hxxp://www[.]rightsidestory[.]com/

Analysis

user interaction
yes
max time kernel
329s
max time network
329s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.rightsidestory.com/
Sample261001-gpf5ps1thy

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3960	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{C3F1E1C4-99CF-401F-833B-E127EA4313E7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4620	4188	msedge.exe	88
PID 4188 wrote to memory of 3960	4188	msedge.exe	89
PID 4188 wrote to memory of 3660	4188	msedge.exe	90
PID 4188 wrote to memory of 3660	4188	msedge.exe	90
PID 4188 wrote to memory of 3660	4188	msedge.exe	90
PID 4188 wrote to memory of 1532	4188	msedge.exe	91
PID 4188 wrote to memory of 1532	4188	msedge.exe	91
PID 4188 wrote to memory of 3412	4188	msedge.exe	93
PID 4188 wrote to memory of 1604	4188	msedge.exe	94
PID 4188 wrote to memory of 3412	4188	msedge.exe	93
PID 4188 wrote to memory of 3412	4188	msedge.exe	93
PID 4188 wrote to memory of 1604	4188	msedge.exe	94
PID 4188 wrote to memory of 1604	4188	msedge.exe	94
PID 4188 wrote to memory of 3020	4188	msedge.exe	95
PID 4188 wrote to memory of 2664	4188	msedge.exe	96
PID 4188 wrote to memory of 3020	4188	msedge.exe	95
PID 4188 wrote to memory of 3020	4188	msedge.exe	95
PID 4188 wrote to memory of 2664	4188	msedge.exe	96
PID 4188 wrote to memory of 2664	4188	msedge.exe	96
PID 4188 wrote to memory of 1576	4188	msedge.exe	100
PID 4188 wrote to memory of 1576	4188	msedge.exe	100
PID 4188 wrote to memory of 1576	4188	msedge.exe	100
PID 4188 wrote to memory of 4200	4188	msedge.exe	102
PID 4188 wrote to memory of 4200	4188	msedge.exe	102
PID 4188 wrote to memory of 3708	4188	msedge.exe	101
PID 4188 wrote to memory of 3708	4188	msedge.exe	101
PID 4188 wrote to memory of 2364	4188	msedge.exe	104
PID 4188 wrote to memory of 532	4188	msedge.exe	115
PID 4188 wrote to memory of 3684	4188	msedge.exe	116
PID 4188 wrote to memory of 2380	4188	msedge.exe	117
PID 4188 wrote to memory of 3452	4188	msedge.exe	125
PID 4188 wrote to memory of 3452	4188	msedge.exe	125
PID 4188 wrote to memory of 2440	4188	msedge.exe	132
PID 4188 wrote to memory of 4256	4188	msedge.exe	136
PID 4188 wrote to memory of 3372	4188	msedge.exe	137
PID 4188 wrote to memory of 4256	4188	msedge.exe	136
PID 4188 wrote to memory of 3372	4188	msedge.exe	137
PID 4188 wrote to memory of 4596	4188	msedge.exe	138
PID 4188 wrote to memory of 4596	4188	msedge.exe	138
PID 4188 wrote to memory of 4592	4188	msedge.exe	139
PID 4188 wrote to memory of 4592	4188	msedge.exe	139
PID 4188 wrote to memory of 2848	4188	msedge.exe	140
PID 4188 wrote to memory of 2848	4188	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.rightsidestory.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff7337c188,0x7fff7337c194,0x7fff7337c1a0
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,18393899916708298539,5432541277085902914,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,8736316705741653640,6757061938330324345,262144 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:2
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,11735393199563964249,11058084796573322890,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,14210398709487852130,6846739584825365190,2097152 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1072819383407082729,15912838232392914665,2097152 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,631310763522858946,5183636026236239044,2097152 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,15797022227328669487,15768442485805907614,2097152 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,5712433353811994005,11407357505098063636,2097152 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,13284104163263088043,2668029258847734253,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,13227017650119594744,9317545820832389527,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10818852382191606493,11491082629954310977,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10818852382191606493,11491082629954310977,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10930216930560975451,6492376484796880650,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9777532264858451363,13440566843487370961,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12167669805380584069,17640685069599598253,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,11216808027266397486,3297872012170466503,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4204,i,7883237043397330105,17442031820538992854,262144 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,12044562693939953189,7426316804091623518,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,16834866444111665612,10367509309980567561,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,5561928533698610973,15604172366141194956,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,16937277365576721171,11230675644347979151,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,13061229167959975627,13424018644722643578,524288 --field-trial-handle=2812,i,15389606154154748938,4951112249017590253,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1dcd75d3d99bf523fe992a131f12ec4237e6da5ada154099e247a5796f0a9e8f
MD5 010acdef3b953d5e7a2b0e13b9737954
SHA1 4f52ec64223cf237470708de426958b923fa1c39
SHA512 10c79a5d049301929556c65e7a20dc73e14f96af8a9c8b02b22abf0f1965a03fea9f57662997629f8ce5454027ffab7198725b205751ece16bc470a6cd1deeed
TLSH
T161E020E615C5C61F520465C7426C4B4C83A0361B93C0794F6708CDC9740508863875A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eabae94f7cad8ee0ea5e07e4acd72c992aae1a7267a723d679db8c3e33919715
MD5 75de7b79de9882a91e539e6695c8d504
SHA1 1c9a618e17fa63a555f6ed22262be84480db63ba
SHA512 593ccc6bf52df155fbb71e75a78f612c1bd78ec596071f57e41f9cde1da516ac7e137be580adc504c31888a621268e67b5d5d4c234c0e78f06748c792bf565a7
TLSH
T1426153CE26C0C461FB9B717C809D2D8F2526A58A245EEB833454C66B7CCBFD16CDC260
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 39022bd9d0784887244da40c9932e83bc2a77cb994d560a7b77c99c27a255f89
MD5 ef09a7db25207c2a5fb9173771b82f9c
SHA1 a46ba2de7b5feb50469665ab66d684d74659ae73
SHA512 02b5eb9a69b13e4cad3e6b145841c978771b9899a4919a4539fb600d186b1d345e7de540829bcb4b6b839bf91db5ade47ac61ec2bfbcfddf9364c91856635d84
SSDEEP 96:DJOI14vob+8Mz1TW2sSB9tnst1LcwB1Tz8wmi:DMI14voC8MRa2sSBnst1ww3v8/i
TLSH
T14DB19FA3C7F8865DC80256F0AA286D16DF9F0964533C3D5DC8D9AE9B93F3470D241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 2afd3c7a07b41f2163b8a5314eac186025084dfbe72a2d9140cd8650a95dfb6f
MD5 426a72b674fa889b615090049f005e25
SHA1 a65935899c64038194a6179f4ccebd04280d92ff
SHA512 9b475efff9588973c5716f8a8823c264a50ea1d32c6f4767127f1a95b9b366df99684dcbadab3ac6c52dc453194d6d137d051aa56928c259c80a6e11ea291cf5
SSDEEP 384:sxZ+YA/f9sp66s8qMpRiYnazAW8pZS15posJWeT+XupHbqZXht:s2YA/fK4Mnc7WeT+XYHbWT
TLSH
T1D8B21905A924C87B9EC36D19683C7E33E9EC506222C5DEDE1AECCA1C029D1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a960bede23724d0f2c4b30338133b9d195a285d185bf275244288805aa799bf4
MD5 25530b92e7cceb7ec84bfe3a7ac119fa
SHA1 7fc63225b24c2146e95d05384d05902a00ef7132
SHA512 8c7915fb38bc06f214d2ff2ed605132969c29f14a7cce25089d935902e42c8dbf153412f7bdd09864c056d87642222ec51e3d58a5c9cf0fa3e0516c78509276f
SSDEEP 192:sxZFRPWA/f9sjNIdpSAHW6+WNBuGC/Y36jneIZIgrJ:sxZFYA/f9sjubHbYv/Xjv9
TLSH
T1C122B9126E34A97B4CC7E20ABA25BF13E6FA5032A1D51E4CAAFC951C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a4e83a1844ca25744100ddaa9ac567fc92a3e1d49e2a6298c91d5f7d6bc40398
MD5 cafc65e05241fa4e85b5a7ccfb1faf2e
SHA1 51164fa2d6b9bd7a6bf784c33353ec013b78176b
SHA512 c367486e6a101e93b089e60d14a92ea58b0cb113e4f70cd0456267b796123bb578a2373426114a56edc807e221151fae7a69e842318085cea5be9ce5caac6e46
SSDEEP 192:sxZFRPWA/f9skNIdpSAHW6+WNBuGC/Y36jteIZIg5FJ:sxZFYA/f9skubHbYv/Xjpt
TLSH
T1C722B8526D38A97B8CC7E209BA25BF13E6FA503291D11E4CA6FC9A1C05E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 49fca0963229671a8655750d96b10db1385a5d5bb8f08c2ec99056da198b6044
MD5 0f90194caa06060992ccca4ade7c3d64
SHA1 5d39b154c4c840c0013f49238c3dcf75c074537d
SHA512 f866544d4f01ede4a703d321dfea66639f02f75bdf82ae2882e5f675c0879f958d07a5a8afd9db9061521a43478c556267142f73d28da2f85575e6ea3f49afdd
SSDEEP 192:sxZ+RPWA/f9skNIdpSAHW6+WNBCuXY36yeIZIg5FJ:sxZ+YA/f9skubHbZXXwt
TLSH
T13022B8526D38A9BB8CC7E209BA15BF53E6FA503291D11E4CAAFC961C05E67CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 744c4ef5cde1c686e336a0eb19edc3e2eb1264a38645615f124df7784f68991b
MD5 8dee71ab7cba40f62736136dfb59e4c3
SHA1 5344ba28bd53c849d5c81f4a4b02869648fc4b4a
SHA512 ae5dd273ffea0be5dc6c7a2f921910cf3a554509b7d5fb8bd2c85b421be7cf68df510e29fb2d04d59740246a491f4841d6f603e5d9e6ab57c31e648ce2e78875
SSDEEP 192:sxZFRPWA/f9scNIdpSAHW6+WNBuGC/Y36jneIZIg53J:sxZFYA/f9scubHbYv/Xjvr
TLSH
T1AE22B8126E34A97B8CC7E209BA25BF53E6FA503291D51E4CAAFC951C05E67DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f98b91578c43693a1a975ecc01c958eee31914122da7e237408ab238a2d0c9e3
MD5 d7568da10d565bf6c5a41870d2890e5e
SHA1 260e8d2af02e6239af82f8e06ed7b1634f98a191
SHA512 44ceea9ea2e5eba40cd3fa5f0d4576644ceaa5b6de572f36df0a7164c0240ddbffb4c389865fdcd966751e3ebfc226fe7e6ee8d70cf529ebc88c2da7a031872d
SSDEEP 192:sxZ+RPWA/f9skNIdpwAHW6+WNBCuXY361eIZIg5FJ:sxZ+YA/f9skupHbZXXRt
TLSH
T1BA32B8526D38A9BB8CC7E209BA15BF53E6FA503291D11E4CAAFC961C05E67DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d28dce48f4d61d84be5c83397a60a7fbb2b24af0d8fd18f38c6bce00a0f754f5
MD5 b28826988a9df19a4824bb6bb8efddfc
SHA1 cd151c308d84b8e12d1e67d1df4ce402dd1450bf
SHA512 a9ada8e6bf41df6622000cd6c2820d26364b6303c4b913cd8a3542fdea7177adfc94343e1d2975966c6a53d100c2c83e3fdcb9333d504942bffdde0094d59fd2
SSDEEP 768:zPKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/EroB6:zPKlm7QWvUYe0u1ja8/L/E/PB6
TLSH
T132C2FA3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D404BFA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 273B
SHA256 9b30736236c24e73bb7c90e93bc0c6acea6fba0afc94b0e43574e941d22208d0
MD5 4e50bb692240d8e8ecd12a191e09bf6f
SHA1 1618c4b548b258a899a074758f540205cd9df074
SHA512 646d7c8c498e4415f5eedd59707f9a0c062571805a006514017d3a90d3384a78a0d92ccc18cea3ebdd4049e218bb4b94dfbfdab44a0a5799c24b5439444b59a2
TLSH
T1D3D02BB72D755410DCBFE7D6103268A00010B894E959FC5E652C85971063725B416D21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ea6f56b22c3baed3df6b120e5a6bc0b89aeb11f01b9ac6c401f7410351f8b42c
MD5 03cb731fbf1b336363b097f04040c584
SHA1 a93ba9a56fa21211ede5633156bfb18aa442ba95
SHA512 2e10bf9f2b3aa91b3ff4fd884d450855c27b095b7dc9aa23169ec6a48ce7bc5a7d7f035e11eb39f52902a9bcd1b6e495f8ca0da9d409b4b79a9b742838d64199
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayLo3uyYCmnb+l+ISKnK9m1cnxw3YNuW8:KIZCK6QK2/eKgIXW0KXqKb
TLSH
T1F1916301346B164438BE264C92B49AAB954130F33029E96F7BF851D24E6FF144EFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ad543fc-9a29-4dba-a977-5f1396b80d7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0ad543fc-9a29-4dba-a977-5f1396b80d7d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bac71502ccdeb6202b1ac8dbc342d2d32c2ffeea8a6bf23002ff8bab8042d2d2
MD5 aad79112cdcb289cae5c034ab7ee74f5
SHA1 96a8ecbb3ddfc8f23ebae5e46405b7f599f1d6e9
SHA512 f4bc8aecc0ad161a7707dd8b6ba63a665d543c1b37b134c8d4a08e262afa9fa65639adccf63eab5956d4f96945c9cc1b9ba453ab24602069e40e86c25855c07a
SSDEEP 384:zZcIhsN1rbbiWxh//WIC12rVZh6DKhH8Gou:rhQf/TrfYGH8GV
TLSH
T139828C33AC78AC7A5EF3E541F0437A035EB48063A7C95F9495ED7B2D02EA5A81317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 64f6f33c34a19beb68c5f8ac25f6d250e7e3968dd1cb2cc37d4418952e611c0b
MD5 851109616c17c13720f2672ab18689c7
SHA1 6238a5503e43b11e18e48f30d8ab209f25b07927
SHA512 15836dd09349b211ec599538352b32bf2d3f6e9a3960fea3a27e370c3aa97514e6d503ed343659c2c085734d34610f9167fba80be020ba774d16622e950596de
SSDEEP 384:UiF7ZcIPasNo8TUNTUlIlebbiXxh//WIC1mrVZh6DKhH8Gou:vFjiHwgPf/zrfYGH8GV
TLSH
T147C229F248D7983ADDAE9B43A33E2E035E7CC063B5855A50B788662DCD960BFD307811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4662e203ce34b52331fe53064a6c95ba9dfe5d927bb1397c56947e2636eea066
MD5 68ec6ea16bc77d55c1a70aa6e8264bb2
SHA1 f82b3c259c97f3cedd85ccbb5f3f01b0340f01c8
SHA512 667fe81ed15eef28ffe460823d554bebcaade73c816084d3b18d24e48954f5f221e430e4f2004f5003a6b4a8a84c33be80fad90e7ca5d09b9e5d6dce7cc0e34c
SSDEEP 384:UiFPZcIPasN98TUNTUlIReKb0Xxh//WIC1grVZh6DKhH8Gou:vFHiYwgEf/5rfYGH8GV
TLSH
T12DC228F248D7983ADDAE9B43A37E2E035E7CC063B5855A50B788662CCD960BFD307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4f50609f9135172485369850c926a9ce21c269e827eded07caf6dd5728366e63
MD5 3d4192a72714ef9f78ebde7dfdc7dcb0
SHA1 859b3a1b61f1770c2d4cbfce0152f312afe5abbc
SHA512 dc2b4ad164731d1bb104034c55863e39996d1e7b0984dae5cdfb9b9735cdaa7bee89688f7f992bbdd4f351d0db186540adfd39829e431b76b7c309278108d431
SSDEEP 384:UiFiZcIPzsNP8TUNTUlIlCbbiXxh//WIC1ArVZh6DKhH8Gou:vFQrSwg/f/LrfYGH8GV
TLSH
T1F7C218F248D7983ADDAE9B43A73E2E035E7CC063B5855A50B788662DCD960BFD307811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b05ac32d625c30a25db4918d48c0c27f99ea391aa4a56c7abf3930b1436fdeb7
MD5 461efd8bc4c5c8bd08f5fe9a8f681ac2
SHA1 db3701a49ec9a3e017cc64d68311960324e921e1
SHA512 8fe123da959d2588976b816d17db56641a6a00e8baaa6a7a724e656934e1190318d1568aa323af33f9f6546f30bdf70d76932dda05aebac406ad0798dd8548bf
SSDEEP 96:KqONkLQsjpfbUmjH5ih/cIPURHl8h4otop5uaDcBKP4v+Y1xf//ojdhxlDeYu7MM:BONz6JUm0QmiUyjwso//WA7MBChPU6
TLSH
T1A702E939AC68BCBB8EF39E45F04777239FA4107BA6951F44DAD86E2D01D755C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d38ad924228545966ac7d6e997dd63b5477e7b653799335b9cd465c24857bd2
MD5 565193a25e598113a13f9dcb493c1ed0
SHA1 9a7b70292e8272c3ba1abb81ba8ea5f2b7628efc
SHA512 3eeabed957dc79f3f8f696c5408f924082b07801a68fdf8d2ae1f387e665e6a52e15b60fbc8ef290cb37bdf1b62bf4ff84b542abf1a86e40c18a89685fcddcfc
SSDEEP 192:BON46JUjQmiUyWwDo//WA7C1GezVNxgqBU6:BON46+V6Do//WIC13rU6
TLSH
T1F6120A35B868BC7B4EE3A994F04336139E744167EB896F50DADC3B2C02EB59C5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8cc19fc6774d6a023e16c9d64a3cbd83724f86e5d77ee67bdbb4425415b330ae
MD5 e448e5bca96db4ce4db88a9c9c9b3cbd
SHA1 dbd9a4c055aafff52ce46fe25306f458ef7f6d5e
SHA512 29d60ac79f0d2f92ff4fbda7ee7927ac9253e9b9992f7b874675fd7d0e261546a7aae743b148068b14a61ba2edadd172d1e39459a55af560ffabf2a68044de66
SSDEEP 384:fZcIhsN1CbbiWxh//WIC12rVZh6DKhH8Gou:3hlf/TrfYGH8GV
TLSH
T1AE828C73AC78AC7A4DF3E540F0437A036EB4806797C95F9495EC7B2E02EA5981313C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdb769ad-37ea-4edd-bfaf-dd4d974da744.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fdb769ad-37ea-4edd-bfaf-dd4d974da744.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d299c1d8f3e0cf5fa3aa539e6f4cfb0d8a1e62204f2d708896dbf416bab10f7c
MD5 fc5c9140f7f4ef714346039e6c5773c9
SHA1 bdee7907986bd373e6d34abcbaae174e9303bf74
SHA512 d71d1eb379c29f419ee08c0eb8b67179fa0813058711da2b1c7ce2c7f75bf2507b796573c10db865e34abe3ce92d7360ce0159763bd899180d66e96cb7c9d7b0
TLSH
T14A41EB58A6E91148B3B76E5A9BF7A82E487BB9372E06D55D40110E4F0A67F00C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_txr10144.yjr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txr10144.yjr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2664-481-0x000002C249250000-0x000002C249272000-memory.dmp

Download

memory/2664-482-0x000002C2499B0000-0x000002C2499F4000-memory.dmp

Download

memory/2664-483-0x000002C249A80000-0x000002C249AF6000-memory.dmp

Download