c4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/04/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe
Size 3.6MB
Sample260403-qd86sahs7m
SHA256 c4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85
MD5 f8eb62d2093788f3f5511800a80b8d85
SHA1 322728e974ce14314032a4ca5de61bba29e885c1
SHA512 4817101e9cbe09d83b4747ae2964c20ae7144882cfb5ca8c66bfec1599fa4b464076979f0c0d1d1bc97d5adb07ae8a751297e69f06bbaa237084ab033c570d54
SSDEEP 49152:k+TP2VmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+qtCy6qomSblF+DJyzKb3HtF:kOhnLrHp/qKm2/Sb/gqAZj+UzKb3HtF
TLSH
T1CD063813EB814AD9F3890536DE548140D72AF91997FB1321306C22CDDFA7387BF65A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_2047664546\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2008_1691215390\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_102_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_327932161\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_766534742\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_766534742\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_327932161\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_327932161\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_327932161\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_2047664546\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_766534742\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_766534742\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_649678534\_locales\ne\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2664	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134196954251029524"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{2F8E5FE7-27C0-4A88-B5B1-9EF2334A764A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 2008	5860	xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe	79
PID 2008 wrote to memory of 600	2008	msedge.exe	80
PID 2008 wrote to memory of 2696	2008	msedge.exe	81
PID 2008 wrote to memory of 2664	2008	msedge.exe	82
PID 2008 wrote to memory of 2696	2008	msedge.exe	81
PID 2008 wrote to memory of 2696	2008	msedge.exe	81
PID 2008 wrote to memory of 2220	2008	msedge.exe	84
PID 2008 wrote to memory of 2220	2008	msedge.exe	84
PID 2008 wrote to memory of 2648	2008	msedge.exe	85
PID 2008 wrote to memory of 2648	2008	msedge.exe	85
PID 2008 wrote to memory of 3524	2008	msedge.exe	86
PID 2008 wrote to memory of 2648	2008	msedge.exe	85
PID 2008 wrote to memory of 3524	2008	msedge.exe	86
PID 2008 wrote to memory of 3524	2008	msedge.exe	86
PID 2008 wrote to memory of 5588	2008	msedge.exe	88
PID 2008 wrote to memory of 5588	2008	msedge.exe	88
PID 2008 wrote to memory of 5588	2008	msedge.exe	88
PID 5860 wrote to memory of 1680	5860	xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe	89
PID 2008 wrote to memory of 5600	2008	msedge.exe	90
PID 2008 wrote to memory of 5600	2008	msedge.exe	90
PID 2008 wrote to memory of 5600	2008	msedge.exe	90
PID 2008 wrote to memory of 4036	2008	msedge.exe	91
PID 2008 wrote to memory of 4036	2008	msedge.exe	91
PID 2008 wrote to memory of 4036	2008	msedge.exe	91
PID 2008 wrote to memory of 6056	2008	msedge.exe	92
PID 2008 wrote to memory of 6056	2008	msedge.exe	92
PID 2008 wrote to memory of 4296	2008	msedge.exe	93
PID 2008 wrote to memory of 4296	2008	msedge.exe	93
PID 2008 wrote to memory of 3860	2008	msedge.exe	95
PID 2008 wrote to memory of 6036	2008	msedge.exe	96
PID 6036 wrote to memory of 3132	6036	msedge.exe	97
PID 2008 wrote to memory of 5476	2008	msedge.exe	100
PID 2008 wrote to memory of 4904	2008	msedge.exe	101
PID 2008 wrote to memory of 3988	2008	msedge.exe	102
PID 2008 wrote to memory of 5592	2008	msedge.exe	103
PID 2008 wrote to memory of 5592	2008	msedge.exe	103
PID 2008 wrote to memory of 5776	2008	msedge.exe	104
PID 2008 wrote to memory of 5776	2008	msedge.exe	104
PID 2008 wrote to memory of 4308	2008	msedge.exe	105
PID 2008 wrote to memory of 4308	2008	msedge.exe	105
PID 2008 wrote to memory of 2548	2008	msedge.exe	108
PID 2008 wrote to memory of 2548	2008	msedge.exe	108
PID 2008 wrote to memory of 3252	2008	msedge.exe	109
PID 2008 wrote to memory of 3252	2008	msedge.exe	109
PID 2008 wrote to memory of 1692	2008	msedge.exe	110
PID 2008 wrote to memory of 3496	2008	msedge.exe	111
PID 2008 wrote to memory of 3496	2008	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe
"C:\Users\Admin\AppData\Local\Temp\xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffca24bc188,0x7ffca24bc194,0x7ffca24bc1a0
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,7520195296178634626,9986570191266961233,262144 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,723304764556659593,16254882949883745032,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,11155908258060694847,11275016287582171867,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:13
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,971128251232718306,8811228724014407192,2097152 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,14536482734571001436,8162911392178740225,2097152 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4804,i,7023819254225979388,9640083724595691731,2097152 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5036,i,3877680325541918808,9419019767147608596,2097152 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3584,i,1394065640072106778,4373204715037016242,2097152 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,12073106674463971712,14324955080248025509,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,10214331133749022025,12149869302277945388,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5621878380517054008,5408949396221346787,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5621878380517054008,5408949396221346787,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3559095381162331027,10337788674943140213,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7912914933915215133,1058222262656262849,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,788119727625431491,222233349804356783,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16790984899778995394,8452022457201292089,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,11710245350482148869,9791226772941368804,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,7947639943799783033,13860687799365506750,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,2977131623945540488,5431191816775437397,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3520712715133938429,4189075888347688115,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5701092516848925651,18393875403065357582,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6540,i,2197171330585140557,2414886337963263640,262144 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,1184162258182742793,14047913086872868078,524288 --field-trial-handle=2120,i,7092168153228007161,8940565301045911194,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
    3⤵
    PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=xc4f82d956d5fc06562064413dcd294143fc6175dc29369251210740500124f85.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 88fa35aa016971673cb7a35163ab85fc0d3627c65d921bbd46ffce1b7e24d774
MD5 9e1ceaf01bcf9f9f64dd4c3fa0c3d2ba
SHA1 c2758ae0c80972dbe281e19bb96215fdc5985260
SHA512 ca9fabc54ff56d25ce81a5b06ad27d54ec3641782287ddd4e53d45d2ef74fc66581ecf2fdd1bb041205c8a3e532220c5d1211e31d644aad1cd5f8873ff301228
TLSH
T144E022AAC864FC3B48FD975810488786E7A0135B2B80885F7A7C910D8FB572B8586CAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 159f7ea02e424b5b242a09f4a70d0309e282257c7ec4224e38327fa15dfb9df8
MD5 0409990701446a42c6d206d50ba95129
SHA1 63dcd23314f0988454e10e1be1a747e83fa3d259
SHA512 fe447ef6232e70e0c9002bb0aaddd54cfec147c2e7c67cc847b5d1ee8fc76aaa343cec1603649fe39d1b7202b555dac3416d5137344b44f342716e143c7a61dc
TLSH
T15D713C5CE0A4B8D8EBD2ECB1A6DD167FB2B142980477EA1B81E04D7D397E34340884DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b467.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b467.TMP
Size 3KB
SHA256 212081f21cb221f8b135183688ada9d9ba3a60416d3ef5e130b9106d99017c2f
MD5 ed775192e2c8bdb07c50dedddb28229c
SHA1 2cd33398af8960ea6c732963eed96cf1b50f88e6
SHA512 7a66c4189044f02863b590bab32df6ba7fb3967d5c51588a55bc6e19c248f5c0e86d62b4ec6e0b7af4a6dc4d285695388947e04079a3dca2d76289ea5b2d7e04
TLSH
T17C61FA6CD065B4D8E7D6EDB096DD123F72B142A814B7DE1B91E0497D7A7E74340804DC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e0adc68730b1ee53d26013ced5b42af57fcdaffb1a0c8a656df446ab43ed6384
MD5 630ea4b099e0d47ad80c007b0c337660
SHA1 3f70aff02bcd9dea3a24efa546a246228c0cd912
SHA512 2fbbca89fc47e0f08d853a638f320c7e28026d80d6652f154b6906c4ec13ef5dccc26496aa5eb347b7ed4016bdd67b6eecbafc11a7ccef47eb345ad3302b44c0
TLSH
T1ED51CEF783F4856E8A1196F0AA18AF2FCF6C0611436C7C5A89E4EE1793E35B1E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e36466a63a5edac1b35dd2ff774529c3226c64a015575988401a97c0197c4d41
MD5 dc8cd7f6143b36bda8bc6cead2724329
SHA1 6734362dbf6d3c8041c9d8a7681973d6366fda5b
SHA512 8c4bcf4493bfbba7841c5688b337bac0146e05e0199be41590bc6d83fe52e25978f11eedf82ceac58473e5a0eb4076bbaa1c18afc021d2aa0a4e2e3a42d1eaa2
SSDEEP 384:sxZQHqen/fLsInTyxnOm3e3/bnfunlwae:sIKen/fVnTyZOMU/bfunM
TLSH
T13172F91A6A38697B8CD7D219FA45BF53D6F9156791400E4899FCCE0C00E6BEE621383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c97cc5b419857b449fbaff0f7e928827fb14467fa43d20dd21f5bab4f2c4d6b1
MD5 009866271dc5c0e4a7b9a235f499af92
SHA1 930cab0b06d9777775c88cbaf3bcb57fd4f56eb2
SHA512 6d3a2ddbd0e62f1578659a192aef01a4de12179facb81ae17acee2a39aa0f46e165e141944642d61bb626ee43c21edf17f22a76a861808f5ebd205a571e0718d
SSDEEP 192:sxZQRGyMqZ/K1Ml8Mcn/fLscjnTfH/ILc1zodp51/W6+WNHOafYfjlcapiDGIgjc:sxZQH0n/fLsknTff3e3/bnfuA6jc
TLSH
T15C72D816AA38597B8CCBD209FA45BF53D6F9556391404E489AFCCA0C04E6BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 2382fab23f5256ca482403d136ad89e31bf5c87efe27979746bd5f32c6b882a1
MD5 647d8aface2828b91a15cb49892b63d3
SHA1 3b73b09f1567c16f8936911b5b45900254fab0bb
SHA512 efee20f6a2b3c79d6e872ab6b0aa9e9d47ec970702b9bf29f9c7e92ec3414068474524c067b57619c83ff92805034412ed9facec75b3d835c0a1c616aadb965d
SSDEEP 768:EmN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3E7yZLl7:EmN9b8PT24ZE/CuWRmCCQx6u1jaKE7yP
TLSH
T11B031C3B280CCB7E0F844E9CDD26BE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 25cbec68f37eec7188d61bf571cf8219e23c784dc74cf7b821be735099a0250c
MD5 6c6ee0becbb03fde706de525987d7249
SHA1 6b2e8dc531ade3c814c6ae0254f4dc60b0479ac6
SHA512 1562029c9b48d97a987cba376c670e225d035a47c15692f17771c3a86e0a900d008fc850f698662ce6313ace81bdd1cac597a65520222474a20fc4ecd4b01387
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3E7yZLl1:EZN9b8PT24ZE/CuWRmCCQx6u1jaKE7yR
TLSH
T111031C3B280CCB7F4F804E9CDD26AE8E7DE8018B9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0e0040cb238346591770143e7ac8a9cd7a93a969d7438d6860b755e04541060e
MD5 dedbee95ab7b327b562696c53b934d90
SHA1 489dae16cb568b1023ac9ce841668e56fea2e116
SHA512 529854d045c917fd26cae66eca15eae38f4039a074af82e4e3b3adb7e865c4eab7622b9348f1fac2b5d34da9613ec051ba8457abae6928033aac29d269bf05ec
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZrImdMguw8hMTgYWyPa3m+7Ew:cdOlNXJjSSjroduZrImdMguw8hMTgYWn
TLSH
T113B27F15723B13903ABD258A8594F4AF42C231633018E43B7BB954AA0F67E64DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3beaad5ef2ca1cdc0fc8c152dcc6e4dbd3157458a3f4562f98d77edee4134597
MD5 03e36238199ea6013c87f7df7a24012b
SHA1 d727120a416f9f6e01fc558053553d7a1a84cab1
SHA512 9b93c72475bdcd76bfada192d1fc8b0e42870cc7382e3163519b168c2bf30670e144d953ac0c1232e0f83175ae79ac5734659f171f46cc76ad08abab9d451a54
SSDEEP 384:nniFpTumV7IhV2og38NH8TUNTUlIRa4dRN2214f+KYjgzEre0Xj7ZBSNBA1ANIfD:iFk6IDNg38wgX26KYszFcj7Z/VJR7
TLSH
T137C25C75ECA4CD6BADE74BC5B75A7A43AEE01063884C9BD8DAD41E1D00C72DE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 84f1c3707a370b89ba38bab8e3bf6e6f0a7366ece272d13a14c201775512be62
MD5 37476544b66da3823f5f89d433d1e84b
SHA1 14a0c05ee7b75abd676901b2bb88eb65d07c4c02
SHA512 ce5a6692e1fd7fd9331972d8af5d3d50afa66eed4430855aaccf68d49125507dcee9da86c6d0f60715fb28010594ba54aad402ecad21928abf3e958935d3f99c
SSDEEP 384:n0iFpTumV7IhV2oX38NH8TUNTUlIRa4dRN2214f+KYjgzEre0X97ZBSNBA1ANIfD:PFk6IDNX38wgX26KYszFc97Z/VJR7
TLSH
T18AC25C75ECA4CE6BADE74BC4B75A7A43AEE01063884C5BD8DAD41E1D00C71DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6f5171c725708f7e1507e9335290e29cc8c2b025c4111fd5734faec56163226e
MD5 662b118b89b8640e2669cf7b560db2d3
SHA1 5313079067eeba352fafc6e4ac05a51e0b7f860b
SHA512 1c8f3196e083c41b674658662e60b68b1483127edf9d7d54ee4121202442cbf5ee05c8044f8e2097f2dfb905aeab66268d2a4aa39dddac85a1aeb8f051882350
SSDEEP 384:nqiFavqMg38Nj8TUNTUlIxB4dT4e14f+KYjgzEre0Xm73Ra4yVrN1k+5vI+V:hFayv3MwgHSKYszFcm73Ra35
TLSH
T163C25C75E869CEABADE68FC9B7497643EEE011A3C84C4AD4DAD81D0D00971DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0c93cce92925195ec22790f2e6ac78a707172db2870aa7e2896d50722782346e
MD5 2d309facb9292aad4c1fb075b5de6122
SHA1 974ea3ff6227f78b96000890d5e39d57b7dcbc7f
SHA512 ba0a4d63b7665da86e7cae323e3e10f297227d6625ad7d2c5ca2847a25c3f88211f00218d1c782dc968f67faed50c8766390ab502547988cab9fdb386760088c
SSDEEP 384:nEiFavqM538NH8TUNTUlIR+4dSuN14f+KYjgzEre0X97E/urN1k+5vI+8:fFayK38wg3zKYszFc97E64
TLSH
T14EB24C75E8A4CE67ADE78FC9B75A7A43EEE001A3888C4AD4DAD81D0D00871DD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 129c8a2225f6ce356a05e3483be6aed459e62aaa1e2d5c47569863e320ae3e63
MD5 4a859a0ea636e10a603d4fef16de51f0
SHA1 0b2016c66bd882108a555e4b7bdadcd764634920
SHA512 655999003f4189e00c846677bb9b8373c7ec4c3dcb7b09f102c67dfeb59c9ead5b006c53d164198b2634197512ce7e8c3f3290349d9c18fae7a8ab5771159e61
SSDEEP 384:nEiFpTumV7IhV2oX38NH8TUNTUlIRa4daN2214f+KYjgzEre0X97ZBSNBA1ANIfD:fFk6IDNX38wgs26KYszFc97Z/VJR7
TLSH
T11EC25C75ECA4CE6BADE74BD4B75A7A43AEE01063884C5AD8DAD41E1D00C71DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 87fd4df33e5045382bf28a8ab6612dcd2d03952fd7a1ca1aef5decd0bbf0e80d
MD5 da811e7a0cbeef43a355d74e0610a847
SHA1 b5de61f68f8dd646f5c3c2edd0906b2e87424a7a
SHA512 d7f238d843731670f2ad1996d95dc5e4a82c45c7d4751abdfd8c8cf5abef8ff91c9660e2e78ce045bc82901a6791cbb74d903cdc182fc1f5af37aa9ad7ca7ab8
SSDEEP 384:nSiFavqMg38NA8TUNTUlIxB4d45BEK14f+KYjgzErN43Ra4yVrN1k+5vI+V:ZFayv3rwgLHEuKYsz+43Ra35
TLSH
T16AC24C35ECA8DEABADE74FC9A709B603EFE001A7954C4AD4DAD81D0D10931DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 923996e6876503e3482adc9eb5370baf141a491cdb62d37d5967023e9a40ed37
MD5 3b2a51b7647a5990af71785e7dc4a07c
SHA1 73f2c844b2de13015856df207608288a31468d25
SHA512 eefaa2a37d064639c01af81757db99eb93896bf554331d4e5f4cf1d42e2cec558300e14ca30b600f1918b77f1d50d4dcfbafff3440676163eb7a1b2f3bd52c66
TLSH
T1A5414FE14C3E26C1D4FD0A3E749B38FC96D8D729F4A4347D6824EA940A3E61D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cc2a6f66131e42e108e064d01abb5754b66dda2f9ed28fcb9366d04d2896ccc0
MD5 64ecbb2d2a425f14f7bb485e9bf3f9d1
SHA1 a6b81d745443d7f197ae690da7c465a7a4563cfa
SHA512 37cfdfb60964f798f8558fabf20b95b2bf6999f47ad31218dd7ae342df68038e60d159cc3804f7381fff153a94c0a32172f4077c7d229dfabf94f0516ace4ae0
TLSH
T1454141E04C3E66C1D0BD0A7E749B38FC96DCD729F4A4357D2824EA94463A61D748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1ed5b361c991dea74d1a56d8037f054d32adaa63d3f4700481cc12bcf8c5e08b
MD5 1343a22e0620b04c40899fd5427e7dd2
SHA1 5208d7bc5a032c1a5945d4e69b3b0bca5db5bc79
SHA512 0c5985a698a85f703ed2bbea61077b1f6195b3fdc52e2891cd1d99ed998f996a83ff32b0f1d2222be5b6e824c01efd68985c1b6445f748eaf27f3c0dbc41c2a6
TLSH
T1A74161D14C3E66D1D4FC0E3E709B78FC96D8D729F4A4347D6828EA84063A61D644043F
MD5 SHA1 SHA512 TLSH

Submit Download

ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 49dee4519296cfe64f14418c408fb1e26710c833bfdd59a67e61c6f0c8461eca
MD5 4253fdd629204a9f147b4a12aaf2b5fd
SHA1 1048580ca1f0a5a753787848b82bc8c165fd4d8f
SHA512 67a37d1b7f80d171c80e8e8ada648bc184f7dc4e44c8ace55a38fd45c368efc17ee3f0838d824e1cb0507033f5a43c5808dd629c852a03551216d1b122603c37
TLSH
T18BC09B47695E1EC54E58067D45054D368AD6574563655175380B7904047431D435145F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_2047664546\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_327932161\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_327932161\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2008_766534742\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download