e19bc63e2a6521f74b322dae41fd0d8d9125b968eb3f073c1368b0e82d45dabc

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.2MB
Sample261012-29rr6afb34
SHA256 e19bc63e2a6521f74b322dae41fd0d8d9125b968eb3f073c1368b0e82d45dabc
MD5 42d83ae444f44406c4fb9c604cbe6b58
SHA1 61fc74c936fb4ca434f2c146f72a2a89f319f37a
SHA512 2c0d91a166ee1beb85eff649db20f00f1eb56749acbe65716f87431902dd20337030a9ba19baf80f6de5ea086a30942e41d597fe60c6ea0d42d33d9d64da3793
SSDEEP 24576:lmm7gNiI6co98elSjDkv7Z+Tlym/XJMo0tDfyJYqD7Mt5YHTi2a8KW/aH5H:lmqgNiI6P983DC4lym/m7qD6R2uj1
TLSH
T120262816B5C000EDC58ED33649E4696A37B63CAA4733A7C71B54BB742F22BD55B38B08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2396	msedge.exe
5948	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{30C955D1-4477-4155-9534-D33FDCF80970}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
204	msedge.exe
204	msedge.exe
204	msedge.exe
204	msedge.exe
4248	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeDebugPrivilege	3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
204	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 204	3776	2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 204 wrote to memory of 2344	204	msedge.exe	90
PID 204 wrote to memory of 4132	204	msedge.exe	91
PID 204 wrote to memory of 2396	204	msedge.exe	92
PID 204 wrote to memory of 4132	204	msedge.exe	91
PID 204 wrote to memory of 4132	204	msedge.exe	91
PID 204 wrote to memory of 5176	204	msedge.exe	93
PID 204 wrote to memory of 5176	204	msedge.exe	93
PID 204 wrote to memory of 1884	204	msedge.exe	96
PID 204 wrote to memory of 3424	204	msedge.exe	95
PID 204 wrote to memory of 1884	204	msedge.exe	96
PID 204 wrote to memory of 1884	204	msedge.exe	96
PID 204 wrote to memory of 3424	204	msedge.exe	95
PID 204 wrote to memory of 3424	204	msedge.exe	95
PID 204 wrote to memory of 4864	204	msedge.exe	97
PID 204 wrote to memory of 4920	204	msedge.exe	98
PID 204 wrote to memory of 4864	204	msedge.exe	97
PID 204 wrote to memory of 4864	204	msedge.exe	97
PID 204 wrote to memory of 4920	204	msedge.exe	98
PID 204 wrote to memory of 4920	204	msedge.exe	98
PID 204 wrote to memory of 5244	204	msedge.exe	99
PID 204 wrote to memory of 5244	204	msedge.exe	99
PID 204 wrote to memory of 5956	204	msedge.exe	100
PID 204 wrote to memory of 5956	204	msedge.exe	100
PID 204 wrote to memory of 864	204	msedge.exe	102
PID 4248 wrote to memory of 4536	4248	msedge.exe	105
PID 4248 wrote to memory of 5948	4248	msedge.exe	106
PID 4248 wrote to memory of 2072	4248	msedge.exe	109
PID 4248 wrote to memory of 2072	4248	msedge.exe	109
PID 4248 wrote to memory of 3436	4248	msedge.exe	110
PID 4248 wrote to memory of 3436	4248	msedge.exe	110
PID 4248 wrote to memory of 3436	4248	msedge.exe	110
PID 4248 wrote to memory of 4688	4248	msedge.exe	107
PID 4248 wrote to memory of 4688	4248	msedge.exe	107
PID 4248 wrote to memory of 4688	4248	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_42d83ae444f44406c4fb9c604cbe6b58_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --disable-logging --log-level=3 --noerrdialogs about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffc3d5bc188,0x7ffc3d5bc194,0x7ffc3d5bc1a0
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,10769546584159911157,2298748574457485556,262144 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14715321185308438465,18259953495211555757,524288 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,4368141205613182605,15009626218128965063,524288 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3024 /prefetch:13
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,1723614240660459679,841060532735440042,2097152 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,4809263155701665216,3254093869307001226,2097152 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,6124920892682464025,2640338602798558713,2097152 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11484405490022157128,12166173957429774755,2097152 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4400 /prefetch:9
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,11935107336404588995,6612803177094466004,524288 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,2343170503570639270,5246829596298655924,524288 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3725335000097569540,6791940182809490984,524288 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3725335000097569540,6791940182809490984,524288 --field-trial-handle=2248,i,4889008649854828213,11853973919599776188,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc3d5bc188,0x7ffc3d5bc194,0x7ffc3d5bc1a0
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,11930615954358986809,5778459077204744328,524288 --field-trial-handle=2184,i,14914629989126429994,10568476263075147654,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,11155382149141914539,16264144944706210872,262144 --field-trial-handle=2184,i,14914629989126429994,10568476263075147654,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,12000234492214930767,3946561512308752995,524288 --field-trial-handle=2184,i,14914629989126429994,10568476263075147654,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12112217695198169092,6754687370199970767,2097152 --field-trial-handle=2184,i,14914629989126429994,10568476263075147654,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:9
  2⤵
  PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

72cf98d1-3473-4c35-857a-54c8781d00fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72cf98d1-3473-4c35-857a-54c8781d00fc.tmp
Size 37KB
SHA256 b4cd9d376edb8686911a2aff58025bb5725d22c9035f8f40adf71b81410f7e6e
MD5 bb3cb8b857d63196e6d664bfb49e3009
SHA1 25e2b7651ddb280af7bd71cf85800c89b5a6dced
SHA512 66b983a3d28a77de39e3ef24c08be9669cc777945cd01c66dd30588ce2e69d1c04c139004734bb14e9042b5e39eacac9967dbd3f7cdb507ae012e843a26ce1a1
SSDEEP 768:5/UxvxjgC+936BwO+YUu5fgGM1TnXMqOe0AaP8:sZj3+93Dcfgt1TnxOzAG8
TLSH
T1B803C036AC556C779CF3D384B20AA296AEF144A3C6C51EA889EC7D0E05C735D430BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8dff5de7c0b7d05e94f29a9385b4233b1215dfade97d1ecfb981ee94c8c76745
MD5 31c5534617ed223642375043d7e1f3b3
SHA1 24772a5ccad9acb1af23f649ca4bfd1e587070e8
SHA512 d42e1aca9171b4dc827ba0ead092e11bb055aee6547ead6b09dae88ea467b59bf9546e7546fed039fcd2924c5da4a5e128df8bf9fe7cd6bbbd1e366586d76db6
TLSH
T1B2D0C0F07AFCDAD3D06850BC00F00424113832336B14C3E03300D44849341C20802BA9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98c6685caf102b22d3031050f1dd851c89d2ebd89c2dcdcef285d4718c42559f
MD5 7aee4f37906a3679f1c4da412e8ea16a
SHA1 01adb6838ebadc427e87ba8ea3073152bee55b79
SHA512 cb2f0b68b18a22a6d7ad848be4cf3ff5716e1c457ee017a8a61ef062a231a0c7b3d30147a47146e6d0b87f6088aa999002250a39c760ae949441946f70b78663
TLSH
T12ED024F0F7DCD443C0D4507400F1157411357130151CC3F03311D1CC05043C10711355
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

3dca45d9-4be2-4aa5-ad27-8204f1c8ee6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3dca45d9-4be2-4aa5-ad27-8204f1c8ee6d.tmp
Size 27KB
SHA256 b7c6351261d9bbd011b2b410e69ba8de3a002151535a7f61d189b5917dd1f120
MD5 07b84819755839bfb78ea7c4b98a4427
SHA1 b9785e4700c5341439f3f5f953bdb7d378aadb01
SHA512 958d67493599dea5b6a44948d5165e6fbb62d300a56ee6ff30bea111f564fda1c50c601ddffe42c41f86f1445e918dc340fca5459488c1dfaf6dfdf0a4b3cf38
SSDEEP 768:UEg+xC7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw6tU6roqqz8:UEg+xaEb7uWgf/fXHu1jaJ4Uxa
TLSH
T130C2EB6F744CCF7F4FC00ADD981A7E9B6DA802CB5698CD8047FE991C02C67EA92154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43a9ad15-ff02-42cb-b0c6-f46476d01814.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43a9ad15-ff02-42cb-b0c6-f46476d01814.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99c65172-dae6-430a-8d22-8e2ea07f728d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99c65172-dae6-430a-8d22-8e2ea07f728d.tmp
Size 10KB
SHA256 6a793646539cc34b8b72a4bf93db0a4e83092647b8ed64a216278bad710db8fd
MD5 30321fd0e00927536c70456fa5d74786
SHA1 cc0fa4eb66dd3c9140eddb0c345b289ae2103c0b
SHA512 1fdc98619fe9e2a247cc077b0c663b364c61bcf7a5ccdee2c59a1f7b93f27fcd84da5a45590748797f90d57efc38ad06bc0dd73dd7b7140846b147b94cedf471
SSDEEP 192:sxRUSr5Vs11qmzoV8pi/g6+WNIYRpHjrJqvIgBHJ:sxRUSlVsffi/5Iwruf
TLSH
T13732A615AD28A97B8CCBE21DFB667F53D6F9503270D15A08E6FC8A1C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7726cbf3682b301c9464c05e40ac63afcb10193933b7ffc2dd3da35f04f1f91f
MD5 72b462046b719b09c34b1d60884efe69
SHA1 6f5809b89ba4d0f668dd4e5eee957267e3aa1cca
SHA512 5e44a31d92295e3c9f8ee260475477f35322e756f805a1cad7cb8378a70b84cf4cd62c58e422485738067a76a91802eafedfb4e42853a5d9d45b2484a5c759d8
TLSH
T11A6151C1939DA094D79D32F89EFB0387363456B358436F913669D734BCC23ED8142A08
MD5 SHA1 SHA512 TLSH

Submit Download

574bce2f-c184-43a0-9059-47ee21132d3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\574bce2f-c184-43a0-9059-47ee21132d3c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 f8752ce39ddb6246f757e016bb5b6136ee8accc4fec292c8bd23e1e4c795dd09
MD5 71496a0b4e1d3678fcfefcce617062ce
SHA1 3ecc40e9197fd77efca4c57b7becf813ae66d1ff
SHA512 804c30712f41b203339c6f0b496ce4bf5f7cf4cc68b87c1ef96f0dcb9da9d229782266233f2fcd123d9702e4c1465a6efd22782dcd2fbd4a0a3a9f69fadb8704
TLSH
T1D8E0D8D4E4DFC12D762838C203286748D3813496DA92AE872740C9CCB646245B74EA7A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 4acefbcee4da3a1879d5e3cb1e0afee7e96935b28e7b1f5ff073b1f18603dd2f
MD5 2fdb18d03adaa361db5d7c9d065ecdfa
SHA1 5e899a8724294162edb48f557a3e34f21b61ac57
SHA512 d911bde1bcbc4111082296043e3202644d4750c81459ead8d75a05bf413472828139ece8282dab26379b2b7db07ae26e402807e392cfe5babc3f5a9d07c5df04
TLSH
T1A6E0DF2474CEC1299328658283ACD308C390645EA2C03DC62788C8C4B042624BB8EE96
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 304B
SHA256 1f844da045ae4e4e56937a272b1c4679f12badfc99e892895bf61bcaea111fc6
MD5 e31621408f289cd9771b4a7bee72f0e6
SHA1 730336e9c21b7f4f753b1fd9c4cafb9d868be5e9
SHA512 a0fe5b23623294e52f151bac2e1d57ecdcaaad55297289ddf3657329e75744e6776ddf4421e5d7e89f899f72465181a9e33dd8e0ac64671678ab6126344a1f60
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 8c4de5c95e73b24eb397e44538c96a0cecea212974d855efd78323089333a01f
MD5 241044f4bb9ac66a32d7ff7ec798c94c
SHA1 a4231484b5627e3f5cd963d7f06ade401b44d49c
SHA512 5257ebc36ee44b749c26ad08f57a43f64642162c0e2f3a67ed6c42620857bb3802da4d8b66d9049d3cc666fb7b266e400dabce6d65c1cacfc0697ee20c4a2f50
TLSH
T1EDE0262868CAC139931869C3037CA34C83D2345AA2C07DC62788CCC4A046300FB8EF96
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 9eeea8a4c0a094f7e78add129275461e8620a7cd306ba7fea9cb29c8401d9c41
MD5 8ecb6144bb97f7062f0b8d1e8626d413
SHA1 8dfa041a9ef77cdacf8ca92d012f638befd2ee1d
SHA512 a38667625388275973b057fed6cb9cc77d1b625f3f16da1fadd7f6aa64c5bd526d963cf08f881de9aa8e1e8c9e12db18439ecc85b076b511631f6fe499a9341b
TLSH
T192E0262458CAC13A911CA8D3026C774CCBD034D3A2C03D862B8AD8C4E502341E38FBA4
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 8fc2769221e5bcad771efe24cd5a8943852fd059ca26d1eebaceb22ab24df8ca
MD5 1a96bafc6e547905d2d9e88b9a568646
SHA1 b59a99cd9809710d0a3193f91f021e75a3681a1a
SHA512 347cd19a67f4edac72ec26115790e8ee57dd1ea3b2ba3b068e61a74f92997cd8ff15e36acca93a93efd20864608245a46215cfda651d2ed1442bec706b2abe9d
TLSH
T1CCE0D870A9DEC13D9748205B022C7B0CC7A03497D6C42EC51F44D9C4F18A104E7C9AD6
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 f55727b8034a69a1cc919fab76d3ce77cb85794af1a395d23afd5379a2baf1bb
MD5 6f409fe8a0ac7e6440c26919b27f53d0
SHA1 094d0d98734a76886910c7dd4e080094bb32fabc
SHA512 c49ab60f4611e2a5a6893fb0a4c1ff781316c4991b208bb736573e3c07f6736c9cfc06fa4c972646ed5822590ff382c21c4ee58aa9ef8add71906add8fda19d7
TLSH
T1E7C022A188B9E036003586391A84F8C46675C0302016C2B0CC96C33CE0900BBAB3702D
MD5 SHA1 SHA512 TLSH

Submit Download

e6aee4c7-9d30-4c77-8c25-ddb43b0903e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6aee4c7-9d30-4c77-8c25-ddb43b0903e2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

efaf9adf-ecf1-4b46-8f6d-8c441cc11fa9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\efaf9adf-ecf1-4b46-8f6d-8c441cc11fa9.tmp
Size 1KB
SHA256 994bf2cd6bd74e6d940e3f5a22984048aa00268cc6f1f4ac0df1ac1e97e75f95
MD5 dee0c61207733774e356c38d2e63abec
SHA1 259c15421bf83f48e92c1d077753c7aec67b3586
SHA512 c1e03b3e9ce6af1f7bff30266a08b376f54da8a951da19545ca41477bd790accf24d995a15b110e766e2622ac5c054e96b031927e7f28e1c0ba87327f4d98252
TLSH
T1E8218EF783B4957E8A0196F0AA08AF1FCF6C0511431C7DAAC5E4AD2793F34A1E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

f931d886-c794-404e-960b-dcf13f4c8797.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f931d886-c794-404e-960b-dcf13f4c8797.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 7fae51b6f62512a574982c1fc5535c7fcfcf9e7678c71b41359a14741e0c729f
MD5 c1a277cb01133b63004939b7b3f400bf
SHA1 6f89c50c9276ce02073d11662b23b5cc3d4f7d76
SHA512 b18e5da2a55aac8b9adf8a1de7793fb3d58d97f5004600a9928e269e3320db824c97f57e53279410921df5fa592882c20216ada7988f4dc9d1ab2d7a8a4fe024
TLSH
T12CE0DFA065CAD23A622935830238AB4C83A47467D3C43D866F81CAC8A147A04F69BE90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 678B
SHA256 7422086c787372c17e82f303dd71fa6ae04bd87462d193f2ae632a056fa06733
MD5 12379c4920ef5fa23bed9d2e56454a5a
SHA1 35ab5a391371f9e28bdddbfa591c86160faa9364
SHA512 30abe966299df35847ee5df77ea1275f914cc30c1b350e21f4979e2ae936a131ed00497a02972d383be1ee7ecfcc3ad383d727e888ecf9bd143bad90c0dc8960
TLSH
T1FA01F9F709085469DF6E87B02CDA63F49B6385DC0E89CED3428C53C706453323D19843
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 830919e0fe40b61173ced7df3cd6d718e7d29ffec0fb123475019ba1875db024
MD5 9ee5580720dd21bd09b564c4430878c5
SHA1 b4dcb0d82abdb9d2096433ff85ae6eadc1d4b217
SHA512 9e90874fce464783899db740b8c7f6855fa73fe53681f5148094b5636a13fc3abcf809df4437b6592a1e0ebd67bb2259b60803c1b6d919717b41995faa0702c9
TLSH
T1D7E0267468DAC13D532865AB0228630CC3E038D3E7C42D862B40C8C4E20A201F39AAA5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3193cad8f4173ce4d22bd847d33425fc1a6cfdde6e8391d1d39b67fdc789548e
MD5 6c13d2c3c21158a05499e430ca84f14b
SHA1 1e4b1d89cd8a48247ee7d3590959a57f8ef3d4b2
SHA512 ff3119122ea1326cc4ff7b1c7d5e911906f893b0eb3a193a8a38870ca2f520bfdee4369ca01b75d0424506cf901eac7f40a40eb6b2d1624e757d11553aeeb189
TLSH
T13CE0D87065DAC33EA74D3197032CE708C2A6B456D6C52D953B58D5C4E20B644F34BE56
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 194B
SHA256 f9a497be96dcab58091e4d5d2389fea3cf4fbde7f8e2e4abac7010cb35ca84ef
MD5 b3b74961bff7ab9fc0f4f3a57f637184
SHA1 1f77ba6e313bc4c498df1c7c4157d79e3df685bd
SHA512 7cedf227788ff68e18579e70187c3dff712652063f322be6eba969f768f719ae9ee7b52c721ce92b7717c29c7e58e480a8739cf862cef123b87ff0b11ebf3c2c
TLSH
T14AC04CD55A903023FDCA59390DAB53041B20C4752F74CE57D28430901C0A285FE61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3b0efa642c4e8196ac90f3943801ff9f0dc2a72057ec781da46e06e9770b8cc4
MD5 d9bf6fed87f05c6306d5680629e53c02
SHA1 54b82996423a296f46b009188192874b141fee82
SHA512 23fd8494a43bbe3f9e599737e18df3ff9f89c6b31217dae977ce528fa844142f43ca91fa60b4fa7d97187db0e82d8fc82d603d361cf8a511e78c73e57093f661
TLSH
T19AE0867895DAE2396208618302ACAB0C87F0789697C47ECA974C84C8E10A345F7AEE95
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e623a4f0-52c9-473e-8855-2237b737a637.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e623a4f0-52c9-473e-8855-2237b737a637.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 478B
SHA256 26d2c6d3a826c31db35aa52d1bd4cd62976164fe458f8f0798bcff0a2ab734ca
MD5 5a41b75799be520c4f3da38b770cfefd
SHA1 a868cff7a33e634e5dd30385319453415b10c5b0
SHA512 cfae7f856f463d1edb361a6d8129c7d23888582f877be00a55791d679ac1920e819c99d07d42a154160813a84249754f624a94f10dc75ab8a9934565b25904a1
TLSH
T176F0E5DBAF030977DC42503154336782FF2289CB0424A47B43CD216B1A6E2F1C9CC0E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 310db506cfc6c465ec5ed4dc4fa6e1c9cc0e413c3fd05a773d168e21746a02cb
MD5 9fc4302120fc844d6d6ac0c4426f4c03
SHA1 71d18ba58a6489f6f48c0787c4ba71476d85b4c6
SHA512 379553df126500641626f45111faa8c728d92ab8b43376cd73bda17062ae3f89b8fd220e7ec60fdd1f89380f03dde5d602eaff385e3af3e3d9d0ee35e7b53b45
TLSH
T1D3E026A0FCCAC13EA119208B0128570883842893EAC02ECA6F41C4C8E207680FB8EF91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 3b913967be265153a0cda154114f9f0cf4b54070d011c1f619a5b13b501ebfda
MD5 f34c46fa3288ee5bee3e0c02384d6ac2
SHA1 82a9a13b5d7e655a5cedd3bdf80bec45972023f4
SHA512 e67fb83f06339c7250290c8f68f056273e4c6165546c92ec8bbaf16d573f299c0c1b1cb76885272c02a60a942a9ff77581bdb61a897f951c96148bef4dd933d0
TLSH
T1C711D456F330C004E25A827A607F9B351734E8568FBCEC0F547A20656E72B590D8B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 498de1aa1368e451c87f58a575c678fb6e23f4f2a3f3165f5b25ac2899c77046
MD5 9646e9263b1498106be0451a902eddf8
SHA1 9895c86f8aeaf6121a72f415a8fcfd7dfbea1ab4
SHA512 7e723ece7446924b240e2520112cc1e097e4f4c00f0fec78ce36836f98e76c7f7ac9bc655838bc6f35f188419bbcfd709c236a535888c3f9414fc6ed6b7615fc
TLSH
T1D8E02020FDC5C13F6115208701689748839538D3EAC02F852F41CDC8D107281FB5EA51
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

d74ce65f-dda8-4ca1-9abc-2291473be56f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d74ce65f-dda8-4ca1-9abc-2291473be56f.tmp
Size 39KB
SHA256 33fcaa9047791cc020cb89fb7994502b83d214349ef42a540075d4e98d0dc0e7
MD5 d2f7fb34ec49490fa085f2cfb0677c5d
SHA1 d8846f798765f5ca4b589369372de33bf37f7df2
SHA512 5a33a563b8768882bba1797c8c070d36c03ebe3f27754903c84892af927990302e4decc874ef79aff881a3e8eb8cfd43e4e064012af6eeceabb3973c59dfa964
SSDEEP 768:o/UxvxjgC+93slwO+YZI75b5fgGM1TnXMqO8WNAnX:1Zj3+93b5Vfgt1TnxOVNAnX
TLSH
T1E203CF35A9596C63CCF3D785B21EA396AEF200A3C5C51EA8CDEC6D0E058735E074B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe4e0062-f992-4bc4-87df-3a4244b64dd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe4e0062-f992-4bc4-87df-3a4244b64dd9.tmp
Size 38KB
SHA256 9983e4fe624b55a9e6730cce55af07e2a0f2a359236547956fb399239be3fe1e
MD5 267282062e1dc4b29666ae093dd1777e
SHA1 582f520f1b16d9f2076c2b5f0eeb0bde60b0e2ca
SHA512 39cf687a8ecdc694384324e1517e12f5bcc40fe36ca62fce8e07e2137d2960d09bb7859ac7424f917c823547ba238718cc591ad13da7bf464f78d2266aeca58d
SSDEEP 768:U/UxvxjgC+93dDwO+YZiu5fgGM1TnXMqO/CAaP8:BZj3+938cfgt1TnxOKAG8
TLSH
T1C703BF36A9596C63DCF3DB85B21EA396AEF510A3C1C51DA8CDEC6D0E058734E074B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3776-10-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-271-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-269-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-270-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-266-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-267-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-7-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-0-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-4-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-5-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/3776-1-0x0000000140000000-0x0000000140070000-memory.dmp

Download