dcc7beef3287a68b836da4429513d46e9082665691fe3c59923378cb025a936b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kotsugespoofer.exe
Size 3.0MB
Sample260417-ywvecabt31
SHA256 dcc7beef3287a68b836da4429513d46e9082665691fe3c59923378cb025a936b
MD5 ca7fbfbc2dab9ef390c3d8f06970d0c7
SHA1 c4beef6ec3807920d88a146882c5f1c7c5578de8
SHA512 8c9bbdf0b046d5eed926f3b3d1c723c797bb0fa72c558a0c48dc5f1918331f1549ea9b77ada79bff24f9d00642d50d9c9a606d68fe46178ac42c03d9a23396c2
SSDEEP 49152:zgTbH94Yx5cfhtbZY3dC00ko5bOGRFBC8D0cre2Rb/12fv8VhFzvnq5aOvbFyWHU:s2HfTV6dLo5H3XgcrPRb/1AyvzfjOvi
TLSH
T1FBE52319D7E504FCE1B3E5788D958912D777784A4372E38F03FC59660F636908A3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	kotsugespoofer.exe

Executes dropped EXE 1 IoCs

pid	Process
4864	spooferprivate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_857444734\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2023998039\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_857444734\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2023998039\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2023998039\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_857444734\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_857444734\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2046429674\offscreendocument.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3264	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209301247344908"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{A5ED528A-3485-40EB-B26E-079EC37D3E04}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	spooferprivate.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5268	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4864	spooferprivate.exe
4864	spooferprivate.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4864	4636	kotsugespoofer.exe	85
PID 4864 wrote to memory of 3920	4864	spooferprivate.exe	87
PID 3920 wrote to memory of 5268	3920	msedge.exe	88
PID 5268 wrote to memory of 4700	5268	msedge.exe	89
PID 5268 wrote to memory of 3264	5268	msedge.exe	90
PID 5268 wrote to memory of 5656	5268	msedge.exe	91
PID 5268 wrote to memory of 5656	5268	msedge.exe	91
PID 5268 wrote to memory of 5656	5268	msedge.exe	91
PID 5268 wrote to memory of 2976	5268	msedge.exe	92
PID 5268 wrote to memory of 2976	5268	msedge.exe	92
PID 5268 wrote to memory of 5864	5268	msedge.exe	93
PID 5268 wrote to memory of 5864	5268	msedge.exe	93
PID 5268 wrote to memory of 5864	5268	msedge.exe	93
PID 5268 wrote to memory of 2696	5268	msedge.exe	94
PID 5268 wrote to memory of 2696	5268	msedge.exe	94
PID 5268 wrote to memory of 2696	5268	msedge.exe	94
PID 5268 wrote to memory of 3268	5268	msedge.exe	97
PID 5268 wrote to memory of 3268	5268	msedge.exe	97
PID 5268 wrote to memory of 3268	5268	msedge.exe	97
PID 5268 wrote to memory of 2148	5268	msedge.exe	98
PID 5268 wrote to memory of 2148	5268	msedge.exe	98
PID 5268 wrote to memory of 2148	5268	msedge.exe	98
PID 5268 wrote to memory of 1392	5268	msedge.exe	99
PID 5268 wrote to memory of 1392	5268	msedge.exe	99
PID 5268 wrote to memory of 1392	5268	msedge.exe	99
PID 5268 wrote to memory of 4288	5268	msedge.exe	100
PID 5268 wrote to memory of 1820	5268	msedge.exe	101
PID 5268 wrote to memory of 4288	5268	msedge.exe	100
PID 5268 wrote to memory of 1820	5268	msedge.exe	101
PID 5268 wrote to memory of 5784	5268	msedge.exe	103
PID 5268 wrote to memory of 4960	5268	msedge.exe	115
PID 5268 wrote to memory of 3116	5268	msedge.exe	116
PID 5268 wrote to memory of 5716	5268	msedge.exe	117
PID 5268 wrote to memory of 5612	5268	msedge.exe	118
PID 5268 wrote to memory of 5612	5268	msedge.exe	118
PID 5268 wrote to memory of 6012	5268	msedge.exe	119
PID 5268 wrote to memory of 6012	5268	msedge.exe	119
PID 5268 wrote to memory of 4816	5268	msedge.exe	121
PID 5268 wrote to memory of 4816	5268	msedge.exe	121
PID 5268 wrote to memory of 5944	5268	msedge.exe	123
PID 5268 wrote to memory of 5944	5268	msedge.exe	123
PID 5268 wrote to memory of 1532	5268	msedge.exe	124
PID 5268 wrote to memory of 1136	5268	msedge.exe	125
PID 5268 wrote to memory of 1136	5268	msedge.exe	125
PID 5268 wrote to memory of 6060	5268	msedge.exe	126
PID 5268 wrote to memory of 6060	5268	msedge.exe	126
PID 5268 wrote to memory of 6060	5268	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\kotsugespoofer.exe
"C:\Users\Admin\AppData\Local\Temp\kotsugespoofer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\spooferprivate.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\spooferprivate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/kotsuge.407794/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://cheatglobal.com/members/kotsuge.407794/
      4⤵
      Drops file in Program Files directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffbe21ec188,0x7ffbe21ec194,0x7ffbe21ec1a0
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,13594745104111992841,2487956422398141328,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,9732876344995141686,1899368452176375640,262144 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
        5⤵
        
        PID:5656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,10021516144350471534,3554642116389189743,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
        5⤵
        
        PID:2976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,101101535339407545,632551410629428851,2097152 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
        5⤵
        
        PID:5864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,17737368677116207982,6961438910622839524,2097152 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        5⤵
        
        PID:2696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4852,i,2210182754258762440,15499067163036899762,2097152 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
        5⤵
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3500,i,9406474033155663850,3804895374880554270,2097152 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4756,i,14728290708252168284,7618669216004269087,2097152 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,6840179971516980474,9960102916010009759,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
        5⤵
        
        PID:4288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,8870577268972294074,18236283831354115960,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8775978399236299570,17927906781487080634,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
        5⤵
        
        PID:1412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8775978399236299570,17927906781487080634,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
        5⤵
        
        PID:5784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,15823687578430113332,9463875742458847102,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=556 /prefetch:8
        5⤵
        
        PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,16999484641110385953,6563640178234300774,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
        5⤵
        
        PID:3116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13303723174262778883,14081217272156716868,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
        5⤵
        
        PID:5716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,10423134235317273968,3580481836366415492,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
        5⤵
        
        PID:5612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,2527711150094284572,9659394097046003209,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=996,i,12646432786601227748,11401498881244279897,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
        5⤵
        
        PID:4816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,5965429513873760897,3253026440582216778,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
        5⤵
        
        PID:5944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,6060916150978454578,15310432526380061638,262144 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,8126250570979677602,11016167927892477308,524288 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3696,i,17542083483919716940,9254634651950165206,2097152 --field-trial-handle=2272,i,6130145481940037623,7997415150746383909,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2023998039\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5268_2023998039\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5268_857444734\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 38e04c9b684c1bad0a6894867fb56b708f32031be50754c20be898c916a32f19
MD5 debadef38ea9eb241c2f7f1ba70b4844
SHA1 ca423f97ab84e2a2ccb7aea767bdbe4c1d5e8ab1
SHA512 1ea134845e86110be3c27f814d7e8eaa15fccc63bdc1f7e4c143a965efec1ea738c57c20058e5ca256311a87af3961182aedb560100cead9392e687dcf88ec48
TLSH
T108E02BA6C872AC2B08FD1B1850544646EB5413472792494F3F3C93088FB6A374986C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec02df16fd6d315bc15e5051cbc5ec1201589b95702e47e6fab61f17e7d5c548
MD5 7bb7a9e30b24804dcb156ce644b3a804
SHA1 50749fc9617515bc64b48f36f7aa28de5c7d0509
SHA512 96c59fc07e106440e4e6ff0006b14cd502ca07102f7d6f314b43c2b7cebcaf576439f66109b579ee915ae70246b33b1733f1db58c3c99f1012e407ddb9d3ea46
TLSH
T171612F04A992CB99F3E406BAC6E20005B370577B134BCE1A39F8BA7F6E37B19D049525
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587421.TMP
Size 3KB
SHA256 9e2d35a4c3c0cb938d3636fde607442dcb63b9e460a1c9de1e97541aca0a5958
MD5 41139ce312b7fa4ad34d465206e606b2
SHA1 649087282c8332d4c12688048b64fa1301225d63
SHA512 a55838e65b70177035789fe54a83900115219cdc34766e435e2c337bfd835b33efb88fb3a5bfd9713b77f82c5a7eeb273b996c24eb9a151cb0170e3df520b2d6
TLSH
T1DB613004A992CB59F3E806B5C6E60405B3705B7B034BCE1B39F8B67F6E3BB15D048525
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5ef927480c021fc0daff83302bdfe103fc232621c295d41f7ba6e1cb191b0295
MD5 2768f27f97f1bb0dcf5fee04834502cc
SHA1 41c4813b194b7d5cf9f696634f65af2cabeb9ed7
SHA512 1f761decad3d28b7265eaa325c8c94bbe004e881c0bed618bdb51e8388e07e11d0d5cc286da44a9e8ca2479475b7b5ebba6306295c9ee0900d9201cee4a07507
TLSH
T14981ACB7C2E4C66DCA1157F0AB187E2BCE2A0958436C3C5A89E4DF4FA3D24B1E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 81c16bb89801a4001fd770d1e497bda495141c1ceb0032f30b284e0077e52a29
MD5 e86768d1ca2961da835c7aee063166ed
SHA1 a6f4b439a26a243d52da4687918b15eba686862f
SHA512 c15668478d80b0616c78f3852580f9b73f950332ad83b576dbce3f962716197f545df484c7e85ceca1f70ea5b28e96e873823919bd7ad1c33a1a4e0958adfe14
SSDEEP 192:sxZjRKyMqZ/K1Ml8UQHji/fOswKVqcdqrjU9zodpqzdHW6+WN3VL/zCKxnzmfkI9:sxZj7qDi/fOswKhi/2Hbh/nmwF6
TLSH
T1AC72D716AA38597B8CDBD30AF5557B67D7F8052391800E44AAFCCA0C10E6AED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0646024ed234527195903e1dab46322cb05b054a06bc2e3acbc9778385a961ed
MD5 15d0049b272aa0c368e860783123190c
SHA1 787ba81e4b667f07f16aa8ca1ec214b1926b6622
SHA512 9cc72fa9c3716040a92fd94f50e6dd050862c837d04b85ae62526afc4331dd847c8fca45f659e5939c71673cf1eadb8fefe3b2ed9ab56a84b34debaacdb53ce7
SSDEEP 192:sxZjRKyMqZ/K1Ml8Mji/fOskUVqcdqrjU9zodpq72HW6+WN3VL/z+KDnkmfkIgjH:sxZj77i/fOskUhi/9Hbh/CmwjH
TLSH
T13272E815AA78597B8CDBD309F9557B67D7F9052391800E44AAFCCA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ebfd45918a3eeb726a948f36c53d526b9d01a35e1a066d6e45bc3ada6ecb8a75
MD5 8862a97112da40947b5abf1396c7940b
SHA1 2d822112fa37bcd2360e395f7fa2291fc567e430
SHA512 180199763944d99b165a04ee7011fe05f9ae66be78b3f08772dc37d20c7f2bc7687769839f9f655400f77535bb074fac79aa4ec41bcc00c36154136c1af74bd2
SSDEEP 768:DcgLiAo7pLuL/aeWvaSXq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmMKJLlhzCpUroZ:DcgLiAUE/aeWvaSXqu1ja3MKJLDOp/Z
TLSH
T198F20C3B2C0CCB7E4F844E9CEC2ABE8E6DE4028B9698C95447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c128063bea137e8b93bc19eede543b043d1ab483917e1feb51c5b2f68ef02ef4
MD5 3d03b88bac9329b0613bf4bab26665a8
SHA1 10740fc010b457478e14136700e77397daaac692
SHA512 80af44828a9ce89b6ce43b7605c6d52a683b3a4536d2107aeace8d540fa2695087b831099b9dea4b26fbaff8030900e61d775678cde95fc7bd80eb91a21c1965
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BxzPa:krN/INhx+kcxKBzxxba
TLSH
T144B23C11727A02853A7E398E85D5B42F26C230633198B53B7BB914A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f7fe132b0b988820db4efce60a6732ab69e637574ce16ed2dbe426d0c16a3fb6
MD5 18508630359c9f4133ff743c9f1fe709
SHA1 1f0514aa31efb2af8ccb67ececd56d4d19ccee2f
SHA512 cda774ae3a770e1aa4f3a89796406f0d60e0e579ed9154458fd38f5c6519125e44a1bc9644f43570e3427e1c52be5670878ec80a4fe443ad13e69a343a7bed02
SSDEEP 384:nJiFavqMg3sN/8TUNTUlIm2ZTPENv6O+fjYorttK2dgwIKAuRYV/Vw1mR2Ce0NrT:gFayv3GwgHwkYoJY2OwIKJRYk1mg/0pT
TLSH
T192C23A35ECA4DDABEDE68FD5A7097A07DEE001A7C98C4AD4DAD81D1D00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 015be4acc24fd018157931ad0c2a0ba803bfd264cdc46d2340c86d268eb88061
MD5 6ee58afc153b5318763f94489232a28c
SHA1 ff71ab9daf90666b5fe51f5a7e0d1cc07559545a
SHA512 8fba56f045ec8a59c47885b066234108c7590a8f9fde46a1ad50e452cdb511087334a3d801cee88fda82e9ff8fe517107bce8493d495750c063712596be7bb81
SSDEEP 384:nI+iFejccCs+Bt0S3b3sNN8TUNTUlI4eZTP1ODO+fjYorttK2dgwAyKQSBFT+mr9:4FIccQ73wwg1g9YoJY2OwrKQSyqm+
TLSH
T123C22A32E8A4C97BECE78BD5B75A7647AEE001538A8C5AD4D9DC6D0C00DB1ED130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 26387976583d8ec84b60086dcde357206f8a71dd2a3fd5e0a38cc3702f0d2d0c
MD5 1b73becedec97dc24627fded5042a407
SHA1 db2141255582d8285ae85708f918451094ee4faa
SHA512 a630b3f605628f1cf07ee17962c7732b88e1a772c07efed22f9754c10e2db5ded35bfd2645b6de4d410dfafa3fd6e29164a0b708670bc82a8bb75752f4a1a782
SSDEEP 384:noiFavqMn3sNN8TUNTUlI46ZTP1ODO+fjYorttK2dgwAmKQq3trN1k+5vI+b:zFayY3wwgZg9YoJY2OwXKQqZH
TLSH
T170B22A72E8A4D96BEDE78BD5B70A36439EE04293C98C5AD4DADC1E0D00D71DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3c357ac9a9cb62a1d588af7352cc7d8b1d6ef7bf94a9eb8da4586110bcd7d79b
MD5 a35cbf912acd146f462153a9c4a8ac01
SHA1 7710a78d0afc5fa843e912e7555e3e44072b6567
SHA512 d0f10b0d3455e6054fa5ce72ded9c2932a4619c3e5578b87935a291d29b9a4c69171ef7988433311f5a1ae6fca767416fc18bf63a44d6a833d44f103c68d0ae7
SSDEEP 384:nYiFavqMg3sNp8TUNTUlIm2ZTPNhwO+fjYorttK2dgwAmKQRYV/Vw1mR2Ce0NrNV:jFayv3AwgHPqYoJY2OwXKQRYk1mg/0pT
TLSH
T1DCC24A72E894D96BEDE78BD5A70A3A07DEE04267CA8C4AD0DADC1D1D00DB1ED130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2637c45da1aec26b85aad0006b1fd680de68a5ee7293fb48c8e2d65f6ce731f4
MD5 653df30933c2d9dd5d9ab569010cb18d
SHA1 e9f84afe95a8f83a0460d17535778b8453931b2a
SHA512 927c608ce574f5e338660013bfe54aeff97209a76cd1c286902b8361aa8ebaf21d10a6cd7cf1515950896868e1ffb51da94f5dc6d45e7d70d43c16b3c1cc41fe
SSDEEP 384:noiFejccCs+Bt0S3b3sNN8TUNTUlI4eZTP1ODO+fjYorttK2dgwAyKQSBFT+mrN/:zFIccQ73wwg1g9YoJY2OwrKQSyqm+
TLSH
T177C22A32E8A4D97BECE78BD5B75A3647AEE001538A8C5AD4D9DC6D0C00DB1ED130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f11cbb415882f57d061b86a7afda5b868d7c5b261917512ee00d7d35a29c4805
MD5 7cb2e9e0d8b0747c8fa5bbcbe83eaccc
SHA1 c7aac64a585a1dffb554602916b7a762df20094d
SHA512 ba3acbe67f082b170f9ab0461c79e7c819cd86385ac546ba19193b26994985aa244840592a3915e47e00d3770fd0f4316ca40b876e9c8a4665d8bb35fc1de9c9
SSDEEP 384:nIHiFejccCs+Bt0S3lf3sNN8TUNTUlI4eZTP17DO+fjYorttK2dgwAARKQSBFT+U:DFIccQ53wwg1l9YoJY2OwJRKQSyqm+
TLSH
T1B8E2C4F198D38976E8AE4B97A33D2E429AFCC153B5485994B7C81D0CCC861BFD30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 65f5cbf1be31936b1103e00122a60bb3ba7462d8832ac1f484dd6865116eeb10
MD5 73353cb8e2d08b76399542576119f518
SHA1 060bb58768be184f66fe1a67a40bcd57bf6c2e51
SHA512 f8841762eac69fdee0ae9b2af68c4c4bfbd49e42f1a1582803d4902395bb667530ae114dd66a05cd72a8668e02be7481d31c4a9624106db3d3e30f9d1d26bf79
TLSH
T1333144D19C7D2AD1C4FD0E6FA04B79FC44C8D226F16871BD5868ED98463D85E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 001a514c5a151516deebe6de244695d35b5a8321d530ea4b4a75c4e0b4756914
MD5 92964261776d308f92c0a73991a1205a
SHA1 752ee920df9f9a4efab983d9f45a9c01db30bd0a
SHA512 37fd3678df44c9161ba9e5d40bc7b68aee23c90fc5540134ed488476195d9c1e38bf17b917303b2b6ac95f1d84b13050e1ba382de226dbd6fec5c573929cd368
TLSH
T1193120D15C7D1AD1C4FE0A6FA09B78FC44C8D31AF168717D5858EE98463D85E240143F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5beec30937338d0e1bbe7aeed35dc7fabf27de33ec4b1b9b13a3b526158e593b
MD5 67c4228ca679dbdaea8ca16bbe3315f0
SHA1 76259dec8716151361ba996137e7a6003fedaf25
SHA512 31dd6a459d0809bc2ddfaa9c2b063c61c0a3c6f8f54d8e155a7f7a8b805bebda551c92f725b0d8517f3e160bfcf46cab2a74ade18fdbb503fcfd6ff6ee046dbe
TLSH
T147412B5CAAF91158B3B7AF5A9BF6686D087A7C772F06945D10010D4F0A33B40C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

imgui.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\imgui.ini
Size 280B
SHA256 59f4447e0701245f47d108f1ccc36d73fb4f73af56a9a93ac28a3536d9c6a5f4
MD5 5719581f60863069ab0d261766dc7b20
SHA1 6c087af82ac54912f00a1066d065e033a0fb2989
SHA512 3adf0de5dad0a946f23922c0295b4c69b44a9a52e6fa88c1abb7bb4e19695a904f277c06879eb202450eb697d16e3a9c2d88f6f209f1d511cd764ee578d63152
TLSH
T1C6D04C033376503D83FA954C627666E87ACC7A40A866B0C4644910D6BE07937245B2C5
MD5 SHA1 SHA512 TLSH

Submit Download

spooferprivate.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\spooferprivate.exe
Size 410KB
SHA256 27adbc79c5baca9f36033358eaae2af44606509d87cff474ddb4ed463d971782
MD5 9787c8434ead30c416d06e74c7048a3f
SHA1 2f11d015e7527de18e7baca945bd35ea73c6991d
SHA512 658962fef9e6aac74fba418f39788948ddb6129e6d8e806c4a6f9bcc08e0f6a076b59b507c9a88724697b1d8854198b282b4e230cda5ab315777e390374d714e
SSDEEP 12288:wcqO1tyJXsCRcWakMlZ/mhzDVTjwYiynqDvY:w0yNOqclmPLiynO
TLSH
T125949086F1A885FCC02BA2789697660FEF39381C13204AD773D4D5A83BD36F166B9711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download