0a43268508a905848bb8b2aee39447315
SSDEEP 768:Trv+4UNbdD381zPg4Orp8+p3bd66j+4BRv86aLIWLS9N0Jq:Tbsbp36cN8+p3Z6n4yBC0o
TLSH
T144137D7DEC58993F88EEB704714E2A136EA84233D5F019A4D7D91B4DC1760ADF70A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b63c92f5a15fe2a97ca29e2ad5222cb923969849367d4898f0540377337c1894
MD5 07e277fbebf3b51b73b3edd01a4928f5
SHA1 87118af107d06d19bd1747c5743e520a38ebb427
SHA512 5aa3f6d3c4e382bb4f56e80762d9d125657ecefe4346f853d135f350299a3952a595bbf686e43680c48ed6161e55697015ff2506f958665cff2d4473930a5938
SSDEEP 768:Irv+4UNbdD3pcONp8+p3bd66j+4BRv86aLIiV2bwCl1:Ibsbp3xL8+p3Z6n4yn0ww
TLSH
T16903BE73F9A899339CF6C644B24A7B437FF851A396C10AC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8063e68131496501c18087750c78630f97d725ac2590d0b64d12fc229674d84d
MD5 975270d678ebff3c5589f7ebcc5292d6
SHA1 90f0529c3fabe08c0809b8785f7f16580c0c20a7
SHA512 9279b8b42925dca3fe3e6de260cd6097ed34d1f7ac59f5eb010ea3eeae30f78e2bc74b48bb0eaf9b3d3a4a5c95f0b075522a82c36924272e1a0125659950d9a8
SSDEEP 3:MsEllllkEthXllkl2zEflp5R+/l:/M/xT02z+5R+/
TLSH
T1B44404047FC4144DC5001130D053C3501771F4100571574334D114335CC75401C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

08f6fbed-26f5-41bf-ac22-11275706c6e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08f6fbed-26f5-41bf-ac22-11275706c6e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/3944-8-0x0000000180000000-0x00000001804BC000-memory.dmp

Download

memory/3944-10-0x0000000180000000-0x00000001804BC000-memory.dmp

Download

memory/3944-0-0x0000000180000000-0x00000001804BC000-memory.dmp

Download