hxxps://archive[.]org/details/3-dasm

Analysis

user interaction
yes
max time kernel
84s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/3-dasm
Sample260422-2ebgpads3x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3468_234904714\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213705748444433"	msedge.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{98F43574-5C0E-4068-AA33-71F4E7C00EC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3716	3468	msedge.exe	83
PID 3468 wrote to memory of 1288	3468	msedge.exe	84
PID 3468 wrote to memory of 3276	3468	msedge.exe	85
PID 3468 wrote to memory of 3276	3468	msedge.exe	85
PID 3468 wrote to memory of 3276	3468	msedge.exe	85
PID 3468 wrote to memory of 4936	3468	msedge.exe	86
PID 3468 wrote to memory of 4936	3468	msedge.exe	86
PID 3468 wrote to memory of 3940	3468	msedge.exe	88
PID 3468 wrote to memory of 3940	3468	msedge.exe	88
PID 3468 wrote to memory of 3944	3468	msedge.exe	89
PID 3468 wrote to memory of 3940	3468	msedge.exe	88
PID 3468 wrote to memory of 3944	3468	msedge.exe	89
PID 3468 wrote to memory of 3944	3468	msedge.exe	89
PID 3468 wrote to memory of 3208	3468	msedge.exe	90
PID 3468 wrote to memory of 1672	3468	msedge.exe	91
PID 3468 wrote to memory of 3208	3468	msedge.exe	90
PID 3468 wrote to memory of 3208	3468	msedge.exe	90
PID 3468 wrote to memory of 1672	3468	msedge.exe	91
PID 3468 wrote to memory of 1672	3468	msedge.exe	91
PID 3468 wrote to memory of 3616	3468	msedge.exe	93
PID 3468 wrote to memory of 3616	3468	msedge.exe	93
PID 3468 wrote to memory of 3772	3468	msedge.exe	95
PID 3468 wrote to memory of 3772	3468	msedge.exe	95
PID 3468 wrote to memory of 1648	3468	msedge.exe	97
PID 3468 wrote to memory of 1736	3468	msedge.exe	98
PID 3468 wrote to memory of 1648	3468	msedge.exe	97
PID 3468 wrote to memory of 1736	3468	msedge.exe	98
PID 3468 wrote to memory of 1448	3468	msedge.exe	101
PID 3468 wrote to memory of 2444	3468	msedge.exe	102
PID 3468 wrote to memory of 2444	3468	msedge.exe	102
PID 3468 wrote to memory of 2664	3468	msedge.exe	103
PID 3468 wrote to memory of 2664	3468	msedge.exe	103
PID 3468 wrote to memory of 4948	3468	msedge.exe	104
PID 3468 wrote to memory of 3808	3468	msedge.exe	105
PID 3468 wrote to memory of 4948	3468	msedge.exe	104
PID 3468 wrote to memory of 3808	3468	msedge.exe	105
PID 3468 wrote to memory of 2944	3468	msedge.exe	106
PID 3468 wrote to memory of 2944	3468	msedge.exe	106
PID 3468 wrote to memory of 2664	3468	msedge.exe	107
PID 3468 wrote to memory of 2664	3468	msedge.exe	107
PID 3468 wrote to memory of 2664	3468	msedge.exe	107
PID 3468 wrote to memory of 4504	3468	msedge.exe	111
PID 3468 wrote to memory of 4504	3468	msedge.exe	111
PID 3468 wrote to memory of 4916	3468	msedge.exe	114
PID 3468 wrote to memory of 4916	3468	msedge.exe	114
PID 3468 wrote to memory of 4916	3468	msedge.exe	114
PID 3468 wrote to memory of 3956	3468	msedge.exe	115
PID 3468 wrote to memory of 3956	3468	msedge.exe	115
PID 3468 wrote to memory of 3956	3468	msedge.exe	115
PID 3468 wrote to memory of 4124	3468	msedge.exe	118
PID 3468 wrote to memory of 4124	3468	msedge.exe	118
PID 3468 wrote to memory of 4956	3468	msedge.exe	119
PID 3468 wrote to memory of 2052	3468	msedge.exe	120
PID 3468 wrote to memory of 2052	3468	msedge.exe	120
PID 3468 wrote to memory of 2052	3468	msedge.exe	120
PID 3468 wrote to memory of 4908	3468	msedge.exe	121
PID 3468 wrote to memory of 2264	3468	msedge.exe	123
PID 3468 wrote to memory of 4892	3468	msedge.exe	124
PID 3468 wrote to memory of 3044	3468	msedge.exe	125
PID 3468 wrote to memory of 3948	3468	msedge.exe	127
PID 3468 wrote to memory of 3948	3468	msedge.exe	127
PID 3468 wrote to memory of 2852	3468	msedge.exe	130
PID 3468 wrote to memory of 2852	3468	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/details/3-dasm
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ff9c675c188,0x7ff9c675c194,0x7ff9c675c1a0
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,7824339135749285579,15499197592847351837,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,1948583197401329122,15899551402448464325,262144 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,13467779467504027152,3149701815426960919,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4057260880796629440,14740676768614954806,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4713036182461281362,5386260361906490564,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,17265799207518948052,13928642220239741687,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,17293008254123779515,6483221741688703521,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,11326003048621048214,14412128142237490044,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,12773206804932717715,11199778053772653474,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,10090568654893960602,7969400208236137207,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7833909734380148028,990807124494832133,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1043047917565415506,16894956778217347935,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1043047917565415506,16894956778217347935,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11473855757344256591,4478654061741225423,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6656157200541123682,6876283476488918020,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14877293721629577289,1688382430355243041,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,12414777534439470635,3149362652490740651,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,18323248259647805688,13994230645204776171,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6476,i,5650055541763855761,9928526513983710924,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,2573329429612937256,10491793758869823709,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6888,i,572126468869877749,5804244336221235318,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7056,i,14640348289266566628,4848111658065381900,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,1315628826759912113,7396447907838752591,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,447742205282855135,5333976667060344249,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7092,i,629717782930957695,6648935778081754352,2097152 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,1799177375913667834,17156431011873186083,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,1576127341332052744,3679235388660931708,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,10502778379324211655,12870135180591619409,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,4285863544102655670,15170927951518160311,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,159900150809678733,13867850297906110208,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,258761111607963622,16082974012655958325,524288 --field-trial-handle=2132,i,14369531382188463189,13082688906773661971,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3468_234904714\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b04489861797cec03fc7404687d31ed4755ebf931038495ba158cbbf77e5994
MD5 8d5497a0d6d631f289ddce3b8713b067
SHA1 e9a86741ddb9ad11d98682073f961e7ab3f714c3
SHA512 509da8d02aa51e8910b1998ff4f2dc501dd78e46a217b34ab4cbd3c8fb5b35e21fc44077baf2fceb5ca1c6a95e4d892ddf87e1a0c25401516589fa338e6d3d4f
TLSH
T14BD02374F796E005C32C00735562D291375A850135938454F45D845DAC683F677D84C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 499f1baf84ccad9aec7e713f14831c28ec8ef6c26551e081f63481da9e10b787
MD5 0b7b7a3907c43b76a43eea92605bfc69
SHA1 b3d127433999df0affab0fc41fa6d73226ec079b
SHA512 67d637e6bb845665c58d6f0a256303841a077e8a03562447569857bb2f980056eb08233e2e8f7e3c0c468adc11695b7c60631f1f3f77f122b5344c0ccc3b2c7c
TLSH
T1D3D0805C9371AC70C7CDC9B1585777453D1AC5629A4247252C732D7D1C4258174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a68569752b554830bdaeb1e8a10446a2bf48a5c40d9055644b0ff7d12eb909e
MD5 619aee87184943036a7fd0a470ee34f3
SHA1 f2e0d05b802871a84b6abab52ce17fbe477f2644
SHA512 618e8ac028bfff63cbfb3dc8165970fe8da37fa98ba9c72a9b4a3b3eb9d922078cf4371b48f699b16e64d0205ac715cb0a1b9fccd6953e5bda90f6d945b76ad1
TLSH
T157D0805C53B1AC70C7CDC9B1585677453D1AC5629A4287252C732D7D0C435C174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 16KB
SHA256 380afccb5139b58682ae393a8bd7b8fd08ed9b4a835243777b4c18267df61375
MD5 d09bf1fd4f1c1b28182e2b8502e87f23
SHA1 66ef186b540f651cd2e55651ec0b3f235e8e6ef5
SHA512 30156515f1c3be6c7b2028865ff1876a84c1dd0f54222e45be54d2502ac0ae260393e1cfc3ff75e80b928440e308329d9b9503355eea220768c8ed67c427b191
SSDEEP 384:JhooSM3IcEhyL+C0pva3kdApw5s4FbASEL8jms8bmq2e:nSSNMpv8kdV5JEhkqR
TLSH
T18572D1F9BA8D95753A0D9A2715F38053DF8022672FDCEDD0767BD063384488874B74A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 28KB
SHA256 acf8759c42025dfc9a1eccef575096cc66449287c1c2733177c5c37ae21ea44e
MD5 a633ffb262ce47f0df9d92f0c459c6c2
SHA1 45daba392d2d6f991a7b63e846a17d3560add78c
SHA512 921a34c7129dcd19039d00b8b00bbd29b85a4a4157952aac1fa753b6f2e7cf2e0dfe1e2ff6b9e24da77610168875e224f78513007edce3c12a5492e05b5ac6a0
SSDEEP 768:HxgsZc/kCuuUc3k+Hhb0FOGuohjWCzVzhV:R/Zc/kDakyQFOHohfVz7
TLSH
T127D2F1CD67DEA817632FE204682417118928BD19AC42F5008DF6DBFE476F25BDC85D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 77KB
SHA256 2af00480f23bce36c709723d323c27540159a3ddab8cadc622e6f72da6b7f406
MD5 243bd6f6863bab3d557ffd5500e0b0d2
SHA1 3b779902dbce2a73bb5dd3f12128771c27003aa4
SHA512 3a6370121c6c96df1f7f1b2ef4fa1e17a28495b5abc7e21c5a1c0120ab02768f435ed0756363eafa38763e7a72e18d988409ded5ac0a975a8d31bbddcb16a82e
SSDEEP 1536:4rWgQCFT78xR044jqIQj/iJ1sIIY8cwJwOkbHuPBu/X3d5SSgaom8:4r5QCKxaLjq/Ki3TJ2S69Fb8
TLSH
T1DD73020EE2E630554A278D0B5F8EC431B612351E51C23CE67F525A74A824FF88E7927A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 19KB
SHA256 a19a63d9409fcd7c8cc2baff3e5c670d03ce8d82cc67ab011ffacfa6ba1de037
MD5 c49113743999cdf1a086b112a52e7e08
SHA1 70b663f5b46684099e6e1a911e6b107301e5d2f5
SHA512 f9e58a69a1aeb377e7a2e633627fdf852f70782f8dfa009cd1412d4b57f6b257e48eac80f05e79cb55c1abdb6ac2767f9838aa5e52d5943be29c83b715607c8c
SSDEEP 384:vnMA9ahBU1lZUyg+iVP9MOffxo1XLcG8whfGxckzOjGnnXKw1SGK0xd+Bv:3AhBWlZYFMOgclwhe+sOj8/Y/0xd+1
TLSH
T16492E038466CF79339770CF14CBD271C4129BA5A0BE3538997ABD46C1D9B3DE81B2019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 55KB
SHA256 9bc047ac8fe630eee479777069537697dffcd514aa7c51c6d0fb8ca5b50cf315
MD5 470490b4870025506e6727895e9e42c7
SHA1 10b6cffa1b834ca5ded32882a20c84debc6e0b3b
SHA512 44526c6d5fed54dd34bb8812cb1c4de741efd39dd1650f399a6eab7ab5976159dcf105e1bf86bee8418ed25f1dfe1a739bff24db9a63ff23a33fe49f34de09e6
SSDEEP 768:iLGGEMIJCvQS2W29Fnw1FFrQt9mTwX/1acqUNFsF1jnd1NKCCfAorQAMd:k2TJ6U9RwlQt1PccqZ/jnzNKCgrQDd
TLSH
T1DB43020C2696836F05DD0880C1E6A375B5CADC2165F29284FA756877ECF9C1BB9F478C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 71KB
SHA256 e7cf10ce16cd074b2ca5a0faeffc34c351bdae3e920c190abbfbe5322fe34716
MD5 d2699aba0f201c635d5961c9bed09a93
SHA1 1547413661ea30c0baddce8105677180af1d06ec
SHA512 0710f4eec3e60a8a717465aae2d8c892d3b80cd65578a1f2b74c8983893c3d1b07e017713c3e34f5fe39cf007372b4f71f9bb9e24b5199a15eab77e562a34c43
SSDEEP 1536:L86f/GPUJDLdzOOprCMWVayfBn4EvNE0i8BK8K5XOIb+uo:L86XGPUlLgOVhyfBnF1o8QLOIb+uo
TLSH
T1AC73125DC5C55F33231D97FB9FC18894762A80D8CB86B10D375EB7052929E8AFA094F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 82e82f8d1f01d41aae5f50bcbc46b5fdc281a857d0758a1618af28b2d08f4049
MD5 83654b4a354b81f2e2265e4de62a04a8
SHA1 9bb6147a04e92cc1f2423245fb2b519993c8072e
SHA512 51b9e994aeb22001fd293855ff0933b5e55f0c231da51878bf72b99274b15fc6a165db620350e682a3b2457553bf255990b99457d371b150db475baf22186c46
SSDEEP 96:bQXtuRSYn+FzAhYqyPIs0KcIg2Jdv6inf+b7KCc3W192v9yWx:bQduMOC8Yqyc0gZif+b7ZgLB
TLSH
T171D1CF20E296E814EFE0F1B214D58AB5F17DDB6600060F367FFD603EA8437967D60AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590277.TMP
Size 3KB
SHA256 08fea503ad896cfd3d5e578efda780b131a41b3bb3e6f8bd5fa011508f71133e
MD5 4172bbff886540df4ef5598256acc6f3
SHA1 81d3555f6d5313f76fa9b5e577b6666f429c2ab4
SHA512 d5de84f0d944f5316e1d276d74682349e357b1a328c5dab1265d74ab98ba3406e1b21dce6dc6ce881b0f16f053ca75d1e859a3e98e64bd5b1c395b05d3733a75
TLSH
T1CF612B24F1528C28E7F1E1B31AD9110472B8CF26014A0F3ABFFD017DA986B137D84CA4
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cec82713b1e2d3dacc3c9eea4e6f3e5169b28a41574ab76e68d0eafeb1bdb5c8
MD5 180a640f239001dca40a3da1446ce00c
SHA1 5f9842186f198ad0e45c3e609b85c27c0fd0fd4e
SHA512 91d2eaa318a6df038570248a7ad2dc01d4f82d11144c96f3791889ec8efc8723f8ce2b2e5182326996121d091261922a2469e1d246e9d7c5fa5428586692f308
SSDEEP 3:MsEllllkEthXllkl2zE/lNWl:/M/xT02zMWl
TLSH
T15D4402446B808407C5001534845187705370D8200612674724A218225C956800C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 1c1ba29a14ad267e9db1e034ca1636684f0f749ca7fe2be2fe775dd0d18c8fd5
MD5 e5028a78a7ce2a7bb3c96b246e7520ac
SHA1 700227926180475ce6ca6c6525ffa1dc3b877c9e
SHA512 d50ddaa0b909e8c6b77336c53a781af0765eb74863161c58dded2bef048d4f8e2ab7574388b49d1725a723e30638db545cbbb9cc7469ed6607cef33ba0688ff7
SSDEEP 192:DM0EDHX1Zadckj6fi75HcyH4GjAgQtx0Z++YtZZWgITejdx2faD7vc1kgZOix1g6:DM0EDHX1ZadckGfi75HcyH4GjAgQtx0N
TLSH
T1D12269FB87B5962DDB1591F4EB086F1F8F1D0521436C386A8AD46E0B93F28B1E101B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 8b87d4df58b59df0c2858bbbeb2fe2f2e852c5681d8db8702836a8e18e280d3c
MD5 6e799f8a4a0ed78bdf23913f2c5c3633
SHA1 e7ff72222211ed6198a188c589cd3b2e228aa343
SHA512 4f70014b6c798d5a82c9367946f50445fed43fe22e4d08881e3523f234f78dc547f75aba6d3766c34e434126b1d81ee8eeafab51424b8bd63049fd0433bcbb4b
SSDEEP 192:DM0EDHX1Zadckj6fi75Hcyr44GjAgQtx0Z++YtZZWgITejdx2faD7vc1kgZOix1A:DM0EDHX1ZadckGfi75Hcyr44GjAgQtxj
TLSH
T1192279FB87B5962DDB1591F4EB086F1F8F1D0521436C386A8AD46E0B93F28B1E101B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e2663361e3d2db7e62f24e559b2fab5449068a5e10f514b751e793103438792
MD5 179379706d76eca14419b1a6f7bf37ea
SHA1 26244659dcab9b940c02f99ab37150a2ea71ec13
SHA512 37cfeefc6b2050b2f4e651532f87ea2c5694b479688403c604e8a16859ee0350a86242426c36f4bbdfac241ccd4546980487d2bf689b45effb06c61698cab056
SSDEEP 192:sxZjRVyM//K1Ml8MWOZ/fPsz2sBbxsPLedpmpQyHW6+WNazIsqq6/YW1lL+Ig4J:sxZjnuOZ/fPsz2sJmSVyHb0fq/mc
TLSH
T1DF62D816AA34597BDCD7D209FA05BB53D6F81423D6944E48A9FCCA0C08E5BED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1faf0ab66e9cf6241b83a7132efcd36db82d7aecd96424fac5b46bd867baaae9
MD5 6cbe963f75963fb2a1be579f6a02195f
SHA1 587cee9638feae393124355d66f3213719a07e45
SHA512 6ccac9fbb73d5f3b86a94a23131830a03150c406db3b4e1a49ff400f040ac9be6da7e09cd5a26223924683bd3bd077d029335657c93ac9d06da7df690e8a84f1
SSDEEP 192:sxZ/QUnuRVyM//K1Ml8M9Z/fPsz2sBbQGPLxddpmpQ88HW6+WNYFyg+zIsdyIhq5:sxZTnun1Z/fPsz2sJJfVBHbQQfpq/ZD
TLSH
T1F172E816A974597BDCD7D219F905BB53D6F81063D6844E48E9FCCA0C04E5BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c64ebf6a5d814b54c58a9b16896d9d947dc7c3e4af5b2afda1f119296c759fcb
MD5 58dd275e2728232e00080fc2a4dabd01
SHA1 5bde9cfbde82c94d843bd5c7127dde21fa634191
SHA512 b499c2a263d0769d804843acd04f9f6b013067037be43bd007da958cd1b8799b01ccd55ea7a033e5001dd9f055889dea1c6854881ac2dc163bb648e7262a81ed
SSDEEP 384:sxZTnunmZ/fPsz5WvtTJmfvBHbCjAtS//H:sbumZ/f25YtTJmxHbC8Sv
TLSH
T19482E716A574497BECE7D219F905BB63D6B81063D6844E48AAFC8E0C04E6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2cf60d5c39892fa91ca378de219d897ec6301fd62f84a0a541bc2a99dfa61fc0
MD5 368d4ca926ea1ab94fd89e466ad028e1
SHA1 f03f0115bd3c4b71ac5cfc05be7f7cd06f87f15a
SHA512 b76fd8ba7d15a4b31fbfa7d1584c01a88a1cdb39be7a85bf41779cda2e0cabeae451df7415558681363511b2aa7a3a79abd1504fed3c3669a303effeb9e15129
SSDEEP 768:WY0G9/d7pLuLnFJWvFnSP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVj83k8LlSMdFOr/:WY0G9/LEnFJWvFnSPu1jaK83k8LcEFF4
TLSH
T1FCF20A3B680CCB7E4F844E9CEC2A7E9A6DE8018B96DC895447FA840C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1984ab13-19e8-485c-bd56-a8d56b72a44e\index-dir\the-real-index
Size 1KB
SHA256 8d6f8e761372362ab220ced467f25e07e0acf9a06f01d14261e24a62ec90a0de
MD5 6ff2a5546bd837a57e1bbdbb34d4bdb1
SHA1 f8c1b5f25460d45b0f5f7c2415284d81f9510556
SHA512 3aca33943207260b82a26d8d3ad9f50731748aa28961b01ca165d194dce0d3a0cff091b79389c00710a8bdc8f42fae8c24181c800913e6e5524733975d14fbac
TLSH
T18B31749DEC825D43D8A580F008BA123D3338CDEF0A08A307592C65795C5F2A129A7358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1984ab13-19e8-485c-bd56-a8d56b72a44e\index-dir\the-real-index
Size 2KB
SHA256 23047bf019ecf4d4588d87a4fef0a47860f102559551e15bc5b87a3cc7430399
MD5 836ac2ac965236e48ba0540c9191ba5c
SHA1 958e769c200b95c966e261321385fc4658c774d8
SHA512 48ac21287b7b14bd725665204de671502c416ab9038d7445d3632a84c9fef72060100722dba8d681fc6eedf6ac51c19938be210b8824505d15f2f4458008e8bd
TLSH
T1B251E68D9C0A5F61E87910B20D76249633B048CDAFE80B7BECDC89B0609726A1F6B711
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587088.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1984ab13-19e8-485c-bd56-a8d56b72a44e\index-dir\the-real-index~RFe587088.TMP
Size 1KB
SHA256 1b07faeb6a2f99e2f79f2a22336e281531ca0a2d478733b2b53ae9c1db799c9e
MD5 54440f02466d2653d19ba43c501602b6
SHA1 9188b5bd51521fd4f8190c8ccbd3ad721af2661d
SHA512 c933b5f6351e20d60c4b91b624adefa4af67d37d0a0f749d4dab76744f8e1ba349d3595e4dcbf1813a1d16c4f7f098bfd4ff3c48a3ec2c4d004ac1365764046a
TLSH
T19231B95FA4854E03CC6190B155CE551D337ED8E51601D30F55A88732FC9BBB51EA3054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a76e37c7-8440-4a48-a1ea-253219d8f42a\index-dir\the-real-index
Size 72B
SHA256 88cfdf4c51aefa9b56ab6f567c0be60af9ed0ce71a2f7c50b922b2541fa924bc
MD5 c194cd90f11463f98ea44ee8a344c58e
SHA1 a64b11ca9c72067563e0851eb6d98d8236e51d21
SHA512 ef307daa011c8ff91257475e39df45302c910dfc0bfee57a732a6479eda8c88a914b50678c551bae052c3672a21b6352909970d6531b16c80f1619e12d11b821
TLSH
T18BA0022556C54003C00F33F135DE05517750C9104251131F65902048CCD1A454DCD44D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a76e37c7-8440-4a48-a1ea-253219d8f42a\index-dir\the-real-index
Size 72B
SHA256 b011893840a731938bc043a15436b929da293e527fa315379aa1d5fafaa24a57
MD5 7c316ccd891e29f09d6da34c36db5567
SHA1 bf130f7d74bb5eeade1801da418a2000dc3cc92b
SHA512 2ce820c6c95d4088aeb9e796074d765936971d38bfd6de12b351580d586dd146a4c0374aba68ff7bc8faff19eb258ca18ef5cc5da9f0593c5caeb3e60cc7cf92
TLSH
T10CA0029147A7080BF01226B1197202521200E91032729B1667954144CC60C4069D505C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 1672e72a478d82b0dab32983bbcfcfbb3e6852cfc034e43606df8fb46ad862dd
MD5 2269c1ead81199932519a61d0c4cd605
SHA1 1fe7400317e14d99a7ee7905f81201a444603050
SHA512 a70e80e9de2b3a19f09544ea137a1e8dae8b89b8ebbfb9c4e02288fec4e79e60b2126fd507c82991a41112d117c9caa82e4c026fd8cce1c3e6998862183a3aab
TLSH
T1DFF05CB75FF72810FCEFC3DB1432947284007444C515EDDF142AA5D750B27642486CA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4277b2c28311720c311b26eed196e6992fa95e432963db7a9637d2c322cee110
MD5 a2b581d2cd30bea418bba93a6b9ed6b5
SHA1 10481a64aa3bbb1663dde062a030fd477ce1ed01
SHA512 c043b9141cf7a48581e2fff93a235861bd444e33da504b5e9a641c9002f14845fe49ae6fe145a31a2c7194d9d78279b36549e40ef46bd4efb8ae5156d9519d6d
TLSH
T1D3A0021ED356D56AC101A2B0948105ADB310C9780605267144A46158E8F414A4762044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ca40.TMP
Size 48B
SHA256 86dd422459abed532a31f512bd775420ce966ddb714a690f18d8b85ab703dc74
MD5 5fe88de428cff6df865ea514d1bb7cf2
SHA1 cc26bdeb53eb95bb493129ad1f683f4aafec8d7c
SHA512 c1b1d5ed823e5ac806ac5593e6d8bed862a75af1b5d261d753dbe9cf74ffddb57a401dd5361afb13405af02088f5fb34e959d6a7bd2c7dcf2b061bff0301c709
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 88c45fcd6fbf05e6913a52f0ab1243273bb70adb67c0054750fee04dc8642824
MD5 af338d712d91556fcf168e59068ceff7
SHA1 8830ffab8925bcf34f1cc82e8f1e781ca9225611
SHA512 8bca4e3b2a027b1f9bc0005f21460c3464ab779c022c5ecbcdc5caab29b8b52907f6e09b3b9ba4858a69ed953d77d28c8d22b26fe1eed34c247b843d8af64408
SSDEEP 24:KVb0vYvIHKrhG16SyVDyXW1WpsNIPKxhK1yS03UtG5s9IvKhhq1qSE/TyXvIT4z:KkgIHKtG8ryhmIPKXKUjmIvKHqcbyFz
TLSH
T1CC912100757B82903A3D294D96A6B42B468679A3701DE43F7BBA40B15F37E508DFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f60e7da4-4308-43f6-bbe3-03efa2a91133.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f60e7da4-4308-43f6-bbe3-03efa2a91133.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594145.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594145.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ed751066cdfb28a765d5642a3b7061019d34ac6390b49d2feea8eb27af7cbaca
MD5 b2d07a2b08bc6355dd45e10573026136
SHA1 75e8ae9267c42cbc3ae4866a9c23fd8fbbf7fdad
SHA512 9e6fef294a5cc0aabe9c2fe841dabb133c0f617900175a1421f505f555a438a2101147d7520ec471a1086ef9d7d85778abdb1f0c9095a3e975fe271aede4982c
SSDEEP 384:n2wjccCs+Bt0S3vsNfATDCZ3dR/d2X+udgqcKzXU/AatId6Xqf3W:lccQP3CR18PxzXabW6XiW
TLSH
T119827D3568781C7B9EA2DA15F04B77075FF410BBAAC52B68D9DC8F0D008B7AC131792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1ab32cb4d41742f19e3c1160c768bf4ed3ec17c725ce85fe4dd7b5a5e5a9f07d
MD5 4dfadc27b877c23dd1239e3d0301b817
SHA1 e39579748d5fdc23083cf228820a6e4812df47ee
SHA512 b125bcf3930d9273a7b7de1b994066a370b69d74e9061f9d36d9d3a035c47956fdfc23dceb5dcf92109fda036951a40681e706693d77ba44d6d64da2b9bf30f3
SSDEEP 384:ncwjccCs+Bt0S39sNfTTDCZ3Xv0/d2X+udgqcKzXU/AatId6Xqf3W:/ccQd0CK18PxzXabW6XiW
TLSH
T1A0827D3528781C7B9AA6D905F14B77036FF410BBAAC52F68D9DC8F0D008B7AC131792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 77334332cfc359b80de8ee6c6627359c9cc1793f0b2b31987fc0f35ae98bce9b
MD5 9caa1612323c5d494051eb3723580090
SHA1 4bc1b0b53b49db1c31c6f7f4b92c5bd208eb308b
SHA512 0e544062c4d793414936d049b36349d1d97e19ebbb9f35b6ffea9e9cb7e0f6fce1da32e7d968cb150a9821eadcb0cfd143ce511702afcb0f9e925b8026130033
SSDEEP 768:iFcccQ6KwgtCR1sLP5UWSDRsKqGfzmXabW6XiW:vccQ6mI+KffzmyWhW
TLSH
T176F23BF194D38DBAD89D87C3A32EAD0259BCC173B4885948B7E8692DEC4B5BFC306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a634c01cae48718f777575366ab77c3d4db9cfcdb66c358f4ab8663ffd4858fa
MD5 e4481115eacdeb27c8e5d1ccc19672ba
SHA1 97fdfde51df3ec9a3901489bb9aea386999fa4da
SHA512 81ca623db5dc25a51dffb9f2e5f267bd67f8b5ab033ee3e99e84e85cb052d81eea5381e28b7c4238ed5fa14d7531b75f0174385abf33ace972a8ea015e09fbdd
SSDEEP 384:nUsiFJjccCs+Bt0S3MhsNB8TUNTUlIlTTDCZ3ZvB/d2ZDfQL+udgqcRzXU/AatIG:iFJccQ6IwgtCR15LPYzXabW6XiW
TLSH
T1FBD293F598E7893BE9AE4743A33E6E465EBCD06775841994FB884E0CCC462BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6d69ec34c6c0a9d86aa34dbd87965eab53020e3cf6a78f09a5cbbe8c8191262
MD5 333bd44eb24e60768042849ac52d34c9
SHA1 6e41ae67d67c0c892e02595959193b08dda2d31e
SHA512 501f6b572ec81349be60dfde847a8035a9de159f64340fc1e95bb0b9b1997831612cfc5722f5f92632bcbaba767b6cc094a551632896a43df0d8279d420ced54
SSDEEP 192:YONi6TZ0qQmiUyNplab+jN+FdgHo8ZaVU6:YONi6TCmWlg+udgFIU6
TLSH
T1A002E7366C782C6B8EA2AE45F48B37235FE4107BE9D52B98E5D85F1C00D775C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6f54de534e8b2d6a7deb24aa224ed9ad9a5002fe7ee5d06fa8da27fcb20c2cca
MD5 910c11f8b6a8819c2e8d418e86abdecf
SHA1 51a1da010f4cb331c1ada4eb66f4c5e34c0080f3
SHA512 3ec3dff8e8ef71c8ea7271e2007c211d1337845f882816d81570955d048ef1ec4226a96efc384a8da994cf32d084d373ceeb1f5cb4d10d3f34ceef96bf1da185
SSDEEP 384:ncwjccCs+Bt0S39sNfTTDCZ3ZvH/d2X+udgqcKzXU/AatId6Xqf3W:/ccQd0CX18PxzXabW6XiW
TLSH
T1F9826D3568781C7B9AA6D905F14B77075FF410BBAAC52F68D9DC8F0D008B7AC131792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d52fcf711b1a98411a3d5e37cdd62454f62f1463963af875b5ee6ebf9b98a913
MD5 1cd25968fcd09cebc7386f040a8d7a44
SHA1 82dd0a3132ec17d4721effcae80d1382f71bf7b4
SHA512 bb325f8d171d0cd6a6c86239adaf00b70f5011f79af3e8c2239f5de27a224e9782890994e22bcf0640e1f733bbf048800bfee44d4826996c135d1dff0c134997
SSDEEP 192:ukONa6TZ0A9QmiUyBp/cab+jN+FdgXkNc9IcXhgqvU6:ukONa6TCA70/cg+udgqcxzU6
TLSH
T12512093568782CAB9EA2AE15F08776135FE4117BA9C63B58EAD84F0C00D779C2317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eb6fca114bc37f693c1091e221e3bfb3614efc820c1e09f00c32f1ac6b2c8516
MD5 95712914b39cdb98750e3ae2a785315b
SHA1 84c9f982f39aa483c0261452b841299a358233c3
SHA512 de48d36b67d31ef5981a76f8d96e789fbf9e71f444161f6ab994e72075a63b90966c6929be63fb08f1a7e7fb0f7cb114593f0b3af5d9c556b4850a1aad634297
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0ce19c31175bd415536bd2d2f466dc8ef2b579df27cc05a541a8b5560bbf235d
MD5 9c6ea5a1e324da8e2f9eb8a6b76f7029
SHA1 b86992eb5f3947d517e77c9e4a212cf527c3375e
SHA512 d7f0aa9b08142847f5662983e091e2dd86b665d237a0d68089bae518d6e18e51e0e003cbf4866f83c7d9d5531a3be8a817756db9a1cdb5b36a41a34cc1dfa6a9
TLSH
T11AE00441D1141074F034133004071F105DC54051007101045735414C3C373013734FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589b51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589b51.TMP
Size 392B
SHA256 b2cbe0c7507c98a34842acf53a733e5b50661f0534df08d5dd02af5c48360fcb
MD5 05a0ed82f2811aec439224b17b5c9b6d
SHA1 418e975572565ff8cdfceb4308a2797a06299cba
SHA512 c64a0b325f382d3a506e666b5ff70a14cd6928271b07b8f541df8a10a904417378cb49b151820cf65d93efd7bbc28bcc1ea87afe33d42cd6f0f723575482a9be
MD5 SHA1 SHA512

Submit Download

5d2b88ff-76a5-4d44-80ab-c8e9825a87b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d2b88ff-76a5-4d44-80ab-c8e9825a87b0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2af3b89fc6994961ebd97ac034f2fac74af8a406052cb8c5c2b1ddd3f1c782dd
MD5 85b89bb05ced6f552488de19135895be
SHA1 96146e199c4f9736c9574e70ac35f7ea189fe576
SHA512 74cf32cd66ca02eb5effd1aae1d285b90cca5684a88d3d34fd101137e1294c1cb3b0fe839fb736f48a740c35f1211a0526e181a6b901ae1250a06347415e23d1
TLSH
T191411A4DB6F91148B3B7AF565BF6A86E487EBD772F06C49D10110D4E0622B00D9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

500c5e14-0e12-4f28-a380-cbe219b9061d.tmp

Path C:\Users\Admin\AppData\Local\Temp\500c5e14-0e12-4f28-a380-cbe219b9061d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6ac92068-daed-45f5-affc-cb5baa2a23bc.tmp

Path C:\Users\Admin\AppData\Local\Temp\6ac92068-daed-45f5-affc-cb5baa2a23bc.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0985e4be-e033-4850-a14e-72042cb3a34c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3468_384081862\0985e4be-e033-4850-a14e-72042cb3a34c.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3468_572614336\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bef6cf6-c9c9-4409-9567-b197e810f003.tmp

Path C:\Users\Admin\Downloads\1bef6cf6-c9c9-4409-9567-b197e810f003.tmp
Size 98KB
SHA256 688b6529c01360f5dd0d33766d79e33f3d0b07f7d9bbcdefa4daa00380888b75
MD5 43d97360d5a3d5effce59e86d2ecee56
SHA1 8ee830532e30fee88a3306454eb9635f957fd6a7
SHA512 99f22111f9a79d353ed8bb3f9155033359913b4412eb138777ac597cb12e9b1d81df3ffe231ea908aeb9d219f05b244a41ef4649113fd3d490f5301ba616793b
SSDEEP 1536:XTKu2TUd+9UyerXmP8nYC80qIJu+HSaZOwYz9CtRiep:eTUQ9Uy6eDB+fOBZKiq
TLSH
T106A312400952CBF6E0145199D6BE1FCF00D64E14EC9ECEF6A839B5162FCB6EB8E29117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads