618af58cbea61932c25959bbc281746df6dc0405a703e265314ee98500f69b50

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
University of Utah.dot
Size 61KB
Sample260416-dr6llaex8j
SHA256 618af58cbea61932c25959bbc281746df6dc0405a703e265314ee98500f69b50
MD5 90b852e044423eb2756db69ff23fa03e
SHA1 c966719823e2e7a43d411dc5cba8c4cf1d8379ca
SHA512 3da3eeef13b7470d1194e8322f6b5b1e45c4c979df96efc00bd56d4c25fa0f9ae2bb74ede9d62fee1db869637a9e4270e23349e0ee994c5241fa0713bad74f4d
SSDEEP 1536:0h6njBiAGMURjepu4Q9RoRf6Bxdbjio99+NXuu+iiiuuDuuuluuuPxTuXoijuuuR:00jBHERjepsf4f6Xdb799SXuu+iiiuuR
TLSH
T114536D8239DB9C18F4B3D77D5639910929397D5D1F3A943D10A8BF3B19F0AF08888BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207829792797512"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{28C32E98-1D1F-4DE6-A9A7-92A5EF2EBF0F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2000	WINWORD.EXE
2000	WINWORD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE
2000	WINWORD.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3188	2000	WINWORD.EXE	97
PID 3188 wrote to memory of 4420	3188	msedge.exe	99
PID 4420 wrote to memory of 1912	4420	msedge.exe	101
PID 4420 wrote to memory of 4884	4420	msedge.exe	103
PID 4420 wrote to memory of 1392	4420	msedge.exe	104
PID 4420 wrote to memory of 1392	4420	msedge.exe	104
PID 4420 wrote to memory of 1392	4420	msedge.exe	104
PID 4420 wrote to memory of 3744	4420	msedge.exe	105
PID 4420 wrote to memory of 3744	4420	msedge.exe	105
PID 4420 wrote to memory of 1628	4420	msedge.exe	112
PID 4420 wrote to memory of 1628	4420	msedge.exe	112
PID 4420 wrote to memory of 1628	4420	msedge.exe	112
PID 4420 wrote to memory of 396	4420	msedge.exe	108
PID 4420 wrote to memory of 396	4420	msedge.exe	108
PID 4420 wrote to memory of 396	4420	msedge.exe	108
PID 4420 wrote to memory of 4764	4420	msedge.exe	109
PID 4420 wrote to memory of 4500	4420	msedge.exe	110
PID 4420 wrote to memory of 4764	4420	msedge.exe	109
PID 4420 wrote to memory of 4764	4420	msedge.exe	109
PID 4420 wrote to memory of 4500	4420	msedge.exe	110
PID 4420 wrote to memory of 4500	4420	msedge.exe	110
PID 4420 wrote to memory of 1628	4420	msedge.exe	112
PID 4420 wrote to memory of 1628	4420	msedge.exe	112
PID 4420 wrote to memory of 1960	4420	msedge.exe	114
PID 4420 wrote to memory of 1960	4420	msedge.exe	114
PID 4420 wrote to memory of 4640	4420	msedge.exe	115
PID 4420 wrote to memory of 4496	4420	msedge.exe	116
PID 4420 wrote to memory of 4640	4420	msedge.exe	115
PID 4420 wrote to memory of 4496	4420	msedge.exe	116
PID 4420 wrote to memory of 5252	4420	msedge.exe	118
PID 4420 wrote to memory of 5544	4420	msedge.exe	119
PID 4420 wrote to memory of 5544	4420	msedge.exe	119
PID 4420 wrote to memory of 5632	4420	msedge.exe	120
PID 4420 wrote to memory of 5632	4420	msedge.exe	120
PID 4420 wrote to memory of 5908	4420	msedge.exe	121
PID 4420 wrote to memory of 5916	4420	msedge.exe	122
PID 4420 wrote to memory of 5908	4420	msedge.exe	121
PID 4420 wrote to memory of 5916	4420	msedge.exe	122
PID 4420 wrote to memory of 5532	4420	msedge.exe	123
PID 4420 wrote to memory of 5532	4420	msedge.exe	123

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\University of Utah.dot" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://forms.office.com/pages/responsepage.aspx?id=DQSIkWdsW0yxEjajBLZtrQAAAAAAAAAAAANAAqF0NOZUQUZKTU41VTA2SEMxRU5QOVVVTzFPTkY2VC4u&origin=lprLink&route=shorturl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://forms.office.com/pages/responsepage.aspx?id=DQSIkWdsW0yxEjajBLZtrQAAAAAAAAAAAANAAqF0NOZUQUZKTU41VTA2SEMxRU5QOVVVTzFPTkY2VC4u&origin=lprLink&route=shorturl
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffd1142c188,0x7ffd1142c194,0x7ffd1142c1a0
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9333991756803212075,5683597386365004473,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      System Time Discovery
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16069304814912682863,3690825755471428390,262144 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,13530502371833239655,15254070167721751042,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,4137518947919547476,6002937840691592696,2097152 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,9602464780366716014,1604362317799519308,2097152 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,9190457430893480348,4225019489246344984,2097152 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,17652787815776998439,9470163333644099815,2097152 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,10094582068222396143,9117722004779875790,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,8723526237477690422,16000684957354106195,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,947269071280446030,9354331393054731511,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7002671439663802487,12460022301366999204,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17339507607729237828,2679151783085838145,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17339507607729237828,2679151783085838145,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,3140195714487236136,5868053841780585393,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1277458103293328794,10569218318335965752,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9550267132584059391,2603741681724413280,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,1168936575744222376,8726045751265048120,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,13531959944804737066,4355683429196622488,524288 --field-trial-handle=2296,i,6761180936098967198,13153594960470479450,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
      4⤵
      PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4224

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f00ccd228daef1e7764629352f6409e7c411bd43dff6a14e6176681c9e065b7d
MD5 24f2c2bfd492fe4e654457e784f4f6b8
SHA1 04fbc59c7b048d74c093cf2cdd864902a365343b
SHA512 4293a0df8e2ce03ba3585c17302c6752db46ca64a5021251bd26cf4e43302dbc01bead80831601d6a6832304146c7e33438cd767e01c1e04bffd675aa12c87bd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T19CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
MD5 6152b0c1f75d5d080bcd3802185a9245
SHA1 4f64d728e6f0df535705d56e0e7a69fc1e71917c
SHA512 28c794bb2d2495521df039966b1a9e94a2843c311371b43db2ea79c54226693c48e9527fea13c5656d1ef3768cdbacfe060b82385bc27c6d4a2715b8b656c7da
TLSH
T1C3D0C00C73722C30C4C9CC300858730F2D19C8F28E42436254371A385DC20C045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
MD5 e2acf35f85cc51742b6dbfd089a22de7
SHA1 d2f831a4d2d2a72bc82294e0db4496d425f3c241
SHA512 dc7c313b6984de31fba866906b65c34a375452af96f5f8d900080a50233e15566612618b446d95b3283af79511b9492a004b9a8f220a70ac98cbe8ba536fdac4
TLSH
T1A8D0C00CB3322C30C0C9CC300859730F2D19C8F28E42036154371A386DC108045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58677a577dcf11ba96e255ad6dc59ffde2fcfea96db6fe3102a0182a37ee927c
MD5 07afe91f36cc3f11da4ab87b3252c00e
SHA1 82e1c53661b93dee1d6b51d3518616559fc4ffda
SHA512 7eb2f18c0ad2dc7f8effd52be924305a96d39d96c2c754195d72fd591402a34e557eb9f2b7f44de0cbadcce1477619db21431ab8c69dedb07a2d9346d5339fa1
TLSH
T106D09730B3A6B811C00540300820522A2E1AC8D16C970191E028422CEEA808487C21D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3c544b3e86aab2eade6ebaf475f0f58f9f69f4c477aafb94ca6eebd4e578fbc
MD5 4e24cb4220e35ea463a66d49f1ebf6bb
SHA1 4f2c3fd40c9b6aca4177bc4eddeb46917127acde
SHA512 1b9511896b9905a661bd28dcda2cc01be41dc3d61e2f97c5518ae8c23cbecd4feb7b3a767f12bcd7af492c6d184051e35bfb8b0d01a277239137556cef16b1eb
TLSH
T1F061D24041A5C82BE7E36DF123BF1C44B6A08BFA10326EE836BC473D4E0EBC25C45822
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b13a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b13a.TMP
Size 3KB
SHA256 dbc194ec04d7a23ba73f4107c7bfba0cd81ad1c8a382bd286c11dc746b5a126e
MD5 9f144990f1175f81bb6755278aac142a
SHA1 851c2d68d2594c4099f2491b3e2ac935faa919fe
SHA512 8f0c95fd8b5a714931e3f88e211f3745e9650cbc83f357237d9cfbd1bf214b5a72bc19bb74d052ef4c13f947a49b4debcee695c4018687feb7f6c681abdddf61
TLSH
T17E61C24051A6C82BE7E35DF123BF1D44B6A08BFA11326EE876BC473D4E0EBD21D85912
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b364b2834d2bcdccb5e62149917db4a96df28e2ba92b51dc8c6582ad4c1edc0e
MD5 5f63bbda875281e5b08d1bea987a1dd0
SHA1 3d73d30d8bd8a1cd2bdd9b9e8a2ca2eab161e2d3
SHA512 8a16b3033d7a9f86966bbc269aaede0831c82ed9d63c172b70169e404da91f4239dae66c3ced1ac39950eee007d9196933461e2aad1864a7f3384346efc7db47
TLSH
T1C741CEF7C3E4856D890156F0AB18BE2FCE2D0950532C3C5AC5E4AF1BA3E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7cef25b12c398511a098364aaa85ae2749a2c6e774eead73e87fd8e94d526927
MD5 9355f92e5e3e8d4ca5075b00d29481c3
SHA1 e583c531c800fd6c774c1b14071d36f982b29a91
SHA512 1da920e23becf6999edab4a32ed55f9b34a3979398624d96ccea193734c587eaec31c5eb5a9d299b4c14a0a0dbced0407752f21e885a9faacc665bfbb0d5c306
SSDEEP 192:sxZaRJyM//K1Ml8hgjI/fCsyWpVysYrs9nhHIdp0PHW6+WNiNXgf/Yg/41SrZIgO:sxZaTEEI/fCsyWvysM2hIeHbwk/80O
TLSH
T10462E912AA38997BCCDBD208F9557F53D6F81562A2904E44ADFCCB0C04E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 249a33d6fdbc6a935dd7d8578ff52dd234cb3baa693f505d11447fed07ea5dd7
MD5 6dd2c669c19bf19f1b79dbf18da245d4
SHA1 3e7bca482a22f7fdb0054f79bcd5bff1040926f1
SHA512 b6742a267c506277ed306c140a7521a2f2149784163c92fcfc740496754d2cf006ab924710b88de1446ecdc0be9ed40b36e1b62d07ba93a20f588af56652c8e0
SSDEEP 768:6Usal/t7pLuLnNVWvNT6D8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/ZwoLl6QF5dro0:6Usal/bEnNVWvNT6Du1jaOZwoLIs5WfM
TLSH
T1BAF2FB7B6C0CCB7E4F804E9CDC2A6E8B6DE801CBA6D8895447E9844C03C66DB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2c8222bbca9fed9b359de3458165c9dc3ec3e5d8babf35b0741bb7024f16b215
MD5 4eaa51bed9a5da83c8ef1bf0f29f1d78
SHA1 96cdebe0748b4563b64ac960a7c9e28cf5c45f74
SHA512 ff1c0f93d9adc3a8636c7ac5f9d66b90e4165143bd9ec5c337340c4d0ac4b7be21c06def6728ac085af177e6339f171db34080204a994f30ceed73fa7af46445
SSDEEP 96:KoleKm8g7yKgIKm/SKEY3MgK1GOGPaKQU1:E0xdrPBQ
TLSH
T12ED17860317A56503A3E399A82E1B52F5EC23463305CA43B3BBD14A55F67E10DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dfafb8cb2a050c90ad7a3c48a6d3c03fad2e32e787c52e89bcddb0cf4b1e2be8
MD5 4767289e9ea2aa7ea17e94636d5c91d9
SHA1 86600763a68763a165fe6ca2f1cd66c6089f1822
SHA512 2c006f539552d9515fcd8257021e3a5abce1485d325a709e5ef5f32f71b4711f1d87763d88f04e1c3c3ea0c88f5171ca1805fd8e0c3d210ae5bb8ee02c8b8764
SSDEEP 192:gONgW6QaQmiUybBZwZ/hOQY5oddSRxMgbbU6:gONgW6vmwZ/hObCqosbU6
TLSH
T1B202D83578786CBB8EF2AE45F4872B175EE8117BE9562F84DAE81B1C00D769C1342836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ad1105011293cf6a1b52005eec0de0d2cbd5c7c846d5de20e8d36030b89e4fc
MD5 1358847799a24daef3a4a5b2b18d4e82
SHA1 587d307618b365c591997afc4cd4734d396bc995
SHA512 3ef915a5ef8e38f228608d30bfd124c39de562e824cc5cb1a1b12ab65f32d5f0f559dd21e3fe27afbcf0d021f31486df7eff109eac135f13272fcfef0aadbcd8
SSDEEP 192:LONr6QgQmiUy5BZzZ/hOQY5oddxTF8RtnaqMU6:LONr69gzZ/hObCJZ8XUU6
TLSH
T158120B76A8789C7B5EE2A555F44736135EB84237EA8A3F84D5EC1F0C01EB69C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74b9113fce4c7f13aea0969dc1b2e06ba28e36cd278c26d3eeda4357cfe976bb
MD5 b123b4380bc13d5464059da82439417a
SHA1 00caf8451eccaae685135dc81d8b69aeeec3a111
SHA512 e7b851233b8b3f967bb02a04b13ffce3a70bd7e4a95c6be47c449ecb43e52653b1e6b620b0f6a3acba79e3c8bb1faeece4ba5b6dbb2bf6b343353b78db783d5d
SSDEEP 384:nU2sNyvBaK0w5BE/hObCJZETQ8RAStiI1oM9Tk830YSK:nJWpOGJ6TCSuM9N30YL
TLSH
T1378229B1D4685CE744E1EAC9A94BF5032EB80237C9990E5CE6F87A3D309F5F85352C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

51e07ee7-1fac-4fb0-9cae-d058a584b3cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\51e07ee7-1fac-4fb0-9cae-d058a584b3cd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 e59f205e381afff61d7a9ab2a379768d2e12ca1552da5ddfc0d6a2d9709ee8d3
MD5 cda4348c3611df6a5fb7190df8b3d969
SHA1 c9e1b2e63d0ef335524510ca9b85fc79306694c6
SHA512 46b532f7b9ed030e668094fe57ab9166ea0599bb17a421af93ada26792010e7913edac193d45dc9b9788211df46fa13955e82def1ce6ecc45b61a901647c15c1
TLSH
T1B341375CAAFD1058B3B76E569FF6A86D487B7C272E06C05E10110E4F0666B40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 f9c4a5f4b6a985fca9dfa035ba05038d52f1f7baf97b68c90b521c4060007764
MD5 5777eb55263e658151e3bbcbf42a4391
SHA1 adb6b6233159d9703024ffad7186e05dc5c3cc84
SHA512 f785d0318e9f2716b0d75218d962f97bae89b5640da6ea9da086c342470bb8aba658983f79f6fb2ee42fff8c0396e3f228a5e008876185584b5c50963b6a2a48
TLSH
T157519E1C76E91144B377BF5A9FF6686E447FBC772A0A905D10510E4E0A23B40D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 398551dc8bfb2f6a8f46c4b676058fcd86a6f1408c8df90920f65a56bcb93e4c
MD5 e35a60a6308d950a3e3faf45559a8666
SHA1 8fb6788931096efa10bffb4804cc378530a9151d
SHA512 91493a30b7827df4352d7c22531730cc392928e1654a948e551a626ffdd47b0d7b4f39a8ac24ff4c943ec5d104916ba6c56b94dc7df3d87e65938aed1baa39df
TLSH
T15A410B58BAFD1148B3B77E599FF6A46D487BB8772F0BD49D00110E4E0622E44C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

48946f57-632e-4ca4-8ea6-1b85260108c0.tmp

Path C:\Users\Admin\AppData\Local\Temp\48946f57-632e-4ca4-8ea6-1b85260108c0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d158480-787b-4852-8025-2d03bd0c58cf.tmp

Path C:\Users\Admin\AppData\Local\Temp\9d158480-787b-4852-8025-2d03bd0c58cf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDB963.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dea8aba-59d6-4047-9375-2c4639468dc1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4420_1464409957\1dea8aba-59d6-4047-9375-2c4639468dc1.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4420_2088140057\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 083c8717a0be7925f82855c7cd1d24946af49fcb0ecc8f877545fca525cdf5e8
MD5 2dae33b6bc7dda9e89ff98c609e01955
SHA1 d696065af31bfff9773aa9bd4e07a1ac456bbef1
SHA512 20895e3aaa74f770650ebe67db7a3c00d81af25cc6b92605c3e9f5eaa7e558f853286ac8d5f10d681d46b9e40f67c830f8e01544fafb2a773bc9b0ded4a8b520
TLSH
T1F051EF0156EBAF13F08686B9173A8713EB717C43EA04A60D668C515FEC3AD901F9DF29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-0-0x00007FFCFCA50000-0x00007FFCFCA60000-memory.dmp

Download

memory/2000-5-0x00007FFCFCA50000-0x00007FFCFCA60000-memory.dmp

Download

memory/2000-13-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-12-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-7-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-11-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-10-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-9-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-15-0x00007FFCFA1A0000-0x00007FFCFA1B0000-memory.dmp

Download

memory/2000-14-0x00007FFCFA1A0000-0x00007FFCFA1B0000-memory.dmp

Download

memory/2000-1-0x00007FFCFCA50000-0x00007FFCFCA60000-memory.dmp

Download

memory/2000-8-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-4-0x00007FFCFCA50000-0x00007FFCFCA60000-memory.dmp

Download

memory/2000-2-0x00007FFCFCA50000-0x00007FFCFCA60000-memory.dmp

Download

memory/2000-3-0x00007FFD3CA6D000-0x00007FFD3CA6E000-memory.dmp

Download

memory/2000-39-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

memory/2000-6-0x00007FFD3C9D0000-0x00007FFD3CBC5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads