dorkbot | 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
21/11/2025, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
Size 220KB
Sample251121-mgqbaseq4w
SHA256 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee
MD5 63857018db54fcb41ae9f3155270eba4
SHA1 3e776e9ba47a6252368ce8a2efa2072fa4aa1014
SHA512 58c1f6e4ffdb9c329b0183bc3ff3ac348f075dad1dec65bacead544a25f81bb4c4fa7da69155de7381cae7e97c7d5d9ea6440b2c491eb42a8b9013b6c5a186d8
SSDEEP 3072:TFY3/I0CWXmLXCnNgP6AB914CO5z09G4vThUDj1iu+qwELbYmTdWe6NFxWmRyQ5R:BY3/vGyABv4CFEDwELbYmdM8QL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware discovery dorkbot spyware worm

Malware Config

Signatures

Detects Dorkbot worm 6 IoCs

resource	yara_rule
behavioral2/memory/5028-2-0x0000000000400000-0x000000000044E000-memory.dmp	family_dorkbot
behavioral2/memory/5028-4-0x0000000000400000-0x000000000044E000-memory.dmp	family_dorkbot
behavioral2/memory/5028-5-0x0000000000400000-0x000000000044E000-memory.dmp	family_dorkbot
behavioral2/memory/5028-47-0x0000000000400000-0x000000000044E000-memory.dmp	family_dorkbot
behavioral2/memory/5028-82-0x0000000000400000-0x000000000044E000-memory.dmp	family_dorkbot
behavioral2/memory/5028-69-0x0000000000710000-0x000000000075E000-memory.dmp	family_dorkbot

Dorkbot
Dorkbot is a worm written in C++.
worm dorkbot
Dorkbot family
dorkbot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 224 set thread context of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1924492672\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1735333887\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1735333887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1735333887\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_2133222924\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1924492672\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1735333887\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1924492672\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1735333887\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_2133222924\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_2133222924\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1924492672\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1924492672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "461364351"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31218478"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	IEXPLORE.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134081944111044084"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1418876453-2228697459-2788511057-1000\{FFD06F80-1151-4BBE-B787-86B7892435F5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
2524	msedge.exe
2524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 224 wrote to memory of 5028	224	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	78
PID 5028 wrote to memory of 4400	5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	79
PID 5028 wrote to memory of 4400	5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	79
PID 5028 wrote to memory of 4400	5028	01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe	79
PID 4400 wrote to memory of 3084	4400	iexplore.exe	80
PID 4400 wrote to memory of 3084	4400	iexplore.exe	80
PID 3084 wrote to memory of 1096	3084	IEXPLORE.EXE	81
PID 3084 wrote to memory of 1096	3084	IEXPLORE.EXE	81
PID 1096 wrote to memory of 5952	1096	msedge.exe	82
PID 1096 wrote to memory of 5952	1096	msedge.exe	82
PID 1096 wrote to memory of 6024	1096	msedge.exe	83
PID 1096 wrote to memory of 6024	1096	msedge.exe	83
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84
PID 1096 wrote to memory of 5040	1096	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
"C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
  "C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:3084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://go.microsoft.com/fwlink/p/?LinkId=255141"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffe7ccff208,0x7ffe7ccff214,0x7ffe7ccff220
        6⤵
        
        PID:5952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
        6⤵
        
        PID:6024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2200,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
        6⤵
        
        PID:5040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2564,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
        6⤵
        
        PID:5100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3412,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        6⤵
        
        PID:3592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        6⤵
        
        PID:4372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4092,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
        6⤵
        
        PID:5636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3700,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        6⤵
        
        PID:5384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3416,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
        6⤵
        
        PID:2088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3644,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
        6⤵
        
        PID:2068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5588,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
        6⤵
        
        PID:4196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5732,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
        6⤵
        
        PID:776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        7⤵
        
        PID:4784
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5972,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
        6⤵
        
        PID:1048
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5972,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
        6⤵
        
        PID:3372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6452,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
        6⤵
        
        PID:7076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6456,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
        6⤵
        
        PID:7084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6460,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        6⤵
        
        PID:7092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5448,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
        6⤵
        
        PID:3420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6036,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
        6⤵
        
        PID:1696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6604,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
        6⤵
        
        PID:5768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6200,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:14
        6⤵
        
        PID:2552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4828,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5388,i,4242309296070104409,17388214706265068043,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
        6⤵
        
        PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e373291cec4f23986133c23daa353551f05eda26aac4a4e3686c40f8bfda576e
MD5 03b6ceee6d3294b477cb96be0a4821a2
SHA1 17508a8b887dac0d5b2fdf62cce6ee7989564165
SHA512 581fbd959baff647df5ac757c03b071653bca94c529807775b30e0f4b88ade1f0dd99850daaea1fa0861ce83d3e9d505a004e6c78d45e923ee39728a2d9efda9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 24KB
SHA256 e924e90576503b16b936c80c4855888f30e9956a5aed3bd9197372a51c1330fa
MD5 3a498960ff845ec0d97cca7ec50a4848
SHA1 a673b1d115ddb2da8235da099048c451c2ed274b
SHA512 7c8b442d328a2f524b579a379ab8ae37e7b8d803f4ab7f8c7b87e5d3cee3b449e4632aed19d933a41dbbaf181265d9ce26cd005c0144f8899c9c77a297fa9394
SSDEEP 768:l43V+OJ8t2DU14Qd+lmLjvcT8e/QKowqF03njxG6A:l4l9atdd+lQQVojFCct
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6513e3329fe3ed642455460a39faab4295446a892a867d7d9edb514fbf22fe76
MD5 3b1279ae17606a9622d397a39d6b549d
SHA1 73b53bdfaaa4e0d6068663dc696eeff44d579958
SHA512 b8e65d839a9a1fc1aa6cc8dacf8abf9f0fd31a46326cbd33de118f131affe98df2381d873a481657b05adf603278adff7a8bf936b1c6352218ec2604e4809681
SSDEEP 48:XpbzlmKx9MuZeRNUDpUydHXS/A8+MP2IRjTapboNhubBZrenrgOWZtl7b0OoFkjR:ZbzoZNUD/2NtaFYhMBZre0v07+
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe585908.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585908.TMP
Size 1KB
SHA256 53c410380efa3405fab4dc832c7658fb5a0675e87060928e082838a8f97712b4
MD5 32726c40e55daeaa994f6c012d0818fb
SHA1 1e78aeae70f4f7bc1933382a02be4913b2b613dc
SHA512 3a821c94f191df3ea945dab4ad66f448ddcc0f0e54653b5be373b357f40739ccf9341390760e622aa1b7843b7f8cde0f664f1db7778d2bfea4bed7188e0943fe
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 50fe1151625cb120f7e2a476ed846ced04d3ffbc4e2922de433fa26f93ef16fd
MD5 c8b1d81f24b1446fa414638906871601
SHA1 925c1c0534962290623dd6b939ef774fbcc710ae
SHA512 f53e3e59190122e8ae81eb676efa7dd320b60481498c1dca0fbe151e33076b100d2b1dd7e493edc7e2fb0e0e312b693ce0a883483367ec931bdecbf13c0b8a96
SSDEEP 192:DEZAC7TvbeyHv/u2lJ5Z5vbzTGnD4mlOfa6GEfAj6FuHPeGfnPgCd:DEZAC/jeyHv/u2lJ5Z5vbzTGnD4mlOf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 28f6153b94d3926c842554ccbe70dfa5632dfdf98e898da9242951ab0437bba7
MD5 8b50ab45a7d208e6387329fb51952ab5
SHA1 5bbac5cb531d54f26e69497ff3b5d14eed39a1c9
SHA512 393d2d220a282dccd80ccf265518f4adffc84efe781e86b95caf6e5f26bbf863a9b122d5aaf68901dd83bb6b4209962dfcbc32db4eb4bedeef704457828d5b84
SSDEEP 192:DEZAC7TvbeyHTu2lJ5Z5vbzTGnD4mlOfa6MNEfAj6FuHPeGfnPw:DEZAC/jeyHTu2lJ5Z5vbzTGnD4mlOfaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9f240b412fd4271ec8303515a7e79bcd58f611b76359c33a66e2b064b3545483
MD5 6bf5320b01f5fe338847d6058e1684d5
SHA1 2cb3e45ca2ea15e66a8ca523535cbc6b586f6c6c
SHA512 17ae13375fa7a9855a7bb5930c55a9974380fd7ada83303c52ced20e9f2bcad8ec85193ea62528ce9140d45446c16e3828cb964abc2c70d0233a0629575e8ebd
SSDEEP 192:sVRRuyMqv/Ky0Ml8M3pU9sVvxxutjb/15oZ8palK/Y+WN6Vqw2zIFj1x0z+tirf4:sVRFLPpU9sVZxgfv5/SVwaVPfv8ms/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e06fe3dddfb82e2613fc6c6abd3eee36e1ffaefeaaee43e229457d00eb95eb9a
MD5 9bc1bbd95e5469df24d5a3bf7390deb5
SHA1 dd0fd61fa0aed76f7912df60e4be06cf6148c2e7
SHA512 28ec6c932ccfdcfe5dc6095459c32615220f4b0055a115e3427c8adcfbad6551efb5b7c242058118bd251913b067488fd80047a072456ea5e360d6a9c391e07c
SSDEEP 192:sVRRuyMqv/Ky0Ml8UQf3pU9sVvxxuhjb/15oZ8palK/Y+WN6Vqw2zIFj1OHzX0zB:sVRFLqPpU9sVZxsfv5/SVwaAzfv8ms2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 097f1de7c9700bf684c887634aa0e379d096f000c3fc8dde7183ba1acb2f575e
MD5 5bb35dcca321e8aab1de1cc2a5d8c3bb
SHA1 f58b0e0ef73a999b178767f24d94463774e02675
SHA512 fa24abc8c3ffd875cddadc61075cb3c8a451725481927e0341387bbe7e6ed0353d32f5fbda14cd835d022881a264a32820e5bb124040a4f2b6316625babdc645
SSDEEP 768:KdB7a8GX2+R7pLuLE8qWRWFTQBD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VF2oLlW:KdB7a8GX2+HEE8qWRWFTQBDu1jaKVF23
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\b53b95f9-720f-4baa-8952-d1bea8c4a684\index-dir\the-real-index
Size 9KB
SHA256 9fdbfa8a5ecee81aeecf195e13f0a1bcde2c5d9ee99ed4a1a8035d17f8e934d6
MD5 0336b8e02fa6383f9585c1ff04a79ced
SHA1 a50b469c374d95dbfd8f53bbe5cbcdd15d68f974
SHA512 8af40649f7532870d60bb6170de6c6845113af3c8b2e030f47dabfe860b8e6da1e3173c0a5ffe1c99aacd8d675289a14c18e32a89b577ee9cece3b6e4e95c07e
SSDEEP 192:WAEH2nNeUfNSXsDUywa+9NuM1MKDI7z/2n20GIXpkGaZcG:iHGTNb9wuDjD620T5dG
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe5887d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\b53b95f9-720f-4baa-8952-d1bea8c4a684\index-dir\the-real-index~RFe5887d8.TMP
Size 48B
SHA256 0206f3edbb5c59859f078bcc956cad48b941f0158841a5fc7bed31e14d6df8b5
MD5 99cc2adc3e77a2a96136255a2741dc5d
SHA1 05f35980f0c685463e9cd11b18f8419eea26c1e4
SHA512 d8fb800dc23ee812f0a6f4c7dd09e3a2c49a72aa5314f79427b6369521262e83a656d75356f192f66c4961c12b684c0579cdd59c6574b0a554500f381ac70ab2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt
Size 115B
SHA256 b175a171a66ba7a73f25e87531db7d408deb36214ee0531e4353ebf973a5a1b7
MD5 0243ac7d57e2b1a77cf52c0c71c626ff
SHA1 3fb85b914fca6445060970be67e1e9f8cad0c100
SHA512 92e6378d0d321c2e5aeabc00da746e84546d83423d421569d2db760a41c3b8977907c35fb278ea4607ab1a1717e432aa766df0af5f77a4d462ae571ad0484de5
MD5 SHA1 SHA512

Submit Download

index.txt~RFe588817.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt~RFe588817.TMP
Size 119B
SHA256 fe4e83beeb1ccd7435845f7ab58a11744fb988e797b112090372df6a4b4821b0
MD5 04e132797d4eb0884f46f92cda5347b4
SHA1 88e27b3b06169b251b53b0b8be23bf22c9f0217e
SHA512 9f3f095ac85681004f0502133f487b2c5692de2e621c4c5d22a1fa523ab4fb6e36ab0137a589af53edac85ca7b1c8e893cc719fadbc1d37f81ee1fab4477f846
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cfecea84e069e2c9daaf5d7dd578c3d610f602696d167f0c2c32886c50c912f8
MD5 c9891047c6ccb19217b5031d1c804f79
SHA1 6fe996cb28fd6a7eb9ea56361dc79c2c87a73b35
SHA512 6ccf3d05ea9b7dbd2499ff781a4ab89236624f4195a59ca59a44627da56eda81a2cd996564467bfbb7ccfad96857d23a8d6d411b4f701c09e68129bacb151132
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58310e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58310e.TMP
Size 48B
SHA256 d4ded2629e6bb7234a2a328f5939ddc570dbf322b9467336a6ca7e3f1ec4c69a
MD5 7ca2a6890d3314e72dfe6bf5400dd479
SHA1 d156a115beab58b8874af9b4e66b26afc6c688a2
SHA512 a49551f592400b3eb26f5c1f73e452a5426ff0b0ebb5ea093322db0041da4a6568f522a326645fce5bead527371f28166da7cde08ccfc4ff2294fd7593c103c7
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 1112f106684918ae69519b524b410cdba0d0140d4c881874d3a0525421be720d
MD5 0aae7daf40610daec792f2c35e1b9869
SHA1 36148ba46d90d8f4de514385fb1a2cced8e7a11f
SHA512 2bdbaed99e56e2ccb28b05bdc718509ad615106fa72583f26c3a0399e6ad66322e18cdf287ccc203424e00cdce8d19334dbf48ca53178de6a4420a8fe356f205
SSDEEP 96:iQZ8gKe6QO2DcYQKQeyYzSnQyPSfmyU0EyOc5CCyKQ4w6xYxkevCusY8g4Q9CGgS:yT44iToEoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 466B
SHA256 8e7620c3ca630434b0be5143cc1a6103e770f1a65a777fe9ceda6146a4dc14cd
MD5 a6bdeea36cf798b09df1cc67cf639d18
SHA1 d7cd8d3ac8127485d2ed85859f74f2ee200aa46d
SHA512 c05954a69e6afc30656ca13b17abca0e3c8a790c9bb27616006e0c025ac40828bfe30cd28f6fea71b6844f10786a5447da5aaec6a722b12c134c6e9dd6d0353b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 c44024b087d7e992c678b6424adf84551895dcae724d1ad822d79fe723f0cd4d
MD5 5041f5b425f53d75efba9506fcef3a35
SHA1 bb259ae28a00ca0cdc4285a4b9d7f8c896748330
SHA512 1f07d259cb2f654ad7c9cc047e51c0f07256923308ba8128e0d943a6aa8c06cf0a636be4dccb882cf6b11b53efa9ed47e555e0dd2c8ede08cf2fa9408efa0ca3
SSDEEP 768:xFCYfJSJLdOuDwLAB3/CgwP2OwbdweYl2w3zSBTCE18ovGqsW7iIKu8UM:yYfEhOu93mb13mUE18WGeiAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 92bbca7142de4a31d9a1fb2eace8f7dfda6033148821d3714df9e9003dd1cf90
MD5 efa2fdf4a43196fffc98ebb914f9af4c
SHA1 244b2a68862090e8acf50d40bff1a78499b0e47d
SHA512 2f28a3e413370831ba9196248ea8618680a4fcb3323886aa831b796e5fb51037db6b896b32c7836eff2bc751a01bf8e1848e9f2bd57be3b60afc28e963a4db62
SSDEEP 768:CFCYfJSJLdOuDwLAe3/CgiP2OwbdweYl2w37SBTCE18ovGqsW7iIKu8UM:rYfEhOuS3cb13+UE18WGeiAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 5573aeeabc4ae25f910be4fb796af130c74cf9613341cbed2962b596b6f15710
MD5 45dd9831d494a9016126cbf2894c3a0b
SHA1 24f99068d7d3c3ff36754c5cd402157666179154
SHA512 687a0af3d3c9f49c9d87614998132dc39cc38e91bfa9f9092981faa5c1a2b4e2c9f21e5ceb26a44c5be07139d8b4e3f29726b9e40dd12924aa5743578723572f
SSDEEP 768:yFiE6esE8lDldUGz3UCgRXB2OwbdweMNMKAO9PeCovGqsW7iIKu8CE1x4L:TeB85d73YbxMK/RWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2e1167aaaa38cc78c936cc49fd11e7ae40c813d59fe64def45375810900c1e1d
MD5 7dc266be34dac9d4c2347663c4a38d2c
SHA1 c1505ceaf6bae1c6e856ed10b2471dc2d786218b
SHA512 08b35f3238646cae879a32cce3b022ec624344b1d63728d126816eddde7acb6eeffb3b0f3272520b5a03d170f5df0f14eb32c4b4f039651d3ac6fbdb5bcc9543
SSDEEP 768:VFiE6esE8lDldUGz3UCgLU2OwbdweYl2w3PSZovGqsW7iIKu8CE1x4L:8eB85d73lb13KZWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0db241c8b0673b39a614169cbe8271edd37959f321d982dd5224d35094fbcadf
MD5 032ec2d640851d34aff1797554b7d692
SHA1 1be29d3ae089cbfcbb746d3de04713324701d028
SHA512 93b76e575fbdc56fc9aa36e6ce17dff6e813d5fce0b6c65aaad4baf71800bc3e88c29c44852d6343b9c8073716c40072447534276ca470ac670a6fc1c9a72024
SSDEEP 768:CFiE6esE8lDldUGn3/CgiP2OwbdweYl2w3PSZovGqsW7iIKu8CE1Jl4L:jeB85dP3cb13KZWGeiAtE1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.9.29.1\keys.json
Size 8KB
SHA256 e5b57a8978e405e9487c43e6b0b3685c4c71cdaa2e74e25d7fbed75ffaea01b2
MD5 80068ae175438916aff814972b76e6f6
SHA1 39336911d02ae3c5b038aa31c73c4757dcfadab6
SHA512 7cd55dc8c37fbaf9675d08fd2346ee45721338e1e70cf6aa351e54b45630ada5ada1243d738742cbda258c830e25ee8e09f57fc3cf21948e62c3c552ba9cd18d
SSDEEP 192:uNtGbRmmhGfHPJyR9Pm4lOvMwkoR9PuGMXcy:Ohm+0KjA
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1735333887\manifest.json
Size 176B
SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
MD5 43c5775bc9bc99578d9a96958edc8864
SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_1924492672\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_2133222924\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_2133222924\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1096_408095845\manifest.json
Size 79B
SHA256 7c00a941d7a04048f469ffb986ff7e8bf349f149639cc474a463da4a607c0a70
MD5 0726a393d6366788cb47da5897d1af64
SHA1 022ebd4d118261b871d50479868d502b797e6d14
SHA512 adaaf0c40793c606d44fd7112b42040f01dd483a7c4c678e811f824e2fbad722ee3faf50984615731d71425eb3a1e4a9090962249e673fe8e7290713c8f75d9f
MD5 SHA1 SHA512

Submit Download

memory/5028-2-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/5028-47-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/5028-82-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/5028-5-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/5028-4-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/5028-69-0x0000000000710000-0x000000000075E000-memory.dmp

Download