hxxp://railtra[.]nsport[.]eu

Analysis

user interaction
yes
max time kernel
149s
max time network
159s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/04/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://railtra.nsport.eu
Sample260415-3qlbpsb13p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1214259001\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1214259001\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1164703915\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_610672341\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_355839013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4488_1219005673\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_610672341\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1164703915\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1214259001\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1214259001\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_2133512330\_locales\mn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2312	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207702084131979"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626041545-1565650712-3224088082-1000\{F93CBFB5-B837-4EE3-8639-06B4E22ADC06}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4400	4488	msedge.exe	81
PID 4488 wrote to memory of 4716	4488	msedge.exe	82
PID 4488 wrote to memory of 2312	4488	msedge.exe	84
PID 4488 wrote to memory of 4716	4488	msedge.exe	82
PID 4488 wrote to memory of 4716	4488	msedge.exe	82
PID 4488 wrote to memory of 2852	4488	msedge.exe	85
PID 4488 wrote to memory of 2852	4488	msedge.exe	85
PID 4488 wrote to memory of 2112	4488	msedge.exe	86
PID 4488 wrote to memory of 2112	4488	msedge.exe	86
PID 4488 wrote to memory of 2112	4488	msedge.exe	86
PID 4488 wrote to memory of 3512	4488	msedge.exe	87
PID 4488 wrote to memory of 3512	4488	msedge.exe	87
PID 4488 wrote to memory of 3512	4488	msedge.exe	87
PID 4488 wrote to memory of 1404	4488	msedge.exe	90
PID 4488 wrote to memory of 1404	4488	msedge.exe	90
PID 4488 wrote to memory of 5588	4488	msedge.exe	91
PID 4488 wrote to memory of 5588	4488	msedge.exe	91
PID 4488 wrote to memory of 3348	4488	msedge.exe	93
PID 4488 wrote to memory of 3864	4488	msedge.exe	96
PID 4488 wrote to memory of 3864	4488	msedge.exe	96
PID 4488 wrote to memory of 3864	4488	msedge.exe	96
PID 4488 wrote to memory of 3484	4488	msedge.exe	97
PID 4488 wrote to memory of 3484	4488	msedge.exe	97
PID 4488 wrote to memory of 3484	4488	msedge.exe	97
PID 4488 wrote to memory of 2960	4488	msedge.exe	98
PID 4488 wrote to memory of 2960	4488	msedge.exe	98
PID 4488 wrote to memory of 2960	4488	msedge.exe	98
PID 4488 wrote to memory of 5468	4488	msedge.exe	105
PID 4488 wrote to memory of 5468	4488	msedge.exe	105
PID 4488 wrote to memory of 5468	4488	msedge.exe	105
PID 4488 wrote to memory of 3028	4488	msedge.exe	107
PID 4488 wrote to memory of 3028	4488	msedge.exe	107
PID 4488 wrote to memory of 3028	4488	msedge.exe	107
PID 4488 wrote to memory of 5428	4488	msedge.exe	110
PID 4488 wrote to memory of 1576	4488	msedge.exe	111
PID 4488 wrote to memory of 4500	4488	msedge.exe	112
PID 4488 wrote to memory of 2856	4488	msedge.exe	113
PID 4488 wrote to memory of 2856	4488	msedge.exe	113
PID 4488 wrote to memory of 768	4488	msedge.exe	114
PID 4488 wrote to memory of 768	4488	msedge.exe	114
PID 4488 wrote to memory of 5992	4488	msedge.exe	115
PID 4488 wrote to memory of 5992	4488	msedge.exe	115
PID 4488 wrote to memory of 756	4488	msedge.exe	118
PID 4488 wrote to memory of 756	4488	msedge.exe	118
PID 4488 wrote to memory of 2252	4488	msedge.exe	119
PID 4488 wrote to memory of 2252	4488	msedge.exe	119
PID 4488 wrote to memory of 5068	4488	msedge.exe	120
PID 4488 wrote to memory of 5068	4488	msedge.exe	120
PID 4488 wrote to memory of 5592	4488	msedge.exe	121
PID 4488 wrote to memory of 4712	4488	msedge.exe	122
PID 4488 wrote to memory of 4712	4488	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://railtra.nsport.eu
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff961bcc188,0x7ff961bcc194,0x7ff961bcc1a0
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,14271456297082704681,1452081368768447740,262144 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9707109171557478262,3824740136512140896,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,15711798070119363556,4710142299128734974,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,13565371987656428501,11238250356361601187,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13174692548893646789,13881407905366304768,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,11211768972973624515,6693622870872171131,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,17955178804833165099,17161796766086484316,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,5260175724726601759,3157470225817091336,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,5260175724726601759,3157470225817091336,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6024,i,15300130900596459904,13265954841196740658,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4244,i,5595388468253020013,13227078900602513050,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3372,i,17891344744136406202,10579545499146886162,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6120,i,9136308454091861383,6126718204192219771,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5624,i,1476803103937688384,2701797703534126454,2097152 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,14690783051778141303,4474287454688499568,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,921589812627932439,1019267363906661696,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6870593389181339798,10087200045476573846,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,11101735102875911191,4736818906284820111,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9051306709585423499,15936024393041303786,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,7584618265180271364,11299178796537902834,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,3889048922638496608,2586434862729547023,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,5168017189140629548,12795029638682737277,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,11905574896875110364,2667865056279871143,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3512,i,14611464833235005910,12753145171331371424,262144 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,6502760748092585053,14376572068735690407,524288 --field-trial-handle=2280,i,14452061648981331050,13543649003788011105,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 96f45b5bf3f547d17e5732304dc980fbe456d82f6d2ff767a06a514f19299746
MD5 a3e3f2365b4a9f5e892bdab0cb23f5ff
SHA1 00437210a19ac4044fc5ab8b05fc67fb3d2c3e39
SHA512 61f23f7d3bb28843c3e55b500350240a688ef13fea94a492e7dd1721000f5fbe101214ecb44b96a44e9b73a8654ea1975ab3fa42ab07cca58e408d71a26671fc
TLSH
T17DD0C04C11F07C33C0488A700F417306350ED89BEF4193151833286C0CC300040D25C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2701018cd27c4946846a233b2808bfc7993b76fae755e7a22a791e82b176a546
MD5 dbc933955c11aa81b70b640f18e125dc
SHA1 724ef17c28aa600c64cde137098694e56f2fcbaa
SHA512 8ba15a50d96e6f9648bcb90820eb75148f7696d9c2c80d4773f9d62ca1d7f7386ac02d68288dc5670d6f30eb57100831998a442260dbf894b42313ad84257ada
TLSH
T1ECD0C04811F07C33C0448A700F817306361ED49BEF4193151833287C0CC300044D25C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3ceccc9418fc004bc2201660fa8e06e4f608989ef89ddf85c67cf143edbf0e3d
MD5 92599d6f4b7109efb162dd614c32fe35
SHA1 aedc5b6127367029c25d23656281cdec93e4e523
SHA512 1800c58d3cc51025960004d5f92dc2095078c27457de8f48b223a6ec2c18b1c51f55965ae078236d80f8e350ce7a899f90213adf4e7217fde077bd92abf560c2
TLSH
T119E02BAFC861EC3729FE071C90514747E66513673A40454F3A3D810D4FB417B4A9A85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d57cab336362cd7841bb344b5153159042a5be7bce460a9979eaec0a9b9187f
MD5 1829e4b6990028905f369e41c32a6569
SHA1 327d3f836a29e28a816c42093dcb0cf77f71db2f
SHA512 f809e9d13f5c786d774dbe257b1f30fd4cec13cf8dd65cc71bd93e5c80783dd4edfc9a672be975050698787523e74b87bfcb48810a6e999ab5e652b3d7af88b8
TLSH
T127717315DBA4CD6AFBE23176C6EB1087BE30455870472E5D92F98CBC8B0278392CC638
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b5a1d8bc3d57be24bfcc03c0faf80952322fd1bc45667d84fa8f1284664beb79
MD5 717417664a3f8e90963db5fd29cf8bcc
SHA1 213bfa7a8d361a26e5214216c2188cd3efbc289d
SHA512 448530a93ed6bc05dd9adff83d7d3df9d86b41375d05c31c3f70301858713a1c9e47bdd6f697ccde58be10d17cce16f327c4ddf06d7ca34367855915fcd26147
SSDEEP 96:D1nOaj+vFvhToz2Gj6PjHJ6kIzQN9KVcbCv1Aw3r1vx:D1Oaj+vFvhToaGj6PjHJ6kIzQjKVcbCf
TLSH
T192B1ACF3C3E48B6ED91252F0AA146E27DE6D0954432C3C4A85E4EF1B57F14B1E241A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2f3a8e730d476b0b8d979688a4efe3fa27b977c626da396d743e68c34adfa8b8
MD5 4b971bbb903045d666a74e114e2f61f2
SHA1 da80b592f3c2e6a02d0557589a9a0456f72ca6bf
SHA512 627e22b491f1d73e08c1a42ef364fff886dfe337bd926e6f8b87c57b711328a247e14e0238ba95c90bb3c55225377c3e8d7aec9101a90235bf770159d3660688
SSDEEP 384:sxZoTqhy2/fLs3vxJsdfcEIHw0/r9SrMVu:sAuhn/fqxJRHwGr9SrR
TLSH
T1A472FA166638997B8CD7D219FA457B53D7FA0523D1904E48AAFC8B0C05E7AED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f19611e8c55318a2a0b4b825250d1f3a73c96df6e47d2d7ab10854f1f200ea56
MD5 637688f2801f1bf20f5d79cd473b7954
SHA1 9568ff9f82ff6b5e85b0e52df968ab5f8386507d
SHA512 76967d3ea9d8c0fcf98c1eb2eafee4ddf40d5ca7d571576da5a15d3be9638f2ae232f577cdeb50744ecf7e5ba26d79daf6ab50c0c9909aaa01bf63a4b0b4a232
SSDEEP 384:sxZoTMy2/fLsZvxSsdfcCxHw0/0lSrMjb:sAYn/fUxS6HwG0lSrw
TLSH
T15072E9166638997B8CD7D319FA457B53D7FA0523D1904E48AAFCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a98eba86ff4fb105622b7981c8628e390b1e71b4141f60c3deeb881b37bfbf18
MD5 5d383abc3c7b604a82f973bef7d3e402
SHA1 71e1819cf9c55c8bb94926656fa12fc4a8cde3ec
SHA512 b772a96499a64114584182902621bd77da77b451b2fb806721eb9aa1940ed4d8fef2eb5b536bf46c6a83cef89ae83941f4ee60bf8848561178714d9bfbff908f
SSDEEP 768:/E0HmkK7pLuL/+SWv+2r28F1+UoAYDCx9Tuqh0VfUC9xbog/OVCMuNLlpvGl0rop:/E0HmkiE/+SWv+2r2u1jaPMuNLfOlf+8
TLSH
T199F2FB7B680CCB7B4F804E9CED2A7E8E6DE8028F96D8895447FA440C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bea16c0f71c62d30f56fb8ce2e800f080b9220de1a6fcb4f1af6da587151169e
MD5 7002311a08f84a6bf467e1164d545fcf
SHA1 82d5b0c02af6d1427ec3f6548fc8260d981e60cb
SHA512 42f3abefe4183aec2ce31e2d1540af8ee67bfcd18c23ed20faf9df02d56c5be2cfdd50facaf4e87502a0ef83e06e53acc2d164a0dc44f39f0909088a1ef0f9e9
SSDEEP 384:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFCffT3Z5tv:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFy
TLSH
T1B5B21711713706803A7E69CA8595B92E46C770B73028A93B7BB904B64F67E20DDFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 16ccde8130fe27e5b8a24d4740f4773631f185807886a652f97e90569b81b4f8
MD5 111aefee4142c4f94e32533048f50002
SHA1 3921e9d47cb412eb334c078810a46654d42bc009
SHA512 c0b6445e9a2ab47c53c840f8c341ad0381b28fd1947cfd777f4a6c1a1e85c787bd792c58b79fc56122afcb6a02d3cd88a53d77cada6d73ddbc23f1c50860627f
SSDEEP 384:nMDiFavqMfysN38TUNTUlI4k+IJDIAZrf7YPqcbMqT9m1u3VQMXU/AatId6fnyrI:jFayTkwgnmIYPqcHZZaMXabW66w
TLSH
T1C6E280F198DB997BE8AE4B97A73D2E029AFCC157B5884594B7D40D0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9041eed5ab2ecebc302d09eec07ad9ab42f903068c8a6ca8d3a7d78d8813ce4b
MD5 8ed8d62254572ace8ebb850bc98633b8
SHA1 10445af3fafa6371c0902c1f2a0a18225dc7479c
SHA512 18df6ec5e12cea170019ac317d1fbce9303b67ba5093b68e7e696bd8a2b8f7314c4afcea6a7adeb851650fb1b27301d13a7425484ea609fa4941d80f52fa489b
SSDEEP 384:ncmiFavqMg3sNP8TUNTUlImkrIJWccZrf7YPqcbMqTkUQAdnS4mtm8qrNlk+5vIs:cFayv3kwg+F0YPqcHgtAdS4sm8KB
TLSH
T172C23A75EC98DABBECE74FC9E7497A07DEE041A7958C4AC8C6D81D0D00971AE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 66e44c6c53a505e44d6d96031b72112b2526cebb7fa32c18a6f8a20511ba0c1e
MD5 3d90253b49341c0f173ce3636bbdd053
SHA1 8674e78e39b01c5e1535e9f9043ad992648da270
SHA512 ec488c067e0ae5b57ea27517851f34c11fbde58a896ad4c30991c64790926187352ac022fc119a5b8ec3763f28ef9976431c2196ee88ee94d54bff075fa8f284
SSDEEP 384:nMmiFavqMKsN38TUNTUlI4k+IJDSAZrf7YPqcbMqT9m1JbVQMXU/AatId6fnyrNu:sFayXkwgncIYPqcHZGaMXabW66w
TLSH
T111C24C32DCA8DAABADE64FD5F74A7607EEE00167D58C4AD8D5D84E0D00971ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8a1a7e4d5f21a2abdb90258f5eccbd7cde6d1704b1d4af373c9baea563e67fab
MD5 d782074efb72be5fc12c3efb567f855a
SHA1 785ae11472015f38fbcb36d9cb82c9a3c2fe61b7
SHA512 9ac5e23be98fe9fdfcdc92836035966bf89c0256d734041d6bbc4d2549690325a37e0dbdb84226168e8f622758e2b4d9081113719ba1cb9ad4c503047579cb88
SSDEEP 384:nPmiFavqMg3sNj8TUNTUlImkrIJXBNZrf7YPqcbMqT9m1qVQMdnS4mtm8qrNlk+f:VFayv30wg+jjYPqcHZjaMdS4sm8KB
TLSH
T1C4C25C75EC68DAABEDE74FD6E7497603DEE041A7958C4AC4C6D81D0D00971AE134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 75cedc9cbe7bc98e615ffb8ffa467fbe91ad505edeaa8a761d0c516c49a9f1ca
MD5 cf77666380138df2520f331c08ca1120
SHA1 f3ccc08145756e6f78f0295d24218d6e3e89c0f1
SHA512 27f00f55a6ab0c0016e7598f0dac38f8a682fc0b431760e121250b42ca4d3a1528f270bf591ad5ecea33fbbbdbb4858f9ae885c870c873d80c58bce4326b739b
SSDEEP 384:n8miFavqMKsN38TUNTUlI4k+IJDSAZrf7YPqcbMqT9m1JbVQMXU/AatId6fnyrNu:8FayXkwgncIYPqcHZGaMXabW66w
TLSH
T1BDC24B32DCA8DAABADE64FD6F74A7607EEE00167D58C4AD8D5D84E0D00971ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d3b66fb30bbe05857bb82438b361715946bb466ea7ab68309b10e6d35a5e2ebe
MD5 e381aea55dd936e09480a13def878886
SHA1 fdc6b5a25e7d850c6bfbc31317a8919d18f93050
SHA512 a5965a65a40ddf752a3c14ea2e3a7fd9595619343a93a0bc8ab994be0cdbf6adb940bddb3ca3d58d53d47cea71516b46ee193d4d48695e9cc9b990468452748b
SSDEEP 384:n8miFavqM23sN38TUNTUlI4k+IJXSAZrf7YPqcbMqT9m1JbVQMXU/AatId6fnyrI:8Fayd3kwgnQIYPqcHZGaMXabW66w
TLSH
T168C24C32DCA8DAABADE64FD5F74A7607EEE00167D58C4AD8D5D84E0D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 677ab99f9bcde31168bb9ae8d0cfcbbab752c81e404c1bb73d68b9352f9a0fea
MD5 240c5cf1fa72cc0c66bf9b10c8bb9b70
SHA1 97bd5188fe9e025a9a22c670eb83ff2f5a161739
SHA512 06489d1c81371cbbaf8988e1e365bc1c384a5fd029ad141a7fff879e9c1d58974857b5bb47dd479559b0dc1cd0be1b0062b73706442e68f0eca32a70a0c5e992
TLSH
T1B5417FE05C3D6AD1D0BD1A7EB08B38FCD5DCC626F5A0343E2868EA88463A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cb6ddf487785cbc34abe606fed4468a57246cc80ca791249bb483a53ab67fa9c
MD5 a4fbc57697fc41d43a3cec1530c962ec
SHA1 a76260da0d3e6eb3f8ccf5690543d878b6066772
SHA512 2123dc0e94266c1cad9d095d06f5ee2e71e09cd0c2cf8e5877aa99811e5ddecc3dea133f7d94e6a35a5c192decaf2679d72f3711c627ee7dc70282f7fa0397b0
TLSH
T1754160D05C7D2AD1D1BD1A3EB48B38FC95DCC62AF1A4347E6858EE88463A61D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a0c55642b41e6e656d2007f8ad2652aaf9bdbb3429560961746bc7435e57b352
MD5 08e87528e2b79f9077ca89a48a8db306
SHA1 865af7ba554806e829c18699a0475f915229d08b
SHA512 fa2a16796b71723471582c7ec8bb7a058afa9b2589a89d91b361836b416e7938dc946161348717c10c50d3b79cc3e79522abd051e41d341115c0314c240a4202
TLSH
T1B95170E04C3D2AD1D1BD1A7FB08B38FCC5DCD626F464347E6828EA984A3A61D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e86eb707d5212b19e8d13bad802a652bae2bbbcb75da1b26faa7af8f79af32
MD5 1d72e8938358c912a6e80bf58ba8a224
SHA1 bda9a2a157050dc945e766567ef9610e01809e22
SHA512 df8c5a32747aa3914cef31a6dc95bef57f7ff51210d3fc64cf2d696274abc3cc1737dc755ba20d1f5ff7ab6a876fbfab9b1ba1278a6ffb08e8abf68be9295025
TLSH
T12B4171D08C3D6AD1D4BD1A3EB08B38FC94DCC626F0A4347E6858EA88463A51D644543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f56368d460921426f4519b70b8a6788022b140996fe73801b9c692b747294124
MD5 5c2268353c0f59f1d33d20ee422fc43b
SHA1 8a8a03b51c0098edec529b49fdb37848e5b563e1
SHA512 b5ec5b0e01b0d5f5dd8ae5cb393b9a29609e4f544765adbc6e4a3bb55a841f0a8e2c43bd21b1837123abbbdc4dbdb4747e5e1992b9d8b4f878c6867240f19da6
TLSH
T1C8412A4DA6F91148B3B76F5A6BF2A86E487FB9372E0BD49D10110E4F0A66B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download