hxxps://pdfgrip[.]com/

Analysis

user interaction
yes
max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pdfgrip.com/
Sample260428-txbleafv9q

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
88	964	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	FlipGrip.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4576	FlipGrip.exe
2340	uninstall.exe

Loads dropped DLL 1 IoCs

pid	Process
3248	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	FlipGrip.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2784_1313189523\manifest.json	msedge.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	FlipGrip.exe
File created	C:\Program Files\WinRAR\Resources.pri	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	FlipGrip.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2784_2087533535\manifest.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	FlipGrip.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	FlipGrip.exe
File created	C:\Program Files\WinRAR\Descript.ion	FlipGrip.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	FlipGrip.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240700781	FlipGrip.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	FlipGrip.exe
File created	C:\Program Files\WinRAR\Default32.SFX	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarExt.dll	FlipGrip.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	FlipGrip.exe
File created	C:\Program Files\WinRAR\7zxa.dll	FlipGrip.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	FlipGrip.exe
File created	C:\Program Files\WinRAR\Rar.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	FlipGrip.exe
File created	C:\Program Files\WinRAR\License.txt	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	FlipGrip.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	FlipGrip.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	FlipGrip.exe
File created	C:\Program Files\WinRAR\Default.SFX	FlipGrip.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	FlipGrip.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2784_1313189523\protocols.json	msedge.exe
File created	C:\Program Files\WinRAR\Order.htm	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	FlipGrip.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	FlipGrip.exe
File created	C:\Program Files\WinRAR\Zip.SFX	FlipGrip.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	FlipGrip.exe
File created	C:\Program Files\WinRAR\Rar.txt	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	FlipGrip.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	FlipGrip.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	FlipGrip.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218671572108164"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4576	FlipGrip.exe
4576	FlipGrip.exe
4576	FlipGrip.exe
2340	uninstall.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 632	2784	msedge.exe	87
PID 2784 wrote to memory of 552	2784	msedge.exe	89
PID 2784 wrote to memory of 964	2784	msedge.exe	90
PID 2784 wrote to memory of 552	2784	msedge.exe	89
PID 2784 wrote to memory of 552	2784	msedge.exe	89
PID 2784 wrote to memory of 5032	2784	msedge.exe	91
PID 2784 wrote to memory of 5032	2784	msedge.exe	91
PID 2784 wrote to memory of 2616	2784	msedge.exe	92
PID 2784 wrote to memory of 2616	2784	msedge.exe	92
PID 2784 wrote to memory of 2616	2784	msedge.exe	92
PID 2784 wrote to memory of 1184	2784	msedge.exe	93
PID 2784 wrote to memory of 1184	2784	msedge.exe	93
PID 2784 wrote to memory of 1184	2784	msedge.exe	93
PID 2784 wrote to memory of 2788	2784	msedge.exe	94
PID 2784 wrote to memory of 3772	2784	msedge.exe	95
PID 2784 wrote to memory of 2788	2784	msedge.exe	94
PID 2784 wrote to memory of 2788	2784	msedge.exe	94
PID 2784 wrote to memory of 3772	2784	msedge.exe	95
PID 2784 wrote to memory of 3772	2784	msedge.exe	95
PID 2784 wrote to memory of 3460	2784	msedge.exe	97
PID 2784 wrote to memory of 3460	2784	msedge.exe	97
PID 2784 wrote to memory of 5048	2784	msedge.exe	99
PID 2784 wrote to memory of 5048	2784	msedge.exe	99
PID 2784 wrote to memory of 4424	2784	msedge.exe	101
PID 2784 wrote to memory of 1616	2784	msedge.exe	102
PID 2784 wrote to memory of 4424	2784	msedge.exe	101
PID 2784 wrote to memory of 1616	2784	msedge.exe	102
PID 2784 wrote to memory of 2108	2784	msedge.exe	104
PID 2784 wrote to memory of 2352	2784	msedge.exe	105
PID 2784 wrote to memory of 2352	2784	msedge.exe	105
PID 2784 wrote to memory of 3796	2784	msedge.exe	106
PID 2784 wrote to memory of 3796	2784	msedge.exe	106
PID 2784 wrote to memory of 1540	2784	msedge.exe	108
PID 2784 wrote to memory of 3416	2784	msedge.exe	107
PID 2784 wrote to memory of 1540	2784	msedge.exe	108
PID 2784 wrote to memory of 3416	2784	msedge.exe	107
PID 2784 wrote to memory of 4264	2784	msedge.exe	109
PID 2784 wrote to memory of 4264	2784	msedge.exe	109
PID 2784 wrote to memory of 3812	2784	msedge.exe	117
PID 2784 wrote to memory of 3812	2784	msedge.exe	117
PID 2784 wrote to memory of 3812	2784	msedge.exe	117
PID 2784 wrote to memory of 4432	2784	msedge.exe	118
PID 2784 wrote to memory of 1828	2784	msedge.exe	119
PID 2784 wrote to memory of 4432	2784	msedge.exe	118
PID 2784 wrote to memory of 1828	2784	msedge.exe	119
PID 2784 wrote to memory of 1828	2784	msedge.exe	119
PID 2784 wrote to memory of 3892	2784	msedge.exe	120
PID 2784 wrote to memory of 4576	2784	msedge.exe	121
PID 2784 wrote to memory of 4200	2784	msedge.exe	124
PID 2784 wrote to memory of 4672	2784	msedge.exe	125
PID 2784 wrote to memory of 1168	2784	msedge.exe	126
PID 4576 wrote to memory of 2340	4576	FlipGrip.exe	128
PID 2784 wrote to memory of 2324	2784	msedge.exe	132
PID 2784 wrote to memory of 2324	2784	msedge.exe	132
PID 2784 wrote to memory of 2324	2784	msedge.exe	132
PID 2784 wrote to memory of 8	2784	msedge.exe	133
PID 2784 wrote to memory of 8	2784	msedge.exe	133
PID 2784 wrote to memory of 8	2784	msedge.exe	133
PID 2784 wrote to memory of 1440	2784	msedge.exe	134
PID 2784 wrote to memory of 1440	2784	msedge.exe	134
PID 2784 wrote to memory of 1440	2784	msedge.exe	134
PID 2784 wrote to memory of 3940	2784	msedge.exe	135
PID 2784 wrote to memory of 3940	2784	msedge.exe	135
PID 2784 wrote to memory of 3940	2784	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pdfgrip.com/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffdccd3c188,0x7ffdccd3c194,0x7ffdccd3c1a0
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,17981472476962995917,11964051419351264403,262144 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3010073762301510989,2711912143382148340,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,15438954466998184343,9977163199224725156,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,4852021584984055657,13927764057871193295,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5126514811375779806,14354029619872078783,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7987611102464481523,3655651512050665503,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,2117862292365716126,5106633873195652491,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4076673830831750799,14309142739050505514,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,11135466919175422357,1934029759408731073,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11322522147076691477,3179558292264553687,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,8337274490995922507,5090387358252502135,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14416001895407341924,5062081230549261191,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14416001895407341924,5062081230549261191,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,13065770887850578455,12313051555940834667,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9899582039481339481,7323826593266311864,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5626783403373667192,12003866153170652794,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,13446858767577585324,17154359931376707072,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,10929495547458478857,15043691828680684990,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4308,i,889444887154377756,6759843830364436178,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,16100146010957377270,12862796977229736286,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4252,i,16422035751137415416,12495872836672101189,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,15341972195877376310,3949416436383042182,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:3892
- C:\Users\Admin\Downloads\FlipGrip.exe
  "C:\Users\Admin\Downloads\FlipGrip.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3779672028525303323,8386257454285464406,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,10342478684677593435,12422023196903074529,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,5296645819038109587,9900639062646987078,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5720,i,5478720078737958537,13911316464051413121,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4472,i,2653436871538518682,6271954032194054500,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5600,i,431035839413066979,8174035258908125123,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5568,i,3389812852798000788,9561575432781461890,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5532,i,2513142512636845219,2562226470520220980,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7000,i,15564411982993732139,15806984227142590902,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6996,i,8583408858419441806,18306328028576265291,2097152 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,17596934083249190410,4030789753426813002,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,8803323380532049561,63429695055996645,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,18049128048845014851,13390703980670013409,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3015034695678335454,5753434187273553065,524288 --field-trial-handle=2840,i,3068008390226825977,11154571566110384195,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 db7b1ea456bd12028e03f9d88af543ca27ebe68101afc81b846e127590b70006
MD5 76f8c35620b734c2a715c3ba41d7ec00
SHA1 7f8d1a4c8a69da6c3afcf141889552b6816c1b66
SHA512 286981f9f0e8640e495082fb18a33a23da3b7fc15bb761655e61e4b9877e4675f5b11bc96826d7315bf55da70b6d8d5eb190e027ad866ff9c7a7c9acf0be78b4
SSDEEP 12288:QegJaV781ACnH5AC+6Fni6GR1AR3jUXloBQKuk9ltym:QegJ87HCH5ACFi6GcjUXloBQKdltym
TLSH
T1F9E48D05A6A853BAD47BD07CC683461FFAB2785583B1C7CB03A51AAA1F137E0573E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2784_1313189523\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2784_2087533535\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dc
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e92328ca7fcaeef0d32f5ba822bd40ccfce972e198209570d5e30f3899edb5b8
MD5 00373589e4e5a99f168e814e4bdd9a15
SHA1 155f8c13a96faf88844e60fd0288209240ebc9a9
SHA512 ae4e331c5f2d92ba09fafbad3b1f869e4114aee266587e42832128ed8fdd7a84b9f04bd4bc2dcf8ab6f27c2b11295485934204b458d673ad5e4f4ee217583820
TLSH
T19E710804A3ED8C29FBE153B5D6D12089B3308F48C15B1E2E36F1C23D8A36B1F72A4560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58acd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58acd5.TMP
Size 3KB
SHA256 cb640050de9672bce79dbe07aeb152a10ec25521687a4e61af9d1bf6488a2dac
MD5 6679dbac48cb80e4176f17d1977fdadb
SHA1 50ecc6ec8c7a2462b1bf6ab6e43c2d0067210185
SHA512 fd2084114f8c0d8462484732a46ad550a38001f355fd9eaa8bb6fdd2764f0328b9c735f7818fc33aa826cbccac08518564cb356a7d71bc74ae033ba662aa4eb9
TLSH
T15471F85453D98D29FBE153B4DAD12489B3308F48C1571E2E36F5C23D8A35B1F72E4424
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7218db1f-b2bf-4894-ac6f-ebb2c02b8eac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7218db1f-b2bf-4894-ac6f-ebb2c02b8eac.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 81d0877c1e393c5861f54cdabe4a7c4fb133c4431c74588555549226532dd74b
MD5 ae37c1674c36ceeac7cf732b9ad9ee22
SHA1 9a26bfabeedfae98fb3fe925e65f39d4c40d7d65
SHA512 12f82ec0bafcd01b15cc937fa31499cb8474b052b63ab2a020b48635f9a38c86f9c61371ef844e5eac66bc4f6b2d0347395f9a07dd9c323d17642f8be266d3b9
SSDEEP 192:DHevOUA6KMyc6CpIF1Dkj6Cijvw75HcgiMmGQ5t1lzzx02Smqhej2G5npx:DHevOUA6KMyc6CpITDkGCi7w75HcgiMe
TLSH
T18B12A0F3C3E5862DCD1162F0AA183E1BCE1D0955536C3D5A89D4AF4BA3F24B1E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f9c9315711cae1be72045a8b595f5046b5d254aba7cb2064bc78b9b10db50ab1
MD5 5301a620ab57dd2969c613cfb2101720
SHA1 30ae7dd37135eb9cacab8b79a8ad30f4fe15f100
SHA512 cbcfe1f8591100bcba79bdececdc17ad2f749c1b1f86d8cb77e7dc5eba4544a665dec5a449b07328c50d53986a046a48e04017418059cb35a46598d1a1b5c42a
TLSH
T1F4D022E31301B0B5AAED2ED260EFBDAFC72700700C82E9D810F4D8AC06364AC1917A45
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe596603.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe596603.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f64cffa3d48256b34e8c3c42d32978978e55b8e90cfb81898ccaac49dc06c2b
MD5 8b05ccedeec4c1b28aff5794badc5bd6
SHA1 be33651116606364f0b376755dbdcbf5d7fd26e9
SHA512 6ea281b8f8fbffcf5bbc4f1c506dd3a83cff0a896e708bf7777092308f1af69021272da5f175f2508b28a917c2067047e3480178206eea256175f7a3f94da292
SSDEEP 192:sxZkR7yM//K1Ml8MkH/frsuWGFGnIdpOnHW6+WNd1C/YJcaaA+EIg4J:sxZkNMH/frsuWvokHbC/7GNc
TLSH
T18752EA566A389977CCDBD209F9457F53D6F9157292900D48BEFCDA0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 5dfa77e9bca2af42e5043ea85cf5646018872ab032e1f0aa8faffbbd1496f400
MD5 94b84c409e836d3d8a3b8f814d43ed08
SHA1 4c46b71fd0d3842c6f65d81f28366b1ae013819e
SHA512 06730c5c1d1a9d07315cdc00b0cdee8692ab22073ad7333600b6322d4fba090ddfd355b7d5ac3ff374f2dc545a2bfff3d78b5b7153eaf32de7c8c874c2dac780
SSDEEP 192:sxZNR7yMw/K1Ml8M0cB4H/frsIQGeGob2AddpON+q0FvHW6+WNdbi/uelvtz/zff:sxZNcsm4H/frsIQ4/i5HbSZF/CNh/p3W
TLSH
T1FB92E9476524D9B78CC7D619B961BF53D6F90463DA904E8CAEFCCA0C00E66FD261382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5f2c4161f44f27c5d03a5af2de02dc4fb7792bc2581877332d04010248db0646
MD5 7bef6b988f75c1af017630493cce4052
SHA1 b2c92c6f33b62c1a549b51cd9091611c207e9ace
SHA512 795d9f56b69775e8c3d8e5f4d0741d37e13cbeac233117720b87a1838ddd124fef79866c43910a6b1a168616eb589d7b5690e8b915ecfbf79c56772a807fa551
SSDEEP 192:sxZOR7yMw/K1Ml8M0cB4H/frsIQGeGob2Addp4+q0FvHW6+WNdbi/uelvtz/zf1L:sxZOcsm4H/frsIQ4/iRHbSZF/fNc/p3W
TLSH
T1A092E947A524C9B7CCC7D619B965BF52D6F90463CA914E8C7EFCCA0C00E66ED221386B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eea69b537e25ae248a9447962e37ec134294b692f5fd1ebe649dd2070e6fbfc9
MD5 13862dbad6d0cb60b9a9df3bf898e6cc
SHA1 ce59655e219c7c34aedba3e8854c0e8c2c5becb6
SHA512 f335f903803fb970d61d5558fb14b06b70ebddfd3b764c298dc43c0317abd1798df5fcdf08b743c03332a8f32ab5ba1436d7b300f7600c7fb44e6ac3535cc07f
SSDEEP 192:sxZkR7yM//K1Ml8M9H/frsGWGFGnIdpOnHW6+WNdelXYJiaA+EIg5YJ:sxZkN1H/frsGWvokHbSXhN6
TLSH
T1C052EA556A389977CCCBD209F945BF53D6F9157292900D84BDFCDA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 42b19f97ae69cce92298ba6c446d47d45cb208a82d3054c5022d906eadc9ec50
MD5 164ea8adbab4057b49315e33afb62444
SHA1 e5a65402c46e932d5e91deb546cbf3a5d7150da5
SHA512 8c22c6b92839ae6b6cc2666cec12a9ad448c89a7abdbb433d8f50e419be90cf50bf37def469d80dc4a7976534fb2cfe64b7d9dd1be71de8491f7a0b74ea67ecb
SSDEEP 192:sxZeR7yM//K1Ml8M0cB4H/frsGQGuGob2Addpm+q0FvHW6+WNdbi/uelvtz/zf14:sxZeNsm4H/frsGQa/inHbSZF/6Nc/p3W
TLSH
T11492E947A524C9B7CCCBD619B9657F52D6F90463CA914D8C6EFCCA0C00E66ED221386B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a57982372e58a5d8c40f6012107c15102c9353891fca0c804b8e2e90c250ba76
MD5 c2559f38baaea7f397468253a9b19ac9
SHA1 e7a6f695142cebeb9bc3e51dea3e2989a4638dbe
SHA512 882cdc90966a8c504dae28248436826bbcf99d7cf81154bbd61b7bf95ac1e3d9a44ec3686e90accd01bab07778f6af46a9b0d3d9f0b04808e06680d9fea669ff
SSDEEP 768:FiQv2GJ7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9j0FLllnWh2ro6:FiQv2GfEneqWve+l+u1jacj0FLfWhNxk
TLSH
T1FBF20B3B6C0CCB7E4F844E9CEC2A7E8E6DE801CB9698895447FA481C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 46a2a0a471459491a253b20a52ace2e1744d2e4e81360636b4727f07b84d7b19
MD5 d5958ed200f66113e11b01ea42af41c7
SHA1 16b0f7e85a6ccdac2a45fafd05dbb85ff9785876
SHA512 93ffe33254db5e2ac828d890182e8c9d7633d096fa213b83959d6e60d87863c8470af3c12be2fb7037da806e6a39584f2de03eb03a55fac6b2366fab61cff113
TLSH
T114A0025402800103C10B53F539DE01C13364C9540682170B52D16099CCE47556F7150C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 041668b7da96469681abf76f5a55bdc9bccf1bc02e2db4073056ee1a025ee9c3
MD5 880684f7f7833f0a4eabad2b4e80324f
SHA1 4199bb188d692381a30bd6d0718de5935aaaa29a
SHA512 78a450404416a29c76654812243ce69605a6164807635754d99323688b7b65a4e411c28af8656e60dbd9b98d91f4708fc0327e15941e66d9978d8cabf5e682dc
TLSH
T183A0021003800406C123AAB3955322451210DD1021431387D0D141C4CE54A4057410FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 3KB
SHA256 a407b87546e645781246e62673e571f38efe2f0ca09591988c12334e40014e52
MD5 8dbe40dd8de6a2fe2dbcfac3ddd7e302
SHA1 865abf3ab1052b6ebaed3cb5c9201248a5a3a2cb
SHA512 d0557f93db0022bc981a01d73750ec0e985118d4c6cd7e4f202d7cda348ae0df34bf7f1ea35dc07fe5a203bd12d983d7594f545da9077603b38bbb843cc7ef85
TLSH
T11F51C34EAC0A5F1ACD6D22B109FA0885337814CE8B105A079DEC697978C33262E4B258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 7b832ca17f2d81232c1e1844d441e08f71602409c8e93dc8b07ce33243cb60ef
MD5 5679cda5c0aa98fdf6ab633ef3187695
SHA1 1d99836395d975d2349198a4b1b964101eab9f1b
SHA512 47e49c44efe620de3c2bd3db1da784bb97e7e343b65be6256330778924ff3c7dde9bd8a061fe1b2c4520498986843402aa512c2c2a51a0ca35f8efb7c32674f3
TLSH
T18B51D64D9C4A8F2BCA3D41B148F61429333458EE1A484B0B7CFD693AAC8B3511DE7218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591515.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe591515.TMP
Size 2KB
SHA256 c7b7c042d41f92fa2e3c98a41187b60c475405cd10f4acbcea6a1e23cb054045
MD5 3f4a08fc4eca6cb0d1117730be8c9758
SHA1 913903e9c9c014a8f4dfea43f9cf8dcef22e52ac
SHA512 63f769bd36aad4ef0d4beafcb3120806dca04a149242b8d0f536ab32e360884be9568043789b79abd33209f2cc8c821de07db97a87870050cd76b6c790e0780d
TLSH
T10D51B75E9C824A22CD6484B349C9246D333AB8A549449F0B34FC8A33ECC77AD3D63354
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 696ed2e4533ed513b156e83a66e41bac8600584623f27901e6863600be49fb74
MD5 8f5a03dd776f6f5408238c026dad5bac
SHA1 042e74571310d94613b945dba3f4588ed698d2e6
SHA512 d341e2245a097fec4923da3280c17c5476d26c70f4c154e3b961fcee136790f44feb62ab10c78b38e40918b7e26af5884b379f796b42781779e167e6568ace84
TLSH
T15EE0D8FB2CA31910EC9F93E2283154A60149B855C951EC4F50AAA1DB54F2640248AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 54f645570671033ff03bf9bb09d51d9cbcc3a04ddd5ebe9a8a16d88c5f561154
MD5 e51201a83c83e0bb2c3499217a088424
SHA1 b453f9d7f39ecd95258cb9654aa8d3d8cc71c2dc
SHA512 bf28e534879603ecbe133225a52a4f27d27c90b6690dcd1d7d3938e7a74e4f81b8c15d84098d423cf9058a3db82649dba5eea57363fd50d3da3f66cf828e3f93
TLSH
T198F027BB2EF31850FD9FD2D2343144B10108BC85C4A1EC4F40AAB1DB90F6644249DC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 69ee0194dabca4ab9b79d457075649d0d67a36d5b1de282b32025590127096e0
MD5 6458247c6e4ee868145ab67de2b13800
SHA1 a21396f570a27e85fb5039322c54c95237044544
SHA512 c3a5d9481b9e4859eae92143038c5c5b47e22037a4674aedb944e57cffcc90f87f3501fa8754380cacaed497ee53d776f3b71972f8ccc478d1af6de21b7815fd
TLSH
T120A00261D958C349D040C270E2B2818572508EAD4645233950AC00E5896C5A047A6305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596807.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596807.TMP
Size 48B
SHA256 5179914579aa39bd802af7f357784be7758e1e36f81b61ff01087ab96d670ec7
MD5 37999cf7eb60ea07a7d021be92bf604f
SHA1 a101f784e30eb1c5bc4849dad230e270555832a0
SHA512 28729bbd8c34a1781f1c9e46e4013ccf4bdd2cefc32c5d1d662c53aaf16d76b7a3a91601889d50511e22b7751184796bca7eb8412fc086cccbfa8bbb99e279b3
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 92ec6ca5354cfad9bc6d6039c886dae0e80fad85d62953f9a4f5ba1d6239c534
MD5 a59b1da5fc6128a1ab15a01aee549b9a
SHA1 2fa38c364beff743c9304cff148dbe8c65176dd8
SHA512 a3d02a23f6305bfe34a43e47c06e55d6c509439f82464f6b196f572f429ad3fb93f492b6da57f193851aa45152343d102c94ed9244b69f1b60944cec171aec7d
SSDEEP 96:KkE4Kh6COTGKI8KicIKB2iiwKvKuCpeKSUa:SnR1rWjt3
TLSH
T151E11421323A42412A3F368E80E1B61F9AC171637558A53B7BBD44668F26E30CDFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4bff7769-30c6-40f6-86b8-6b5d6da0c536.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4bff7769-30c6-40f6-86b8-6b5d6da0c536.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4f1063f5ae80c6d59217f6ad4c5a35642bbc20b6b6d4f7d898d0e794b65ee677
MD5 029e312440bc59202cd2641b2e69b844
SHA1 de935f688e0438262fa1f14c5c006405e31234a6
SHA512 2a7f24b0cfb6bb892cc5f04f9b7e2f82b5e039d5fc90258e05e950b6f3faa4a2f342ffa2610d742a10040e0ab045ab043664cb03d30ca24c97b808c0b02eddb8
SSDEEP 384:nKSxmoWEsNVU9fO1BfgDxgnAMeYQmTV5fPKznmzf:7x0E84OLeYQmDKzmzf
TLSH
T111825CB558689E6B9BA7AE55F24B3A035FF4917B83D42F94DAD84F0E05C71CC130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 2bf701673380910772598b49a5a0d85b27b9405072f22d7e2696f6f75cbe0ad7
MD5 fb40869494015bbfdf9944f64980fe8f
SHA1 9bd772975eac01ecbf45a8faafde55a7c5120d73
SHA512 21b22a4fbba246cfe41d1eb405a1dc1e278722331c192c4c0e3694d4a70f6d5a77e7a20e8e96a1dbd4f1297dbc31992d8472249ce2fe156137e10a8581face48
SSDEEP 384:nViFzSxmoWTxsNG8TUNTUlIl2fTn1I+oXLgTDfYpxgnAMoYQmTV5fPKznmzf:cFux0NTwgx+oX8YkLoYQmDKzmzf
TLSH
T1D7D293F598D78A37D9AE4B83A37E6E429EBCC16775885994BBC44D0DCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b6c3bb7585aba1cbd64c2d1eaf2d492539c32aa832f6edea92581022cc4872e8
MD5 297e0cf55eafdccdcb31e33d22902311
SHA1 542c9716b8687e976b504e38e7680c5938d6c400
SHA512 4705163112fb52441d205d4dcdaef9301d4eccb823e833955784e898889ea0323e8e04734006cc7bdb6e75a3981226650957262a7787bb5a3d4b163ddfb25df6
SSDEEP 384:noSxmoWcsNVU2fTnBlFLgDxgnAMVYQmTV5fPKznmzf:tx0co8OLVYQmDKzmzf
TLSH
T139824BB558689E679BA7AE45F28B36036FF4916B87D42F94DAD84F0E05C71CC1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 259f32df501e1ac3d0fb18640e0517de96f40eeb9c2f2c075bd361e1e945f21d
MD5 588ea5897b156999a6fb496944d1e64b
SHA1 a8d9332e1fb2a5cf40b69bef8707fd4c5c8cb43d
SHA512 2612327218e9da1bebcf142578243eddb096db2b721609574a91c747191a089fc56d1dd530318c4094c2f4f457799a325146b0305d07cb5b6e60a7242f61ef22
SSDEEP 192:ZONb6IT0JZQmiUy+/OgibFzX2RLTFuYJO/U6:ZONb6B3bOgixgMYM/U6
TLSH
T15602EA75A86CAC6B8EA3AE49B0873B235FA4117FD6956F94D6D41B1C01D728C1703836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e5b70f7b0e1a6b9fb59fe8dc72ff365344e1f453987e7e609080d5f5331758d
MD5 ad1e08569d9a62ded958bb5c862d8c8f
SHA1 da2f6a2fb11d88ca6bcc153481086bafa262d20d
SHA512 de1b859eb455915133a68a12eaabba90d445a080e078412080de2f527f51baa17864ef68b4a9b53e55c31ca0b0c6993c10298ebedf97b044ab823b1b0e3087b2
SSDEEP 192:qON36IT0kQmiUy0/9gibFzX2RLnAM9Gh1Y9qRU6:qON36Mh9gixgnAMWYQU6
TLSH
T1B212FA75A8ACAC6B9EA3AD55B0873B135FA4617BD7C56F94DAD40B1C05C718C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 da1db81583782b30186b4b365e7c83ec2e4d63eed88bb365738aad2e7f578f1b
MD5 37cc18d13f84119367e9bec91e7d9d08
SHA1 03cdb9970a6fdfaab489804e322681811a558e72
SHA512 f67a3704e03800a895bc11163d1dc97a0d8c5fef523571e50225224f9b2e9b4e38a8fac160fc87a58d59dbd2566d8e44488217e55731530b609d340b50d86b2c
SSDEEP 384:nzSxmoWHsNVU2fODbBfgDxgnAMeYQmTV5fPKznmzf:ux0HP4OLeYQmDKzmzf
TLSH
T1AD824BB558689E679BA7AE45F28B36036FF4917B83D42F94EAD84F0E05C71CC1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b2272eacfbf9adce14b3b0b898fcfbaab0a5d12f0dad35f53756e32cefc904d1
MD5 eb1c119c441daf14f19d6437543e3cc4
SHA1 82f7c777cf60c5253a94071965aecc9370f60fb5
SHA512 ab2e63747fe036515491f424170417a06d2663019b383c09fa7dc013c907bb0add5ed0bc8fdc68fe1fe07a7547f567063a112f7ca0f066dc979eb11fc458205a
SSDEEP 384:noSxmoW9sNVU2fOhbBfgDxgnAMVYQmTV5fPKznmzf:tx09B4OLVYQmDKzmzf
TLSH
T135824BB558689E679BA7AA45F28B36035FF4917B83D42F94DAD84F0E05C71CC1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 12a8203239ea818020cb4b0b4035d5ac25c70ac82c0645d38567d62e27892b93
MD5 ef1c42d786b42373f0b6ca927787c9f0
SHA1 a06f02c92e67977f79474fde6b0e01798d381789
SHA512 0a29ae5749afeaf7a434bbccecc6183235eea065bc1f85bd8d576677ccd7f231522ba2939c4b1db931be80fbb7d0928ba5d15a4e1961adf58ae190230280f308
TLSH
T164E0011A631000ABD02823320083AB612AF7813007B707465A2006A41C227506A29BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 89b96650ec3976e0ef808a8f6d990b429841a209fcb00837953f9b9a964f9231
MD5 e7f0f793e268455ecaa381346ecb6cfa
SHA1 8666975040d22980340b078f57df1184bcfbd939
SHA512 a358f52fbce9665d4369f31c8d4e9d5f6d01473c582d496e5436a275abd514c638b09f2f3d82e47d89cc9b2ed7b3c8e951f6a5ce950531aec9dc65a012d47ae3
TLSH
T1B9E0011AE31000EBD12C23320083AFA02EF7813007B703465B3006A83C36750BA29BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 013817f0cfe44f8ee382326cb2bcb72e386fd65bec8d72809cba13145c5f5b07
MD5 76de09a41503f2a58acf1a32b7439369
SHA1 ab07f4ecefac4b5d5384ac3a070d8dee3ba87ee8
SHA512 a8a5842ab297bc4851bb8d7d205f0c65df1878e8b135be9a6cb90ad7675a4dd971a07434e31436e3fa54ade3174cf2a93d2dc9237a0295cc113490b5bf4a2242
TLSH
T103E0021B230000D6D02C233000836B202BF3C130167703475E6102A40C233106E1CBC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe593c53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593c53.TMP
Size 392B
SHA256 ee75096fdcfd586473356376ec318a4876c72d8c551cf17d6fd6c3ec06c76251
MD5 eb9dab9c86847f10beea5a51a4d179df
SHA1 8d65e3431f22ae209171ccefa9f568a03437677c
SHA512 24b63aeb5abc52c8eb13b6afdb0cd6c37907add18aed8d2a096c3b3019b9ec829e64c107e9e04caf4864a16d335911422a2db67e7593d75422714360da47bce9
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

8949348c-19a6-4573-a523-d726399d1e7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8949348c-19a6-4573-a523-d726399d1e7c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b02a8ff5f610e1ebc140dd2abf4161086f9089586da832a517c88752cd862c71
MD5 361880b3a718789de4adebe8599a1c7b
SHA1 d94621420e6f5675190766dfaf0f09e30e5e96cb
SHA512 d345a898366a5fcea5231bb00a7ce3cba301a25b0bcc4c8baf36b919a4400a0013284b354012f6d53eabf039f5c0581b0f066b64332ddcc6cce6d9068dba8cec
TLSH
T14C412D5CA6E91108B3B76F569FF7A8AE487BB9772E06C05E00110E4F4663B44C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

1dc08cb7-4447-4a82-b07b-cc04d1ee416e.tmp

Path C:\Users\Admin\AppData\Local\Temp\1dc08cb7-4447-4a82-b07b-cc04d1ee416e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba6d6ea1-4c60-404d-954c-36b92e982b0b.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba6d6ea1-4c60-404d-954c-36b92e982b0b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

75024ae3-9291-435b-8b3f-f748e94be67b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2784_1335768147\75024ae3-9291-435b-8b3f-f748e94be67b.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2784_1675054683\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlipGrip.exe

Path C:\Users\Admin\Downloads\FlipGrip.exe
Size 3.6MB
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads