2f5d32b3f1990ed53857aba65bc428a3fa33d231c1c059b8a8b2ed09076ad607

Analysis

max time kernel
900s
max time network
762s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/02/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The-MALWARE-Repo-master/Trojan/Carewmr.vbs
Size 3KB
Sample260222-cdtt7sb16e
SHA256 2f5d32b3f1990ed53857aba65bc428a3fa33d231c1c059b8a8b2ed09076ad607
MD5 0eeb59abb53bb2aef4fa819f8437a643
SHA1 14e9b3223662b5d74aca26edffb4eea27e8c6f23
SHA512 6397bac318d90a008f54b62410dfd797234be83f8bff8b33392427442885d50f498c40ee0eee97f7272100de68ae917af95d3e75d1902f5fe6ae1b8a14c8b6e3
TLSH
T1AB610017BAD651CFC26A1284214635A9D2D401F0D9F04D653D4CEAA82B12DE744FB2FF
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1163659435\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1163659435\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1163659435\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Wallet-BuyNow\wallet-buynow.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1163659435\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1536750341\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1187109649\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1163659435\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134161995442142665"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{CB9B9626-5890-4084-8982-0525E2687331}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\THE_HEURISTIC_OF_NORTON_IS_VERY_BAD_AND_PRODUCE:POSITIVES-FALSES	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5988	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5988	4620	WScript.exe	90
PID 5988 wrote to memory of 3300	5988	msedge.exe	91
PID 5988 wrote to memory of 392	5988	msedge.exe	92
PID 5988 wrote to memory of 3452	5988	msedge.exe	93
PID 5988 wrote to memory of 3452	5988	msedge.exe	93
PID 5988 wrote to memory of 3452	5988	msedge.exe	93
PID 5988 wrote to memory of 4960	5988	msedge.exe	95
PID 5988 wrote to memory of 4960	5988	msedge.exe	95
PID 5988 wrote to memory of 6028	5988	msedge.exe	96
PID 5988 wrote to memory of 3420	5988	msedge.exe	97
PID 5988 wrote to memory of 6028	5988	msedge.exe	96
PID 5988 wrote to memory of 6028	5988	msedge.exe	96
PID 5988 wrote to memory of 3420	5988	msedge.exe	97
PID 5988 wrote to memory of 3420	5988	msedge.exe	97
PID 5988 wrote to memory of 6116	5988	msedge.exe	100
PID 5988 wrote to memory of 6116	5988	msedge.exe	100
PID 5988 wrote to memory of 6116	5988	msedge.exe	100
PID 5988 wrote to memory of 1532	5988	msedge.exe	101
PID 5988 wrote to memory of 1532	5988	msedge.exe	101
PID 5988 wrote to memory of 1532	5988	msedge.exe	101
PID 5988 wrote to memory of 2040	5988	msedge.exe	103
PID 5988 wrote to memory of 4272	5988	msedge.exe	104
PID 5988 wrote to memory of 4272	5988	msedge.exe	104
PID 5988 wrote to memory of 3108	5988	msedge.exe	105
PID 5988 wrote to memory of 3108	5988	msedge.exe	105
PID 5988 wrote to memory of 2212	5988	msedge.exe	109
PID 5988 wrote to memory of 2212	5988	msedge.exe	109
PID 5988 wrote to memory of 2212	5988	msedge.exe	109
PID 5988 wrote to memory of 5388	5988	msedge.exe	110
PID 5988 wrote to memory of 5128	5988	msedge.exe	111
PID 5988 wrote to memory of 4144	5988	msedge.exe	112
PID 5988 wrote to memory of 4588	5988	msedge.exe	113
PID 5988 wrote to memory of 4588	5988	msedge.exe	113
PID 5988 wrote to memory of 4588	5988	msedge.exe	113
PID 5988 wrote to memory of 1748	5988	msedge.exe	114
PID 5988 wrote to memory of 1748	5988	msedge.exe	114
PID 5988 wrote to memory of 1744	5988	msedge.exe	116
PID 5988 wrote to memory of 1744	5988	msedge.exe	116
PID 5988 wrote to memory of 3360	5988	msedge.exe	117
PID 5988 wrote to memory of 3360	5988	msedge.exe	117
PID 5988 wrote to memory of 3360	5988	msedge.exe	117
PID 5988 wrote to memory of 388	5988	msedge.exe	118
PID 5988 wrote to memory of 388	5988	msedge.exe	118
PID 5988 wrote to memory of 4016	5988	msedge.exe	119
PID 5988 wrote to memory of 5452	5988	msedge.exe	120
PID 5988 wrote to memory of 5452	5988	msedge.exe	120
PID 5988 wrote to memory of 3596	5988	msedge.exe	121
PID 5988 wrote to memory of 3596	5988	msedge.exe	121
PID 5988 wrote to memory of 5308	5988	msedge.exe	122
PID 5988 wrote to memory of 5308	5988	msedge.exe	122
PID 5988 wrote to memory of 376	5988	msedge.exe	123
PID 5988 wrote to memory of 376	5988	msedge.exe	123
PID 5988 wrote to memory of 3840	5988	msedge.exe	124
PID 5988 wrote to memory of 3840	5988	msedge.exe	124
PID 5988 wrote to memory of 2796	5988	msedge.exe	129
PID 5988 wrote to memory of 2796	5988	msedge.exe	129
PID 5988 wrote to memory of 2796	5988	msedge.exe	129
PID 5988 wrote to memory of 4844	5988	msedge.exe	130
PID 5988 wrote to memory of 4844	5988	msedge.exe	130

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Carewmr.vbs"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.avp.ru/
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffeb6f1c188,0x7ffeb6f1c194,0x7ffeb6f1c1a0
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15770115639040479961,15905707117777239166,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - System Time Discovery
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,3273785494207970822,17527591104168910226,262144 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,162318361742795373,5490860146113831853,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,10098176758257926267,12310692736662541350,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,15987094865136403643,4443492910506737551,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4752,i,6819259549106189260,7681100344958054672,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4720,i,6917200636400059617,14444742476532020299,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,17156943714931093157,3298156411350794167,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,17156943714931093157,3298156411350794167,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,10344757251027004063,2376097181928706626,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16016730320574236012,17259331468008496098,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6004,i,14894204502229616355,11741902802028332101,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,4691377970410720539,2433490091136034783,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,12143752703004543608,12660983686871439586,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,11414594445670359634,13999443084439563182,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5516,i,12590091018861299508,6520529709265298755,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,14843786435545634142,15532256926412141404,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,2898154602000753143,15771163611314494727,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4952,i,3888158023744079282,8816085076423447747,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4622460764765626569,16832039388920232179,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5516,i,2731641644047180086,14504216021779780435,262144 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14277124533744681654,1591718147603873888,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,14521534459942937716,17599724928398238336,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,11211490579135345597,12056678707290700241,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,4194799813279498491,5299656892430013898,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11456269365084726848,13799441577090328,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6336,i,49982474862658240,8445039289350209113,2097152 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,3774689300418010964,12284634612438715522,524288 --field-trial-handle=2304,i,4090615582956075503,3265464677283995265,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:8
    3⤵
    PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ce3de864fc029de1185f15a333c36ccc857bab064d704c1c9cb74f2d49559c6
MD5 95e4fa06728773c204126766fa6a3f91
SHA1 b2b2ff6dd17d9d1fca4c1aa1d226d00b195749be
SHA512 11564019829fb23fd1b38faa2fb3c3298ba02394920b54be1169d3ca923ae73304fcdfa9ca88adaeddf4fa314022ecd93085a2ea4ef7973e86e12e5d7e562c19
TLSH
T10ED0806C17B17C31E099967015C57B05656DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0dd682e82aa8cd6159af27b9fe9796b85ae32d8c3b7a54ca83c08e7258a7175
MD5 2ed58da04906706bb0da862e8e7185b5
SHA1 3c5218714f1830b95877032ae59a91505796d0f3
SHA512 c1694efeb33c2b30e89769d925a4ac7923301aa37e527971ebc442ad3c0800bfdbcade111c6abe3c94cf362ebe4febbfe65aa0c3ad7f46f25d381ebed28c5a41
TLSH
T197D0806817B17C31E085967015C57B05767DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 a174f073755b37e5a9a4e580edb0598df74181fd741bf163cfd573ad8d1982ea
MD5 4b8384bffb679bad8b7e132bbbacf8dd
SHA1 88e79315a60d8211ccbc9988502470768c3632e3
SHA512 7baaaac5ec0358fc928e6e5973e097a7dbeff2a8db03be98643265b05dd36badfc84f4a4cf167642a523c07e2cf078ce882473087267fef812fcb35a13c94f21
TLSH
T18DE0D8744FAAC1D51B01A48F88E5B3BE4852B407B6CCD4B93A4EA44CA510C047399CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 332B
SHA256 6dd5e64b729aebd2b7d70ea5a8053b7b076f8c5dab90700100a201fb13501f67
MD5 2e83affd7b0daacd47d627a96cde9d44
SHA1 583534d60912f65a9f60e7785af99f6cbc453110
SHA512 efd2f1417d68de00f48dd09af6bad394c07f58d26b65c137c41f5f41d0654c2bb22ff83f4cd372946b10d6086eb7e2ec94ac10efe2f2a16b7be633ea307f10ee
TLSH
T11AE07DB954CAC25EB344744782B8534CDA90364BE2CC6D0E7F4C8CCEB149A407FC65E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 d1c5fc950716ac282f130544a80b1be8a1567a6a0d9f1249b6ad3664db1a41be
MD5 5fb3c335ac3cc86089d0fda3e785f732
SHA1 9483bb3643aa36cd248b0b88c581098e1e2c8671
SHA512 3c15545881c9bef6d3f1eb44b682fc508f1e6f46496faf1c06ba279b29a0245fb2d8065063b77e43d3556fe1ddde29172d8151bb1571fea51cfcfde111d26143
TLSH
T177E0D8344BC6C19C6307D446C4D963599895709BF5CCA75D23CC62CC9450D006BCFAD4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 385B
SHA256 d488d95a232ee9b7ac2190284dac2116527784b456ea03afe75d6329b941d434
MD5 47bfede3e6a2a1517ddab0aa4ef8722c
SHA1 bd91fe003384fc2e791c004923ad40d9234385f0
SHA512 dfe2ffcff9bc48150a451160311599e9b6254ecda7295ea204e98a26694b214b5a1efb3b22280e0fa9ad955ccdb23204fae6435f9de2dc1de5e500af9a568aba
TLSH
T18DE0929EFAACAA8DD3E4497E5BB6B0410B8802B2D80F5B2304347DC035D56B01E75420
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e6b545e7f0e73fba170b618056f5afc6b1419d571774f2eb08ac692b07d95922
MD5 a4a5e21184479719ffd354f137618152
SHA1 561b56e486d8cacaa4869684f5fed1aecfa5e487
SHA512 14889c2b96ee38b0bc724d780c6d5848fbb11cb4fb2c8d23f1ed259878399fb08803650fae2eb4e32e85bb682ae673364a5a432b5e2c810af72e5afa489465d5
TLSH
T1B2F0F4A5CC25AC3718FD0B1E61A55A46EB51131B2691898F3A3D810D8FB1B3B869A81C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 105KB
SHA256 a3e0ed3b7b22eb63f8d684039026c6d1cf309dea226c1060864a6dde8ef4297c
MD5 35ae3b10ff09df4a55dc35b6a13e7f7a
SHA1 fe687665d50274195c09df8c0da43a3281143963
SHA512 6e0f0955ecc244ee48e49a902266addd795478331bd0f0865b92d66a08f660efe55cd0ca570f6116b5ba85970c359854e921faf3b517b566cbdc2ec1c6e7719b
SSDEEP 1536:IEpH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:rHSRhPjU1
TLSH
T172B35227D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 99dfc7e887050bb98d53c0e0b7eea6c294c243a77f9db19870d0570ad2834160
MD5 173b7fb265f27ede3fe97f02212a344a
SHA1 eb41a40905a08791a3ef8efcdabc00d19ca66be5
SHA512 ddba1ff107e77702a68fd75725f87fd484e35664084c164b0d43103afbae7b1cbb9eb0b901a8a368b93e120a30c70c2a84cdf55ba3c1118e0d6f63f27bca7d5d
TLSH
T1DE41AEF3C3E8866DC91195F0AA187E2BCE1D0954432C3D9AC9E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ce73b12048df2c3aa7c6997f540b9d557a4a23f89f8004e1d53ed4f8d8a7cea5
MD5 b6bfa5ebb8834da355efd620819ff5f7
SHA1 6e730c7c4ccc40a887a409c0e4a1bd1109d11601
SHA512 50636e4bf8b2fbbe81ea73126101cd8920f3eebeb9cbf2dea22fff5581e6b9e73cbf71ee0c812846a7ad4aef02827f6b94f56c9e39b123cf55b8f58eef2b83ba
TLSH
T1A2419EF3C3E8856DC91195F0AA187E2BCE1D0954532C3D5AC9E4EF1BA3E28B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7e35b657dbae8cfb95e8c5ba6cf6b69321cafb5da43fbcb36de9cb226a1815a2
MD5 9ac60f034439b5837378adde7f1829a1
SHA1 02857b23062760bb09e32ef2770b342568d6a4a6
SHA512 c8008330819336dbd06f66f9d6ea39a78279263c4fd1e61d3ec9d8fc1f418a1315a9522a1163ebe896c659ad9e6dcf2af75b001d8f05c44e8a5c17596dfd6c0c
SSDEEP 192:sxZUQARbyMqZ/K1Ml8Mi9/fJsOWfG4tM6XvBRijC4qzodpooHnB6+WNGYLT52SIx:sxZtAsq9/fJs7G43RUC4RJHyGgJjKf
TLSH
T19662E915AA386977CCDBD609BA417B53D7F91563E1804E48AAFCCE0C04D7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 57dd094230e84ec67b60085d99563a30588bfca50c039a2061b310caa80f9292
MD5 687b5d3e54afeec4d42180f2e62f6cc0
SHA1 6a76e268018f7eeece1995f6ae55c85b084d143b
SHA512 cdddcd7bb6e2bfa202342012680f1fbb7ba2ddc75f13198b294b80fcb95e5ac57358da6cbb9c5098984a54b01e04a09c479b00a1f8fb06ae6adb6328af784df0
SSDEEP 192:sxZUQARbyMqZ/K1Ml8UQMi9/fJskWfZtM6XvBRijC4qzodpooHnF6+WNGYLo52Se:sxZtAsqB9/fJsZZ3RUC4RJHOGpJne
TLSH
T19772F9156A389977CCDBD609B6417B53D7F91573A1804E88A9FCCE0C04E7AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 40a8dad078190a71b0ac1ad027aac4a99c2363c6d485730f3a6e9cd2eb5e0a4e
MD5 f036c432dbaf8945e686d7db1bd63246
SHA1 1de1f802458c3f85a3a6a2a3aa425b25d03c936a
SHA512 db96768a66ea6757f94232cbd20c1d9b015384b999e622ef79517b67fc25bf2770aea50874df012f999a07c0cf35dc74ac6b79e34de8f84acb5feb07726149f6
SSDEEP 768:z0sjWCv7pLuL/OmWvOKxC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVj+xLlx72BUrod:z0sjWCpE/OmWvOKxCu1ja0j+xLjyB/K6
TLSH
T174F2FA3B780CCB7F4F805E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\010443c4-b907-4bce-b343-a72f510eec21\index-dir\the-real-index
Size 2KB
SHA256 5312f94951278f0f25cb95f8644631dfd1a363d1cae5c5cb43fee71f074d1f7b
MD5 72ac7520fc3bad9308ab3b8838ba3215
SHA1 385f5a041ff54efb0c3df4e8175e0aa07e4fc004
SHA512 81ffd6a3d95d218845d35c0c4e5a537ea62f82c23a0352af081b34cc5ada6e3726d4517b7282bcc266c4d79c89e2fc2565a5b77ed87b4686f3ad2f89cf7c8d6f
TLSH
T1C151088CDC8E5F0BC9BD42B258FA056533780DEF29289B031DFC0639AC8317A2C87219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cef88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\010443c4-b907-4bce-b343-a72f510eec21\index-dir\the-real-index~RFe5cef88.TMP
Size 2KB
SHA256 68755c0936092dd4eaf44f6ee5c2ef65fb8da6dbdb37b6e00d6c8fcc71f1017f
MD5 cbd7b9fa90d2dc8484edcb7781b3dbb8
SHA1 343a376b50b3e4eecfce17e0802ef47f4e5622e2
SHA512 c44f52ba26a78a3fac3c73b14aa8da0b6c9cf905ab02198ecd73680d209c71229153dcf670643f159deefc5530009851fdf319d48b7188477d9c9474e7fa8464
TLSH
T1CD51D79E9C420A32CDA095B355CA5465333D68554A08AF0735EC8A33ACC37AD3C56354
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 afd758e1782a2dd821f8fd2e36f710a02c825522549e3309595bc2277cdcfa6a
MD5 982a11c84f4523eb6368ababa31057d1
SHA1 4fb0f8b7d5c436b1e6a6d1a9a4e58689983ec11c
SHA512 8e7e80c02c3af17515cede3ebeabd2fedf4ec4beef7991f850947fde1684c8afee7648d2baafb048cbf16e4631e48f4c8b12033655e8d87693bb487ed1fdc161
TLSH
T1B2E020BE3DEF2828FD6F97D324B1D49205097498C551DC4F101995D310B034C284FD26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 4c859b5247880fb2c183405ea29269b1dbf30978a1e896db839faf7753f47a40
MD5 db0fd3e13c01147117aac4b9cf5c9c21
SHA1 d92bb7e741a56d87bde7819d33d31cc1efa5c7f7
SHA512 4813e922fe08f074515ad19934e5aa020e71ae06bc1201c9f43900b260aad9e02c17ceac6f7e5d14d40851c26aa72f86f718a2de3a8145b02f75b255508aca0a
SSDEEP 96:KY5OKiwSKWkYKR2yCyMKLC4NiKWU6ezWKYMboAKt+6Ob2KwMnZWKSQiOzqKUEzzZ:0BKLfyFpHbxpBJhZf4f7Kn3Olxh
TLSH
T14DB21710723A42813A7EB9CA91E5B81E52C331737419E52B7BB944A64F67E20CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8c415fbbf71461329915636b58531485a5e04216a1fc81d276917d472ea82c38
MD5 7cb2c036bbe1ef5a053ad87fe8cfe6e6
SHA1 ababb320fc34497ba49b665cc49091ce15c78b59
SHA512 cab5eeefc8bdbebdc8c4a7a372ed6b8fa8e2502f5baf0bd29202df0fed0bcb62856f09c01e07754e42101c6c7224314024ab7f84e7400256526fa4bdef27f128
SSDEEP 384:npGiFavqMg3sNZ8TUNTUlImkrbPNm5cl4fFYYt/po4uRXiRYV/Vw1mRtrN1k+5vU:ptFayv3OwggvYG/po4eXiRYk1mbk
TLSH
T18AC25C35E854CEABEDE68FC5E70A3A07DEF0466BD68C4AD4D6D81E0D00DB19E530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 38b21fa5f54a239b0c89684852029bef51caaac205d4ce0f6a482488667c7c6a
MD5 04438855065fd3ac639e61e6dc900315
SHA1 49c92b9d6b92c148e3a7ec9f146392615baadfb7
SHA512 48cc36102988b91ffda3776009c2a35b8d782150168a601ca52ee82b3cd47c97962806821560c75b3cc4aba8daa90226862d983675e7e566bee32e0b8ec8dd7b
SSDEEP 384:nWoGiFavqMg3sNK8TUNTUlI4kAbPN5yoll4fFYYt/po4u1XaTVEkWywDzrN1k+5K:5tFayv3FwgEmYG/po4OaTVELRy
TLSH
T16EC23A31E868DEA7EDE74F86B74A7A13EFE0126B858C4AD4D9D81D0D00871DE134B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7ce00f71272906e9dc62f2217f34da4a07d6fc54b3c1e8badafcb0553c5eeb40
MD5 1016643819f9bf298b533e250446367a
SHA1 983d7482f49bc25c12e2c22993be2c8f2b7d29e8
SHA512 7c9d56406d8e14a4873f50c88d5c6bd6da0d202b1a880d2cdf0ee648e132bcf3aeb364c01ce22f639f4caaa56706b38fb58b919dd26e6fc08b814ec46440f268
SSDEEP 384:nQoGiFavqMg3sNK8TUNTUlI4kcbPN5yoll4fFYYt/po4u1XaTVEkWywDzrN1k+5I:rtFayv3FwgwmYG/po4OaTVELRg
TLSH
T1F8C23A31E868DEA7EDE74F86B74A7A13EFE0126B858C4AD4D9D81D0D00871DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e345c81d148e20cef44bb0576b691905cf392467b644136caa75f4ec2018a99f
MD5 b1676a16858ca2e77daeea16e483f576
SHA1 a7a152ed00cdfd5e01fd108257faa57a3b0775a1
SHA512 f110cc61fb6772637a08daa0ae5d40ba1d6c8877cf9a1d94c10cc9988098357dd61637c9971739ccaed6d43bb088f0f88f96e1495a15b18bc9ae6095f3eace9f
SSDEEP 384:nQoYiFavqMP43sNK8TUNTUlI4kcbPN5yoll4fFYYt/po4u1XbVEkWywDzrN1k+5I:rjFayf3FwgwmYG/po4ObVELRg
TLSH
T14BC23A31E868DEA7EDE74F86B74A7A13EFE0126B858C4AD4D9D81D0D00871DE134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0ffa114f4527948726560c11c40a1af51172c535213e8e615ad24b1f1407a338
MD5 491cfae6b959ea91d2542658530572c9
SHA1 1f4bd00586241d50dd0b9c6d18a6e85f719ebe6e
SHA512 aea9771ed8ff147276d7daa839302504c1c17fca94db1b2afbf212a55a406d33dae983fc1c4c63208f4df2821541b557d190987fb3770b83675f1e9974086c2b
TLSH
T1F44133E04C3D66D1D8BD1D3E608B78FCD6DCD636F464357D6814DA88463A51D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bb7bdf67d47f7e3509fad14c93a7ec7791c186c516168d68bbbd629cd668529d
MD5 ad62be4711208ef0cc758d0dd8753044
SHA1 9b4c1dc3a05b044b21aa318fad882256b3bef02e
SHA512 226526b40ed636e8cddc8ae2036fb30a52b61e933675781227833ffe47ad68c0f3a1fe0e3e091cfdafce167e04c7ee70f7d8dc8bb566b03c5e65e55d48d912bf
TLSH
T18E4153E04C3E66D1E4BD0E3E604B78FC95ECD626F4A4747C6828EA890A7E51D748143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 72df3cf04fea9d3b18d816900756802f9ac17d0d2f377ab751bf7b1a63e7deb4
MD5 86d3eed587f6d88db7476eb36142cccd
SHA1 95e6df01d2143542ea35d57055df4585e10d2cef
SHA512 191846b939e283681f0f04d3075e620189963cc017a7deb5a466d23e60637b07795f18033bc8f3e0b07497726329f5779ec8653d3f48f39a1bee9109f0893b53
TLSH
T16F5163E04C3E66D1E4BD0A3E605B7CFCD5ECD625F8A4307C6854EA880A7E529648103F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 595780b1222d4b3437ec78f87a41c4a314fc2bb1ec1f8da56b9f66f7c95e72ac
MD5 2d70a094f71cbbf74bb88927dee05073
SHA1 31be139f21f82dd02984d783db61c55634958d19
SHA512 1e4118adc77eec5f3bdadbda71c6d11dc360a1b0fa2cdc6c105126065428248cb4c62ddda099e3ea480c60ca810f58bc6a7dfdf025f8a3c915cdee5587f1fe35
TLSH
T1864121E04C3E66D1D4BD0E3E608B78FCD5DCD726F8A4357D6828EA88463A51D648243F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 86ef016c5edb295f4af5728d2807ea7e482aa31aa1b74596bad6fa77735d6a6d
MD5 ef0c590ba93575375f63ef6ec813e377
SHA1 162bffb438b41a4cb21f72c3d02c03c5e46e9093
SHA512 ef572c6a9b67c5af962d6ff485e9c509f795f3771420aa5a839a976f674f26f1348012b81e1d78dfb3409672f96ca2865a3ce0d3404cdd6e20d89ae97d051d37
TLSH
T13F4133E04C3E66D1E8BD1D3E608B78FC95ECD62AF4A4357D6824EA88463E51D648103F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c76b121f00e378fd9af5d7fb7973eb567d81dd124e181adc03773d3d6942ad10
MD5 e794a6ea39232e2d38a7975376f41cb7
SHA1 7859d0e15e2b432ee5ecb6635e0210827f4e223c
SHA512 0a0ae9725f381d5ccba0596e7f9b2a8b86428fea3a70f90a9afb363156032d187798e63d665ea3883cccad088e83324b8dc74336cef98f17de52d9091518ebe4
TLSH
T1E241F859B6EA1148B7B36F5AABF7A46E487E7C772E07905D10110E4F0A22B40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1187109649\edge_checkout_page_validator.js
Size 983KB
SHA256 24e61bd2cd840f1d0c31b656fda800ad032e71850768d77b04fc45c65ac1b3ce
MD5 11d46bdcb9f1d19a351b2ff865b9b0f2
SHA1 2b498365ca6530fe83eb376740a2c0849e08bcb1
SHA512 2a1acca19f93be135db3a81aa55c64e44f7f080f91d8d32ef8e8ec6eebc8e7dda7bcd064cb2e5ca16d5960b47bb4a204ff88e0ea71e8dca11cfa24dc6b06cd78
SSDEEP 24576:cs41mRAps6vGNkrQAQHAQUwzEB4hWQtDBLIfIeBCs6oam5dXKLRzMEiJsfasHPZ1:cs41mRAq6vGNkrQAQHAQUwzEB4hrtDBt
TLSH
T135253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E8FA6C588ADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_293703612\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH