hxxps://gist[.]githubusercontent[.]com/ost101999/281cb35935a7f3a35af3737f23ebb04e/raw/

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
15/04/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gist.githubusercontent.com/ost101999/281cb35935a7f3a35af3737f23ebb04e/raw/
Sample260415-d2v8lsd13r

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1372037248\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4640_754213216\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1340326865\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1144411958\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_851284146\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\page_embed_script.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_851284146\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1340326865\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1144411958\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1340326865\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1144411958\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4640_1334691514\_locales\ka\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1748	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134206974567255438"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4214655515-2537246629-1547560666-1000\{BE34F7B5-08CF-4859-A792-8157D1A9D30A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 6124	4640	msedge.exe	81
PID 4640 wrote to memory of 1748	4640	msedge.exe	82
PID 4640 wrote to memory of 1752	4640	msedge.exe	83
PID 4640 wrote to memory of 1752	4640	msedge.exe	83
PID 4640 wrote to memory of 1752	4640	msedge.exe	83
PID 4640 wrote to memory of 1504	4640	msedge.exe	84
PID 4640 wrote to memory of 1504	4640	msedge.exe	84
PID 4640 wrote to memory of 4784	4640	msedge.exe	85
PID 4640 wrote to memory of 4784	4640	msedge.exe	85
PID 4640 wrote to memory of 4784	4640	msedge.exe	85
PID 4640 wrote to memory of 5552	4640	msedge.exe	86
PID 4640 wrote to memory of 5552	4640	msedge.exe	86
PID 4640 wrote to memory of 5552	4640	msedge.exe	86
PID 4640 wrote to memory of 6028	4640	msedge.exe	90
PID 4640 wrote to memory of 6028	4640	msedge.exe	90
PID 4640 wrote to memory of 6028	4640	msedge.exe	90
PID 4640 wrote to memory of 3956	4640	msedge.exe	96
PID 4640 wrote to memory of 3956	4640	msedge.exe	96
PID 4640 wrote to memory of 448	4640	msedge.exe	97
PID 4640 wrote to memory of 448	4640	msedge.exe	97
PID 4640 wrote to memory of 2872	4640	msedge.exe	99
PID 4640 wrote to memory of 236	4640	msedge.exe	106
PID 4640 wrote to memory of 4168	4640	msedge.exe	107
PID 4640 wrote to memory of 1868	4640	msedge.exe	108
PID 4640 wrote to memory of 4568	4640	msedge.exe	109
PID 4640 wrote to memory of 4568	4640	msedge.exe	109
PID 4640 wrote to memory of 3340	4640	msedge.exe	110
PID 4640 wrote to memory of 3340	4640	msedge.exe	110
PID 4640 wrote to memory of 3760	4640	msedge.exe	111
PID 4640 wrote to memory of 3760	4640	msedge.exe	111
PID 4640 wrote to memory of 1684	4640	msedge.exe	113
PID 4640 wrote to memory of 1684	4640	msedge.exe	113
PID 4640 wrote to memory of 1236	4640	msedge.exe	114
PID 4640 wrote to memory of 1236	4640	msedge.exe	114
PID 4640 wrote to memory of 1936	4640	msedge.exe	115
PID 4640 wrote to memory of 1936	4640	msedge.exe	115
PID 4640 wrote to memory of 2556	4640	msedge.exe	116
PID 4640 wrote to memory of 5632	4640	msedge.exe	117
PID 4640 wrote to memory of 5632	4640	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gist.githubusercontent.com/ost101999/281cb35935a7f3a35af3737f23ebb04e/raw/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb809fc188,0x7ffb809fc194,0x7ffb809fc1a0
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7802475251763873207,16402185049709469942,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,9718766053342947081,739686280471239797,262144 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,9305503333332142151,4823573795274869951,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,5696163905873086140,18013614736296208867,2097152 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5966331532032138077,16353693230221809006,2097152 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4848,i,1343856811175330759,13621224070218992006,2097152 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,15682183760055208390,14388578052808520040,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,3642845029269740624,16882207201251252466,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,16114149427083539255,14051807286231853620,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,16114149427083539255,14051807286231853620,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,18144941975714348468,1859060025412668809,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6968137573664506970,248269765638084906,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17960216702169739496,1868428745650780268,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3343468662570670011,620474907307597429,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,14106700551038365672,10299644449999881191,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,6888781967275787966,7443501777712904693,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,6469455396290288565,17349221149484587551,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,4506440747113290704,17971858493578565013,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14274293793334308035,11038789221288579013,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5224,i,4832134100312605143,609323917345762743,262144 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1056,i,15106161454200622772,324730505047720168,524288 --field-trial-handle=2292,i,14982791354819733559,14294806649497626596,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3bdd57139d99fb171187e241d0c03cde224f9c176dac9c20c60f28f29e64d27d
MD5 45635e74a1cb997ad7b0c65562e1854b
SHA1 410a8995e5f0ab9af3d7133e347ff08392ea8653
SHA512 239eff3e5a6810ecf550fe74b8292209366c145d90efbf4293b3f4e3842c2b505baa3cc749e27b80454fe4c792925cdb299145af908b40e927282f7899be7372
TLSH
T1DBD0803C52B57C74C86EE57424157B0B7519D87756535F15187315FC0C4314015974EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e61c9f908475582ec0a8eb3b5cf00399511c5e42d8f5f9e1bd10dee6c3382278
MD5 00930effb53150b1c15782f203b6b229
SHA1 f2d3a801df3b68ee8a225ab8aebfafbc557fe47c
SHA512 baf5ecdc128b0737fee0d6a21544bc1de0f07159bd0b831936ace2f6b71df216792cbd6f9346d50bcb17ca955a247d1d414d019e9f3233553a84f8ae7ace1c7f
TLSH
T138D0C03812B13C34C85EE47024043B0B3619C47306534F1418B314FC0C4314008970EB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f7855881a3d91883e782fa7e4118f2b25c9bfad861f404cfe49f41f24c7365ab
MD5 1d733785893abbbdf439a96154896e83
SHA1 eba2d9460c082d651a69a0c833ae8eeb8d83bd93
SHA512 86f3853d373d701f8b1c299bfbfee68ba995dc23877c46cae48b92321a6922c83e345c102095623242ce6cff4fd198ca7031a1293710c5fddcf99c77f57907e5
TLSH
T104E02BEAC920EC6758FC1769B054474AEE61030B2A51884F3B3C81088FB522A4585E5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6fa124172bcb35a7e5f98928328d80fbab9b85c5e8d018bdb6622b38bcefce2d
MD5 d30a0104a784e802b5b977d2e2e2b38c
SHA1 8b21900faf5ee10ddd25af742b9462379894f6e0
SHA512 1aace4023f2530874f854d98184341357ff5232dd4faf1b5f3bec6afe1f83645a6cc74153f15a687bee902d29f186806e4ddeeb0cb0421bb1e3368ecf29166c0
TLSH
T1A241C0F383E8C52ECA0196F0AA187E1BDF2D0554532C3D5A89E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a47c1c2c7111e09e27448d149e9b2d4f662beca4279c4e1b8444abff7c4860cc
MD5 c68c9288bdf399ec6dba8ca2a14d9374
SHA1 359b17cef2cd6dbcebf6f97fa3c6b21fda748de5
SHA512 048c97418cba0b9adf8bea37cf39aa26d22f52dab43a057e16cd5c82f24630d2a044710779d7b16b541bc966a6cd55acf6365f9375dc6203e60c1d7924e67296
SSDEEP 192:sxZWRQyMqZ/K1Ml8UQZ7t/f1sRxfdQBe1PYzodp2fHW6+WNTQG/Y3QXWATIg5ydG:sxZW9qxt/f1sRxke1PrsHbl/3sddE
TLSH
T1E872F8566A349D77CCDBD219FA457B53DAF9112791900E44AAFC8E0C11E6ADD320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ba25d7a741f296bb0fbe87a282fb60a0e19b69d4f9a27a48b6d5e8ceb3776009
MD5 309c72c9f9148ed18fbf25327a755227
SHA1 12500b64ae405795e74b829a20cf369afe33c6cb
SHA512 dd3b62f00c20c9fc6d6418838d8a89af52c844719e61b0d3ab310da61cf92fed06358b92a6c5a878d0dcc2fcc4294b70aa78c9e9fb5feeed71b1329400baed2c
SSDEEP 192:sxZWRQyMqZ/K1Ml8M7t/f1s+mfdQBe1PYzodp2fHW6+WNTQG/Y3wXFATIgSdoRJ:sxZW9jt/f1s+mke1PrsHbl/ySdob
TLSH
T11F7219566A386977CCCBD219FA457F53DAF9112391904E48AAFCCE0C15E6ADD320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1f68f89257fb56c19e658e17f08829d1a142ecf2c733f95bb184739dd95706a4
MD5 f5b6fe23cc4d1c351b00d549ab9b0bac
SHA1 50f604fd3710722f15f371fda9600a9970b80d46
SHA512 5cf6eec4309a9557fea15bc1c1ca7d00df4b1a1ac566b1c0dbb8f36637398b3c057189107141e29bad8aa6d213cd9f6132eb8230195e500c2087e171f3cd8add
SSDEEP 768:FAsxA8P7pLuL/tpWvIMLA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmn4zLlusg5qroA:FAsxA8JE/tpWvIMLAu1ja7n4zLUx5BKL
TLSH
T106F21B7B6C0CCB7E4F804E9CDD2ABE8A6DE802CB56D8895447FA940C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 13442f8d7f3b50bd58e6238d7d5df2c5bbaffe624697c1722a9e0723d04799f5
MD5 de03f37a92c89d8f48c7dd78a39be2e5
SHA1 3086e40a1e1aa94b834f07ee69a17c106a239705
SHA512 fd7ade4b92ee4f8ae221336b9d6f0c88be4a1486526419a3b9ce71a681c0f4c5a4963fc4e8f38058f969e4cb5906eb876e8efde31a2fc06a8342824f2a635a4e
SSDEEP 384:cnF65VzPbMf4xNR5BbslV4jFC8VOaUWWpC/WSY8B0Hs0XiXN2B+7lI3MoemWZmdM:cOhfN2B+7vnPtk3JXwJ1
TLSH
T141C25B2471BEC2113A7D3AC89199BC66434230623058F93B7FE950A64F67E181DFDAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e5eaa9bac99b7e3d350cc5acf6044e53baf9d7bcda37601909e541cdbeb5513d
MD5 51fc912d1dc91c43987ef0a603859d08
SHA1 c27311480ef5dd3981922703d91ffa2112adbf27
SHA512 466e4adc6d0c45116f0e5f8d23663240deb66d7d3a6736f6142a2ea9c028c537ae5e0bfe0dd6e79624e7b7e1bfd737022c397a6fc54ab9952698da3e76011b08
SSDEEP 384:nViFavqMg3sN98TUNTUlImkrq1/Ikd9rfzYaGFPih7uakX+VWi9Uy5aiLNPk+5vB:cFayv3awgCTYt4FuaMyJbR
TLSH
T1CAC25B35EC98DEA7ECE68FD9E74A7607DEE001A3958C4AD8D9D81D0D10D719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dda4bd4dd4efba37d33d93f31e91597cedd52741d44572541da4a31e1ca5f0fd
MD5 95b84deb1ea0df45ac5beb2d0d3a3802
SHA1 edcd29344a5c32ec4ff4fa36a09eff090f6f54aa
SHA512 5f1df3bba49185162ce254eb48e55010811b9bd31b000ec4d9c7c4d22f9890462afb2c640a3a39f61fb4696903641ac3df9a63a5a6c1a905615b777e5a8cae10
SSDEEP 384:n4iFavqMg3sNJ8TUNTUlImkrq1/QcC9rfzYaGFPihM0ukZmkX+VWi9Uy5aiLNPkg:DFayv3WwgKaYt4y0lmMyJbR
TLSH
T120C24B35EC98DAA7ECE68FD9E74A7607DEF001A7858C4AD4D9D91D0D00DB1AE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d662e10789a377ca4f61d8b29f06af86eca023432369aaf7e4a0681ed08e6cfc
MD5 0e55be93a4f7c38ef5ab1cfa603a4d27
SHA1 ad9b526474298500d66745c866c38d379cedfa58
SHA512 13dd274f1f62783847713f49f5866887318059b7610978256bfefac82cfe7ac49b001448bcc9f26c61889019c569a1dbfc8f04da94cf00f363fbec9a7274bc72
SSDEEP 384:nLiFJjccCs+Bt0S3m3sNV8TUNTUlI4kRq1/n1h9rfzYaGFPihM0uk95mk5NLNPk8:mFJccQG3Gwg6nYt4y055mcTTr
TLSH
T17CC24A36DCA4DDABFCE78E99F74A7643EEE00167868859D4D9D91E4D00871AE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d41cd313174fd494ccb3e7022ce4af544ffdb1fdc2829b89a07b5e0bd7e86c7d
MD5 d8ffc16d20e864fd8ed200fee0de6efd
SHA1 b45b25b9fc0d8df7c99be5a56d4688fb67236f2b
SHA512 9aca2c73270bb4086e405ec392a3ea21a65a4b9921b989c01fae71220d08cf4cecbc58969badc1aa0c73b42df15f61a5e1e659bea1cb2220e10f925c334f7991
SSDEEP 384:nZiFJjccCs+Bt0S3gR3sNV8TUNTUlI4kRq1/D1h9rfzYaGFPihM0uk95mk5NLNPn:wFJccQ03GwgmnYt4y055mcTTr
TLSH
T185C24A36DCA4DDABECE78E99F74A3643EEE00167868C59D4D9D91E4D00871AE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8d28704b8541f430e26b0a40c8497122a67f5bb68471153ea6b953ec20338440
MD5 736f156554397ffa90b19b43dadacd4b
SHA1 226a0745306d55718abb2cdf474ba1c33b964679
SHA512 484bc582bbfc2be7e5833f7729399c7d836ef35902530c2dcd10f4e7fdbd62f06316015b7a5359ae2f0007c466940c6649caa61c37e298e81f0be4b4f89ad12e
SSDEEP 384:nHiFJjccCs+Bt0S3bMR3sNV8TUNTUlI4kRq1/Dgh9rfzYaGFPihM0ukhVmk5NLN/:CFJccQU3Gwg7nYt4y0NVmcTTr
TLSH
T174E2A0F598D38977E89E8B97A37D2E429EBCC057B5485994BBC41D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5ebeec7a2efcc3d4ab4ccb9cb1e8dfa344917c4aa41c208297710005e13745c9
MD5 079e07e3f391953bcfcf2f4f2abb298e
SHA1 ebfab3098c1f131746ab86a69773ffd1b5a1d4a2
SHA512 9de575e8feb4e2f4de6940a21a9e796a34e29543765ebe7b48c0f23816c7d14e9b947f2aafd5ea8c54ded13d43ea534792d5a1760590c65dfe85eee34cdea3d6
TLSH
T1704140E04C3C26D1E1BD1A2FB04B74FC85DCD626F864353D6828EE98467A65E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aae92d68dfda303ff90ff9c88131bc6689f64408336bd31e6cd8b7ea34bfa1a9
MD5 e5faced8a0d5a453c927c32fb125199e
SHA1 23db5aa85754df6308db92969d6ec7c575939976
SHA512 d0f19f5999b040a9dc3e4262ea7af144f3e68e4f44724b435dd01f26db1e8c577ebbc9e0c125144d58662e5639a3363938ccadd12acb2e063d42a3b9efc0dd9a
TLSH
T1CA4172E04C3D2AD1D0BD1A3FB08B74FC85DCC626F460343E6818EE88467A50E648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 43b2da1c5174b3b155b6ff3942753d197183c7c30fa090af80e04ea9115b8172
MD5 7f8651d0c39434de8dfb353f45c63abd
SHA1 beba32b7a80175d5be24bed6cd1608c67048e7e0
SHA512 dc13ba94bb89e48a2d14aafdc7752f48e221849a97a1cbc0d5da6eb6ed670211d3b5ca60ce19377df710c91601c712a36a9881f0f2278cac0f2a7aa3e392bf6c
TLSH
T14A4141E04C3D26D1E0BD1A2FB05B74FC85DCC626F964353E6818EE88467A61D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5d5cae63a62aa49eaa6023b9b34b8c02d3514e997523b308fd4cb1b8ba6dfc8f
MD5 17e58452cba86127e6cb7d37a746eb5c
SHA1 a4f58ebad142681d58991e38f7f8cc0895b34462
SHA512 6698ce9ae2d910afec861bcb2b788027b6024121f198c974f13ecf4e46e99874797a7b95e823cdde51a29fd015a9e3f5870c9e531283b060fe6bb9eea2239e1e
TLSH
T1B14140E08C3D26E1D4BD1E2EB04B74FC85DCC626F464357E6858EE88467A51E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5ac0a0f4b3ae21ab8a1e3ad626b05c19a2e3c10cc218d1176df39909e7ee439d
MD5 7f8f1f381e94558b6b707c8944c6fce6
SHA1 57ca01f9143e68b1efd38cf9953a68d41ee9adf6
SHA512 b17e5a294ca7ae10b8051e315d2080346995ccf85ed9cf504d51ccedd54ad3fdd3b2ecaaabdeb22e9c0bddb293f18a29f8235384ddc6e855bdcb44825f24d509
TLSH
T13D41E749BAFD1148B3B76F169BF6A86E487B7C772F06C55E00010E8E0663E01C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download