c4aa2960fed37d78d1eb659f48b51ccf3870bb9428ce9a968c4ad0d3c546c6fc

Analysis

user interaction
yes
max time kernel
143s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 155KB
Sample260420-jspx5agw21
SHA256 c4aa2960fed37d78d1eb659f48b51ccf3870bb9428ce9a968c4ad0d3c546c6fc
MD5 f08905d0b046661f4c5919fd4cc63e19
SHA1 a280a9371fc8164dadafef9d185997de140d89f5
SHA512 5d127ae7636e32ba50720fdeef88e9c2dcaedf1187f09bd86477ca756afd87df61cda4dd07e8d0b2230c32c063140c2220e8e853990a7c6fe06e30c84dfaef43
SSDEEP 768:Txp1LMnV0nIH2iEldw0wgQL81faP086biJH5SJSJ5GSR/HwWaWK/H7znEwGjiaic:xMbfYUaWoLZKxJ5eKjCpGSwPvNV
TLSH
T152F3953992D0026A50F3C692CA907F6DEE899307D787D5CCF6EC52975FB7C84AA03264
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1316_1475952968\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5028	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211453808741238"	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{DB47D317-FF08-48A3-B8F1-2E8C406F866C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.apk	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.apk\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\edit\command	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CapCut_Pro_v16.6.5.apk:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4088	Winword.exe
4088	Winword.exe
3156	Winword.exe
3156	Winword.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
3440	OpenWith.exe
4380	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
2524	OpenWith.exe
4088	Winword.exe
4088	Winword.exe
4088	Winword.exe
4088	Winword.exe
4088	Winword.exe
4088	Winword.exe
4088	Winword.exe
3156	Winword.exe
3156	Winword.exe
3156	Winword.exe
3156	Winword.exe
3156	Winword.exe
3156	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 3368	1316	msedge.exe	80
PID 1316 wrote to memory of 5028	1316	msedge.exe	81
PID 1316 wrote to memory of 2572	1316	msedge.exe	82
PID 1316 wrote to memory of 2572	1316	msedge.exe	82
PID 1316 wrote to memory of 2572	1316	msedge.exe	82
PID 1316 wrote to memory of 5044	1316	msedge.exe	83
PID 1316 wrote to memory of 5044	1316	msedge.exe	83
PID 1316 wrote to memory of 1596	1316	msedge.exe	84
PID 1316 wrote to memory of 1596	1316	msedge.exe	84
PID 1316 wrote to memory of 1596	1316	msedge.exe	84
PID 1316 wrote to memory of 3648	1316	msedge.exe	85
PID 1316 wrote to memory of 3648	1316	msedge.exe	85
PID 1316 wrote to memory of 3648	1316	msedge.exe	85
PID 1316 wrote to memory of 2380	1316	msedge.exe	87
PID 1316 wrote to memory of 2728	1316	msedge.exe	88
PID 1316 wrote to memory of 3996	1316	msedge.exe	89
PID 1316 wrote to memory of 2380	1316	msedge.exe	87
PID 1316 wrote to memory of 2380	1316	msedge.exe	87
PID 1316 wrote to memory of 2592	1316	msedge.exe	90
PID 1316 wrote to memory of 2728	1316	msedge.exe	88
PID 1316 wrote to memory of 2728	1316	msedge.exe	88
PID 1316 wrote to memory of 3996	1316	msedge.exe	89
PID 1316 wrote to memory of 3996	1316	msedge.exe	89
PID 1316 wrote to memory of 2592	1316	msedge.exe	90
PID 1316 wrote to memory of 2592	1316	msedge.exe	90
PID 1316 wrote to memory of 1432	1316	msedge.exe	92
PID 1316 wrote to memory of 1432	1316	msedge.exe	92
PID 1316 wrote to memory of 2084	1316	msedge.exe	105
PID 1316 wrote to memory of 2084	1316	msedge.exe	105
PID 1316 wrote to memory of 1620	1316	msedge.exe	95
PID 1316 wrote to memory of 4324	1316	msedge.exe	96
PID 1316 wrote to memory of 1620	1316	msedge.exe	95
PID 1316 wrote to memory of 4324	1316	msedge.exe	96
PID 1316 wrote to memory of 4440	1316	msedge.exe	98
PID 1316 wrote to memory of 3136	1316	msedge.exe	99
PID 3136 wrote to memory of 4560	3136	msedge.exe	100
PID 1316 wrote to memory of 1548	1316	msedge.exe	101
PID 1316 wrote to memory of 1548	1316	msedge.exe	101
PID 1316 wrote to memory of 4460	1316	msedge.exe	102
PID 1316 wrote to memory of 4460	1316	msedge.exe	102
PID 1316 wrote to memory of 2372	1316	msedge.exe	103
PID 1316 wrote to memory of 4520	1316	msedge.exe	104
PID 1316 wrote to memory of 2372	1316	msedge.exe	103
PID 1316 wrote to memory of 4520	1316	msedge.exe	104
PID 1316 wrote to memory of 2084	1316	msedge.exe	105
PID 1316 wrote to memory of 2084	1316	msedge.exe	105
PID 1316 wrote to memory of 1040	1316	msedge.exe	106
PID 1316 wrote to memory of 1040	1316	msedge.exe	106
PID 1316 wrote to memory of 1040	1316	msedge.exe	106
PID 1316 wrote to memory of 4904	1316	msedge.exe	107
PID 1316 wrote to memory of 4904	1316	msedge.exe	107
PID 1316 wrote to memory of 4904	1316	msedge.exe	107
PID 1316 wrote to memory of 1984	1316	msedge.exe	108
PID 1316 wrote to memory of 1984	1316	msedge.exe	108
PID 1316 wrote to memory of 1984	1316	msedge.exe	108
PID 1316 wrote to memory of 3812	1316	msedge.exe	109
PID 1316 wrote to memory of 1844	1316	msedge.exe	110
PID 1316 wrote to memory of 3200	1316	msedge.exe	111
PID 1316 wrote to memory of 4364	1316	msedge.exe	112
PID 1316 wrote to memory of 4364	1316	msedge.exe	112
PID 1316 wrote to memory of 4364	1316	msedge.exe	112
PID 1316 wrote to memory of 2128	1316	msedge.exe	113
PID 1316 wrote to memory of 2128	1316	msedge.exe	113
PID 1316 wrote to memory of 3900	1316	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b8,0x7ffcc824c188,0x7ffcc824c194,0x7ffcc824c1a0
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,11296978409120498903,5144500887115537344,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,2829043198327587526,13151206338154417236,262144 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,12652237078221202864,13523616619882185670,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,10638989745597254124,7060836928370340347,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,5300413078812725168,10315536302525945853,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,13103874080435353685,4772859265352993676,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,11738179913228785956,12146462077856716244,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4216,i,16355388688018284363,16577575021805368433,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4224,i,5480713921705262935,744748220994281118,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:9
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,6902849209888573451,281783909873519130,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,6113905554199872812,9468028317526622668,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,18133641992708122986,4597392853516257409,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,3597846371786618734,451113921083309265,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,14201305431446155106,16110605899930820346,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,14201305431446155106,16110605899930820346,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,6282796054899343362,8747126495354175440,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,2880647379963972906,540574458689423404,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10229459305165103293,6010190978727468036,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,14788009529300840920,14091863583736612606,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,18279821306547350555,6454094154812131631,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,4589174451311921564,5486221292507695664,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6908,i,3099208049760168598,17699398779280627759,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7088,i,4043900927055396786,15350937341952260844,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5040,i,4612610211986409700,2024350613491696326,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,10822377513615422033,423018478884263378,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,10774566746356163038,8716645034646749968,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11657655763022355433,7167503213523811551,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6172,i,5609927279306885606,17279633709304038359,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,6907825358285581533,818723909760339827,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4960,i,4151888788310444273,14445746778936003784,2097152 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,9604089752955451966,15282035265067542744,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,6441105933552831723,4440159124188537507,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  - NTFS ADS
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,5157342557960045532,2444168790618882332,524288 --field-trial-handle=2336,i,10242759366538959517,11343085202900729311,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:14
  2⤵
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\CapCut_Pro_v16.6.5.apk"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4088

C:\Program Files\Microsoft Office\root\Office16\Winword.exe
"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Desktop\CapCut_Pro_v16.6.5.apk"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 43aa26974d1aa58a04ea3ba6faa2b5be27deaa117c9a01d9c43780e294dca893
MD5 3b1902bfb439a6c6e3bdf499822f485e
SHA1 221970a739f5ee14b9f0251d744104562bdf42d1
SHA512 dd142ced7d89d59232a656a5f0bf23bd992e39d35b10eb09cfc2ccecfa1cbb63e47c70b7eaec0067c8ba304d36b5259212bfcdc376f9589958036aad008f85de
TLSH
T12EF0D4A391CDF02238A551EC16FDD6B3142090A80891372AF0A4D6A04C4AFFDE56A63D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 8a69e7a42b28ede7a99a2dc34feb4225e5b3e960063dfd4a91798275ee350ca7
MD5 d0d3a16a3106a9c3be0f0cbc82ef138f
SHA1 b4717cb342a860d3a9be48405a07435359d3fa51
SHA512 57ad23d1e06d1ed01317d494cbec4d3ece1654c7623a40b5e4ce12779c15c6d7f26a4fc45a918d592d89183f7e5ea0c5c1465b2b93bb5c12fd3895b76a1adc46
TLSH
T1FDE0C02017FA421EF1F1D6790AD4F9B485DAF0612060E1F656D43B057642A00DC11E31
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8648dbe7c6ccfd26bf551adf1fc6e3265815ce5ea5942267fdb3d8494e49ccaf
MD5 0d69a24f0c5199062814f3276a0e0425
SHA1 1689f8b116072314ed6419bdbf045ff11d1d2f1c
SHA512 1609905f1cd06a7538f4d74fe58e56421156a96ae16f40de19041369554941dd25cf283bb0eab1972345de9fc7fa8406d01b16d3ec09b21fe116537aaa21605f
TLSH
T1CDD0A73076D5F009C3751137865191602B5E844225D34090B255815DD45C6BD6BD9686
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 29KB
SHA256 521f1aa84dacf998911e1874ece5d240f4d2cbd71fb7d6eb3ef9b805b2a91aee
MD5 506765c5708d241a89dfe7b139731e42
SHA1 150e865914568a0f2deca646fb2670b210435563
SHA512 04d0a03bda24792c584be4c87fc35c5877f832356335cb399448ecb6a5171daaee2f5c6d2f3ca41fab87f4d41831aa3dd843bdfdbe6d4eb39db6bc58541aae7b
SSDEEP 768:dF7gRXy0duCQup2NvVlLVDk7JVGwpDbse44S:7gRXjuUyVs/tpHse44S
TLSH
T104D2F1525B6F909528CC8FC584D04A5460A8C361EF2FDB5BCABBF95CCF6CF056A2642C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 18KB
SHA256 98c59861138f9df1d82e58bc9b7ed58e9eb795b4bb6fe267dbc5ff3c9eb3140b
MD5 e714ed8f8b63815a68a4c8b356f71794
SHA1 727ef37b2840b273e233dcc548b77d2352f93ff3
SHA512 0141e1098ffb37656d6c17c2b453ca6981583aa00ff88bc528df2319ce8321d0839a59d981d4de9ef042d10b6eb63eb0e3cb3a0273f7b7b8f26012901f290c8d
SSDEEP 384:/pU4Rw/v1KbG/cGUorw07nNM5HQnhvCxsQWMyEyb9Ds:/avQ3ocgn7vD1MyEyZw
TLSH
T11382E1D11683718BDF08F0B8483DA8C7BB3129C5ED0E57C5A283636AA7556711D434AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 94KB
SHA256 e7d77b1ebc21cd896c3f3f4172b167ed0ee09c16a83f3d3e0d22fa28020caa76
MD5 ef4666e98af7abc420aa0e850e20a4e8
SHA1 538a976b5217a0441a951c4db70daa206f387c1c
SHA512 6223f143a53f343d1cc5022b7f4dbefbf9460e9b9680de43244c21e0b069e7a9bccb724aacfb07cb4f0aaf18746a76c25eff103508eac64878ffa7333a5a2a2b
SSDEEP 1536:mywTIroRoN05QoPU1NWnDTnpoCjPEcLq+jcXn3D3TEZ+AMY/Wfm+/c17Bwkl5ZI9:m1IH0xPQCjP9Lq+jmS+AMY/rNeklM9
TLSH
T10B93021FC386100AF55E70B4F25B645C86359B4BCD05BA7EAA72EAD40BD1881CDCEB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d1f240393fb5452f9d1b3ca621a5e52d919d572414bce0160f8f181733bcc30
MD5 b88bcd0a3aad6f2130c69f1e3a91e66b
SHA1 0bb7a87f47b2eb97da783880b248fb75f137d19d
SHA512 39d08cb5f54d4cdf1e9eb8aaf1c42f39e73ac5ac2f3dd9ac79364fbc9ae27439fa37d46026fa420db4f9b8499b0483e14978c073f1d8aae24b774c85e2716893
TLSH
T1F871EA836283F6DAFBE6CCB86ECD24797670D6F9003B0E1711E4903E7AADB535884560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 848cf4952481c0aa2e12a041f1befdc262679b671e628601f841e1994be4e703
MD5 7d5c9d6dee5c5eda1d5e671604bce6e2
SHA1 4e4819be1e77c52b0e9fa14fa4c455df210a63f9
SHA512 298fc247d1e8bfdcb4239e832ea01efa7c27a9f469e8d5b33c1ce6734ddf47924f01ba997e20a6b90d562fd723bf5bd079751b7399c4cecfaea558c0e574518a
TLSH
T19181FA836163F6D9EBDACCB86DCD24757670C6F8003B0E1711E4953E7A9DB13A485560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5893cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5893cf.TMP
Size 3KB
SHA256 641c0a26af534795c89fe941ceed53e69ec67a21fe13aa2fb2d547ed506cf461
MD5 2f8978e79cfe2acd814180f0715f6e47
SHA1 f40a5346c073711e35d4d63b5754564a1b4d8bc9
SHA512 194f7ba168338671f908c6095e5061663c310a9599f3f4eead2f56d76ea336d55c66ddb092ea89fcb240c220418d636c9ee7ee4f457be831520f823e2631f81c
TLSH
T199612C835283F5DEEBE6CCB86EDD2479B270D6F9003B0E2716D4943FAA9DB135184550
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 830d060b4165a771c414f1b2bf0e372c2a80734e5c16169c1ed735285f617b4a
MD5 89a8cd44641a9c145adb33ad77f8a73c
SHA1 a1fa972528a9923152651142b7b6d28d928f5834
SHA512 6f0029703406c1e0c55b425ea266a0f9e81b7df771ca5695c623c7bd31331ba3d9b44fb8218aa07c2095de2ed667b420adcc6c7f9110d6183a128ff3ad7e3f60
SSDEEP 3:MsEllllkEthXllkl2zEkee:/M/xT02z
TLSH
T1F7440444FFC05D47CD4455305015C3700774D4100515D74334F1D4137FC75C10C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 ae18167e441e7aaf9240221719c504ef51c44ff8533b47b2eac558c71e88dd4f
MD5 d92d48ae6ebfadfbb26ece1e1d84ce79
SHA1 2320dda7e9a0378a62938ebb863ada47b31ca945
SHA512 9426ce9431a18d81d2823776eb25d6b893bf2aed29cf9b8dd4211b903492e9c700c6d9b95d9d729f964e5161aca6e5ea5ca42ed4c3041a1e35bd4f19fd1b5dc3
SSDEEP 384:DuxKubKutgF4PpRpVCt7nzeaZ/mRZ6+jJkGA5OJvjfjG6HGPRZyqna4PVYitYiid:33EbJbwGr2U
TLSH
T1CC429BF3C2D8C62EC81256F1AB146E1BCE1D0A59433C3C1AC9D5EE8BA3E2472E15565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 4261469beab8685d22740e5e16243f5f7a4747e1909a7a5db34afa1ae007ba18
MD5 ac05fde8d1d51e5584da6d845ef0e65d
SHA1 7d77660cafc2e17790aba3ad8fa94308b902767d
SHA512 9499451dba33a8baad7aa170fb5f23766dbd164caca77900bb8828fa7587f1512e57877853c44cc906f87ea4b3cd2cede09159bbacbf3cc77550a1e1cf9e63a1
SSDEEP 384:DuxKubKutgF4PpRpVCt7nzgzCaZ/mRZ6+6kG2OJvjfjG6HGPRZyqna4PVYitYiwq:3WEwBbwGSMq
TLSH
T16C529BF3C2D8C62EC81256F19B246E1BCE1D0A5943383C1AC9D5EE8BA3E3472E15565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8e5bde8af724e370d8d4b0d82e3869295c667705c36a8da60a88db3ee3f9af62
MD5 5d5efa354e9c7f802bd4a35c1175b42d
SHA1 704ec33b04247beaf705c1eacfd2c0fc646064da
SHA512 4ea09c6ffebc15e4384d726a78d81b9ff2e18b051a0352d567d1c41b72ba32ace115cff6032f29a72063dca6b0056f7494dbb4c44217ad3bb96f7d0146a0b885
SSDEEP 192:sxZEoRSyM//K1Ml8Mog/fLsYqGftQmIdpEQpD/W6+WNm3k/Dh/HaSVI05g56t+sk:sxZEo0Qg/fLsYqGKHV/bh/pV3qidq4W
TLSH
T1DA72D55BBA34597BCCCBD619F541BB67D6F544A792900E84AEFCCA0C00E6BED610381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 2b69c7064cf743d1ac311f7d0f7b0799b66e315f9d563156ec73e844294cb91c
MD5 dfe7f3b7a3c263f10b75d33f3051aaf0
SHA1 611dfd65236249a588c2cd022a1d40e5f9437c52
SHA512 1d3456501a0b87f29d98906230ba15e3e6451b98b22a1b591e91c3760a4bfc49747e6d487fbbbfe204601ec8513514c85450cd68df92e96e5e180e371ec4bc30
SSDEEP 384:sxZEo0Ug/fLsqWvoqGNHV/bR/pV3qHYc4W:sjTg/flYoRL/blptqHEW
TLSH
T1B482D45BB57449BBCCDBD619F551BB67D6F9046792904E80AEFCCA0C00E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c22d3ad140424e37d2316fadb165894e60d02e5214a53b06a44a3f67aa1f13f4
MD5 b70d08fbb6023bf65e361bfb95d4bada
SHA1 e81737115ae4b733e8e47f1b00d14dc29d7eb82f
SHA512 8fe4c0275d80ac75b75b1b2af7149bc7f1d3683fcb63ef44e350e10bf32d5b014acc54678e69a191f70df4e5f384da21f36863319168b56bf5b4fbe42de90a47
SSDEEP 192:sxZjRSyM//K1Ml8MFg/fLsLqHftFmIdpyQ0/W6+WNGeqH95G0X4kctfIgU2J:sxZj0dg/fLsLqHzHG/bGt12dUC
TLSH
T17B62E916AA345977CCCBD319BA55BF53D6F9456392940E44AEFCCA0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c5effbc80dd42f9e80021e1acc59fb1ec8a72353070947e2766c6d3afd69640f
MD5 ea2044990271ce710ff66803f986f807
SHA1 2b661f98ef152e7ec86aaa35c920f888189fe062
SHA512 529d6804e439300660b4ae87f01f7d0cd4d99f251ef19a24a35c9c088a9a34e561afdc3152d02106e983b562c7ebcc811e12bd3ace205a84c885b22cee79f243
SSDEEP 192:sxZEoRSyM//K1Ml8MFg/fLsYqHftumIdpyQu/W6+WNGe/Hg5/0X4kctfIg5QLuaJ:sxZEo0dg/fLsYqH0HI/bGzi2dqCW
TLSH
T10762D916AA345977CCDBD319B645BF53D6F9546392940E44AEFCCA0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f5ff2547553cd6ca78ac278409c41acf5bb384fb387bf83e967329054bdb2c5e
MD5 d9e805828e9aca45bb62172f743f6c76
SHA1 e7a8c268c1c7d297990c99ce008da4726bca2d17
SHA512 6f6fae2d418b69941ff3601c3a3c20eae7aca82328b36f6481585d0308f5ffc54da1412871e78fca031fcd8c0d508a17324290a7a22a0495442a0fa38843bade
SSDEEP 768:f+TTF8J52YO7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3bumfLlk:f+TTF8J52YOEnYwWRmY4QPUu1jaKbumu
TLSH
T1CF030C3B280CCB7E4F844E9CEC26BF9A6DE801CB9698C99447FA444C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d87f65d3fdb35dc829f540284dfee880d03f03ed5ea5f47db475178a3df8faa0
MD5 d91f5e6ad1f4123fb9a3448c1da558dc
SHA1 869d6cdc2735def759032efc0ff30ce905f9bcce
SHA512 1b5caa5f4978d311c459c8cd079f1e7b7113a65268d85facec4890f871c969fd01b6b40c00d3853361593bae2aa50497a6af8e04b89fc11bec75edbe49386063
SSDEEP 96:KwzeKc4m+naKMgymZ+Kqwh8gK1em2JKKCEo:YFNRdJPhV
TLSH
T16FE15580B03603803ABD6A8A91D5B47F53C270637518A43B7BF951AA0F66F55CCFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

47aeb834-8fa5-4732-bd0b-18c867cdf3ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\47aeb834-8fa5-4732-bd0b-18c867cdf3ed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c43f1b04c3993e38bcbeed8807aa788229873b9bfa399a8d353c1efd0f8841f5
MD5 5264623819ec0f6fe845c773d458f233
SHA1 71fab934790e459ef9de637cae1c30405d4e609b
SHA512 25043420e95b935072d721a4824f68a669ec22a4f268806e137a91eca332d20a0461f7e3977f5b90ced587aef664cf3567b86bc54831de3e5d269b0a90a6d74e
SSDEEP 384:n9jccCs+Bt0S3v8NKY/20lB6Y9nkc/T+AS+6SgVLkf3x:9ccQPuN39kc/nn61Vsx
TLSH
T173826D7568B82CB79BF7AD05F49B37135FB420AB97852E54DDD98B1C04CB2AC0307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d410413ba4c3723f5d15985cfb904ce75c25824646a0ccd4b36aa529c038d94a
MD5 86ef35d047b26033a6ec13b959c49456
SHA1 fefe7bf04f4b0f066c9734e529cef6b707a96266
SHA512 1e66843ad5416df536740b25ad36f8d84b62b33cbb7a3f4dfc7eeabb625aa69a9624051075d4a62777111a8e4b73e78237fdf7ea019ccc02121c4dc738e3cf68
SSDEEP 384:ndiFJjccCs+Bt0S3/8NS8TUNTUlIld/20lD609o2jDfcac/T+fS+6SgVLkf3x:UFJccQfDwg7NH9oPac/qn61Vsx
TLSH
T1DBD293F594E79976E9AE4B83A77E7E429EBCC09775841980BB854E0CCC871BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8096d1e0655e7e14e459fe764c3c38dfaa1a10356f79569818e3e545d15e77d3
MD5 706e7851343fe7fe2e54ece8af0e49c1
SHA1 f698593bd6f7396fc00fd23ce735c4517204dc88
SHA512 da394faeaa74d6b9638874c0c670ab65502c0ad5bda0e43234e227dd9aea3b0ac99beb841bd5997518d68e86291570ea9be09760fd7fec13e2f093d9306754da
SSDEEP 384:nijccCs+Bt0S3Y8NKd/20lD6U9o2kc/T+AS+6SgVLkf3x:MccQ4vNJ9odc/nn61Vsx
TLSH
T153827C7568B82CBB9AF7AD05F49B37135FB420AB97842E54DDD98F1C04CB2AC0307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f3eb0f0c70a83e228d63cc3c39eb385428a5bf6ecec24f90b5709d3515753d00
MD5 a3c1a72d6c6657a35d0cd892b10b049f
SHA1 4f514e8d1df19567e837f2d7cc0c3cf051bc5f6c
SHA512 103fda7cc7fc428a826d075a5eb9f91db0607baa5a6a366b722deb8138ff5f34a06a2927aa8318e4b78c7f92ac5299df42d7aa8daffc22de35dbd823501590e9
SSDEEP 384:ndiF1jccCs+Bt0S378Ny8TUNTUlIl5/20lmrYo2jDftac/T+f3/7tdIm9/kbV16c:UFlccQbHwgrNlo6ac/sDtGm9uf61Vsx
TLSH
T166F270F998E3893ED4AE6B47633D2E1649BCC177B5A45894FB840B0CCC661BFE706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 589b5f49b08e5ee0e225838b521f758480bba7f90d68e0be17f99f78aaf16d86
MD5 faf47511ef4d0bafba3d5c67ee4da691
SHA1 6a6ee6734bf5785929c14497504b0d8c3a14b1e9
SHA512 b38ef28660e04b3fab194ae7b9c2bc00329042fefdd3825234ff16aed2c8876c455bc34fcef8a6a5513e5dbab6001bf6969a6b3b6ea83434245f5b3ed5690dbf
SSDEEP 384:n9jccCs+Bt0S3Y8NKY/20lD6U9o2kc/T+AS+6SgVLkf3x:9ccQ4uNJ9odc/nn61Vsx
TLSH
T125826C7568B82CBB9AF7AD05F49B37135FB420AB97842E54DDD98F1C05CB2AC0307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f482a071d831b6c8a2fc52ba9579045eb28738908703ce9ec53bc3d977db711b
MD5 9131ee01fd9425cdac1abb9ebe1e8666
SHA1 72858aedaf9fa071f6f835956f1d184a59222a6c
SHA512 1b26076588f861354a3c76dc00fa0feee99482ccd1d01c10df53b409844dace45e18bc0f131ada232fe5d05a07da7d4bae8f8ed07772c19125f5fd2357c4cc03
SSDEEP 192:lGNq6IMGEQmiUyglTM6xc/T6m7Sep7dVU6:lGNq6GUnl46xc/TJPU6
TLSH
T1DA020A3578783CBB9EE3AE45B48737235F94116BE6952F88CAD81B1D00DB39C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 98b6e93a6bb94606a1ceef48453559f9f245e9902f9f704c03078f7c8abcd8a3
MD5 a5e0566c71b5a21dc1505e335956fee1
SHA1 c2d3bb6296e024df1f8d04c7f9de6990d2bacd02
SHA512 e22c06e4847d3c1952a7e66f0f4a496ad03867780b1fc1669d90ad8a880456fdc76e0b0fee8d5dcf4226fc25656a211b25fa80c5ab127eed6fa4a959a0947a0a
SSDEEP 384:ndiFXjccCs+Bt0S3M8NZ8TUNTUlIl5/20lX609o2jDfcac/T++S+6SgVLkf3x:UFTccQsawgrNL9oPac/Jn61Vsx
TLSH
T150D293F598E78976E9AE4B83A77E7E469EBCC09775841980BB854D0CCC871BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea3f5d6307e6394965dffc74551d33a697267dba7607c3140009de23176cbd33
MD5 d1a372c0a2d2361cf237846eb5955c5a
SHA1 5a4a4ee1faa484a05ed8ebec84f1bfedfd82a41d
SHA512 0782150b514728d810968871d10f8c19b99934e0bbf5fa103d0b06fbcc709ead69d0abecbc8f6724cf0b7abf4312e29f093985588954b32efd9678e26ba76005
SSDEEP 192:5GNT6IMGPQmiUygEMVxc/T6mWYGS66Bq5lb+U6:5GNT6GRnfVxc/T+0S+U6
TLSH
T14012E775B8B87C7B9EE2AD51B48737235F94216BDAC92F94CAD81A1C04CB39C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ac1c93a53d0ee431f72c9ba714a4dba8f790f8fb6a28eb78298b427f6ce28ccc
MD5 a40830f795d78f67729b53361a086c2e
SHA1 97f9a4df2722269d0adc9e5475f5d7e049a025b9
SHA512 42d55e1fc80aeca468a188c2aabc8432a5ce39a7fc836d42faa461a772b5b72e6303d00f9d6f294b9aa8210fdc021952b99c0ff6e05f9f4f85dfe35c53d9843d
TLSH
T152E00213E7040077C01C433000C71B143FB1C01103D3031B552002BC3C613842C34EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f39f3c5837d46a3693544db7bbc00a1374b09e20a4bd2f3f7a85bf67b6899aa1
MD5 6df66e2e53d8d37b98c58ce8807f90ad
SHA1 5bf157785ee5942add49f0fc8e059a319540fc9e
SHA512 8b2ca845ac3c7ad414c3533b36f02f72731dec73824dced04ef2e732841097f76e5ddfc3fd24b0021a5c94c326038550a90eb2a3133a7685eba342c11334e506
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe585752.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe585752.TMP
Size 392B
SHA256 7a887a68e1d9079761d926f0d9c213220a923f0e9280548093bbb36aeef27ea6
MD5 96373be73ec2d1de61b93b4505d223ba
SHA1 9e47d43ed1d2f0c3619dd581affc6cb07c158f29
SHA512 902a90a455293d371fc00b71ef52c7d382b1d1b666ec67c4ed658b88c202705a87a9678e0d2008daf08ffb07f509f68699e8c411cf8a83444f4dc5f89088785f
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

cca4e42e-bb6d-48ce-9346-5313a1de69a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cca4e42e-bb6d-48ce-9346-5313a1de69a0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Word.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Word.GovernedChannelStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json
Size 417B
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
TLSH
T1B1E03758D5B8D45DE94325026BB173960D329691F9DAE03C2D3DC00EB5DC2BF4A1C20F
MD5 SHA1 SHA512 TLSH

Submit Download

Word.Settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json
Size 87B
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
TLSH
T10FB01206089401BD405D500084445A5B035470510144241853046206107E9E20368C33
MD5 SHA1 SHA512 TLSH

Submit Download

Word.SurveyEventActivityStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

FCCE0582-1624-4C18-8F03-C366083BC3A4

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FCCE0582-1624-4C18-8F03-C366083BC3A4
Size 187KB
SHA256 7e23ffee2a7c99981d15c9f4207fc20dd3b0b58a9b736705a647bb09f9c933b3
MD5 3f7902077dc7808abe11589627c5cdd1
SHA1 3d1c3ff288e39be0f6311da6783b08e826e3f2c4
SHA512 09a3b2adedde4089e550e9cb25fc8abc9ef0d3a2220b47403fb68df922dd4de491cebfb5e018279ab0818f9d629c87fe4f917f52236833fbca6996edc5f1687a
SSDEEP 1536:vrVe3b3yFK13SllbQ4sghEz1e7HW6Dkjj/mtXcAZl1p5ihs7VXXbEKD0aO7na3Y1:nue7HW6Dkjj/8Xo57ai
TLSH
T1451402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
Size 80KB
SHA256 f41d74f1c6630dce776a7c9bd88cfbb1555840762b834efd8d339fdb0a0dcbb3
MD5 08a34651201e65d0443bb29d93ea54be
SHA1 56e64660da00ffb98d7058cfeda732879af022f2
SHA512 837bcfaaa42ca825a4e0cb330f170eb220ec85441b5424ea1413a5571e19bf3bf885644d9a809d38c465d10f14383fbc1e1296a49b905e36486025ccdea718d4
SSDEEP 1536:NO6DOzyhDRMfutowvi0toT0kvhhLUvpUrYLGNj1+DAwr:7nDwC
TLSH
T11483849F5B9020F9EFC2837C5B9F4B5935F895D29E9A048861D60C037658A73B3E30E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22da8344-2d16-4083-a632-f6e8ded78f8d.tmp

Path C:\Users\Admin\AppData\Local\Temp\22da8344-2d16-4083-a632-f6e8ded78f8d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e67e4c5f-1515-4f64-87bb-3282ab0966d5.tmp

Path C:\Users\Admin\AppData\Local\Temp\e67e4c5f-1515-4f64-87bb-3282ab0966d5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd8cb1fe-5cbb-41db-a85e-9be84a3acec9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1316_1955583548\cd8cb1fe-5cbb-41db-a85e-9be84a3acec9.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1316_295626746\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CapCut_Pro_v16.6.5.apk:Zone.Identifier

Path C:\Users\Admin\Downloads\CapCut_Pro_v16.6.5.apk:Zone.Identifier
Size 321B
SHA256 3b37191d094f1c3fcaa4d40a1685cfd26fbc1b78df8addcd719e9d0c97c0592f
MD5 a11ea11b4e67e469f041a9272ae78236
SHA1 c3c8787b37b4534d1b8b74367c3856f889c4c678
SHA512 d0c8a696451685eb2ab2f34d6eae311f00380f9ecb6349188fa321ac318555e21474b65879fd714595326f6aae010d1053976627a32dfe99e99c1f215c202d69
TLSH
T1C1E07D639888954D72A972F4947B9F6CF18F54D60A1DC0C9B81054C376454297684941
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1316_1475952968\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/2524-848-0x000001EE152A0000-0x000001EE1543A000-memory.dmp

Download

memory/2524-859-0x000001EE152A0000-0x000001EE1543A000-memory.dmp

Download

memory/3156-1015-0x0000024E90960000-0x0000024E90970000-memory.dmp

Download

memory/3156-1021-0x0000024E909A0000-0x0000024E909B0000-memory.dmp

Download

memory/3156-1019-0x00007FFCA4CA0000-0x00007FFCA4CB0000-memory.dmp

Download

memory/3156-1022-0x00007FFCA4CA0000-0x00007FFCA4CB0000-memory.dmp

Download

memory/3156-1016-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/3156-1018-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/3156-1014-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/3156-1013-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/3156-1037-0x0000024EDB5D0000-0x0000024EDB5D9000-memory.dmp

Download

memory/3156-1036-0x0000024ED0970000-0x0000024ED0B0A000-memory.dmp

Download

memory/3156-1012-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/3440-825-0x0000024CB62B0000-0x0000024CB644A000-memory.dmp

Download

memory/4088-851-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-898-0x000001941E510000-0x000001941E6AA000-memory.dmp

Download

memory/4088-907-0x000001941E510000-0x000001941E6AA000-memory.dmp

Download

memory/4088-908-0x0000019429260000-0x0000019429269000-memory.dmp

Download

memory/4088-906-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-903-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-905-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-904-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-899-0x0000019429260000-0x0000019429269000-memory.dmp

Download

memory/4088-853-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-857-0x00000193DE540000-0x00000193DE550000-memory.dmp

Download

memory/4088-858-0x00007FFCA4CA0000-0x00007FFCA4CB0000-memory.dmp

Download

memory/4088-856-0x00007FFCA4CA0000-0x00007FFCA4CB0000-memory.dmp

Download

memory/4088-852-0x00000193DE500000-0x00000193DE510000-memory.dmp

Download

memory/4088-849-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-850-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4088-855-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/4380-824-0x0000026AA6550000-0x0000026AA66EA000-memory.dmp

Download

memory/4440-622-0x000001EDB0160000-0x000001EDB02FA000-memory.dmp

Download

memory/4560-144-0x00000185C9B80000-0x00000185C9B89000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads