1f3118935ed9e3c4140b7cef337a970c24e776f316c154aa1846e3f53fa45f4a

Resubmissions

03/05/2026, 21:32

260503-1dlqlahv21

03/05/2026, 21:29

260503-1ccfjacx2p4

Analysis

user interaction
yes
max time kernel
116s
max time network
119s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/05/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
watch.html
Size 1.1MB
Sample260503-1ccfjacx2p
SHA256 1f3118935ed9e3c4140b7cef337a970c24e776f316c154aa1846e3f53fa45f4a
MD5 a3feaa59b54b15e8bbc309d932e7a004
SHA1 8fef3e94a2e2ebb3be1813b297d9531efd4a5e6b
SHA512 eca2823d5b87c264838abbfec3af320f5be12e5e3edb2a15b3dcb8c852a787961e7f9ca8f162d409b9e57a51c91110329cfd927064d960cbae76b47b4c2acd6f
SSDEEP 12288:M4LlI4LlInLlIALlIVLlIELlIqLlIGLlIzLlIhLlIlLlI0LlISvFg/XJyFj:Mh6/2
TLSH
T16435B3541868B8B78983A103DCF5FE3F5DE413294BC89A6EBCB7D75C01ED6180CAE856
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3752_1850953728\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\tr\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_101429604\_locales\sw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223174495140248"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{16D498D3-1728-4613-BE82-12909B49B238}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4556	3752	msedge.exe	83
PID 3752 wrote to memory of 2084	3752	msedge.exe	84
PID 3752 wrote to memory of 4772	3752	msedge.exe	85
PID 3752 wrote to memory of 4772	3752	msedge.exe	85
PID 3752 wrote to memory of 4772	3752	msedge.exe	85
PID 3752 wrote to memory of 4864	3752	msedge.exe	86
PID 3752 wrote to memory of 4864	3752	msedge.exe	86
PID 3752 wrote to memory of 3728	3752	msedge.exe	87
PID 3752 wrote to memory of 3728	3752	msedge.exe	87
PID 3752 wrote to memory of 3728	3752	msedge.exe	87
PID 3752 wrote to memory of 5092	3752	msedge.exe	88
PID 3752 wrote to memory of 5092	3752	msedge.exe	88
PID 3752 wrote to memory of 5092	3752	msedge.exe	88
PID 3752 wrote to memory of 1804	3752	msedge.exe	93
PID 3752 wrote to memory of 1804	3752	msedge.exe	93
PID 3752 wrote to memory of 1804	3752	msedge.exe	93
PID 3752 wrote to memory of 5244	3752	msedge.exe	96
PID 3752 wrote to memory of 3972	3752	msedge.exe	97
PID 3752 wrote to memory of 4256	3752	msedge.exe	98
PID 3752 wrote to memory of 4508	3752	msedge.exe	105
PID 3752 wrote to memory of 4352	3752	msedge.exe	106
PID 3752 wrote to memory of 4508	3752	msedge.exe	105
PID 3752 wrote to memory of 4352	3752	msedge.exe	106
PID 3752 wrote to memory of 5872	3752	msedge.exe	108
PID 3752 wrote to memory of 2784	3752	msedge.exe	109
PID 3752 wrote to memory of 2784	3752	msedge.exe	109
PID 3752 wrote to memory of 3260	3752	msedge.exe	112
PID 3752 wrote to memory of 3260	3752	msedge.exe	112
PID 3752 wrote to memory of 5640	3752	msedge.exe	113
PID 3752 wrote to memory of 5640	3752	msedge.exe	113
PID 3752 wrote to memory of 1672	3752	msedge.exe	115
PID 3752 wrote to memory of 1672	3752	msedge.exe	115
PID 3752 wrote to memory of 4384	3752	msedge.exe	116
PID 3752 wrote to memory of 4384	3752	msedge.exe	116
PID 3752 wrote to memory of 2916	3752	msedge.exe	117
PID 3752 wrote to memory of 2916	3752	msedge.exe	117
PID 3752 wrote to memory of 2916	3752	msedge.exe	117
PID 3752 wrote to memory of 4704	3752	msedge.exe	118
PID 3752 wrote to memory of 4704	3752	msedge.exe	118
PID 3752 wrote to memory of 4704	3752	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffc8988c188,0x7ffc8988c194,0x7ffc8988c1a0
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13086408146828818465,6673331711235830923,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,7560768896899053054,3639638541506001206,262144 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,8764574126643402885,5251866686487120638,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4010119065186698067,15814465492069250547,2097152 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15378885422459943747,416645439226760845,2097152 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5232,i,16152615749758393284,7158484598346203420,2097152 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,7682894029685953442,2268227276039971435,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3542657424317858438,6467738200407951589,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,5428105543294795014,16761782934592891312,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,12088444008455420610,17786294750444409607,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7577005153039062878,5049378853960953226,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4201690083015660576,16637751661384591483,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4201690083015660576,16637751661384591483,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,15257013891137085499,1097135572754908492,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14623294667993699258,1176449397904596452,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,8976686924750365418,1984500689834560598,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,681349782387878790,15935349450569040197,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8405689895121297473,9405655861348962509,524288 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6216,i,16018815258190460849,7313527748365833559,2097152 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5532,i,2467332207996225959,15981467440211957761,2097152 --field-trial-handle=2352,i,6263758372768998879,9816913607441879608,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1877fbc0c43a45e793044a62162a5fb8c5c9dacc6820f192e229549bf23e282
MD5 d7f6a0a3a239b65bbc4d7200cee11fea
SHA1 bc633583358feec3947b57794222463c529d6a40
SHA512 ac97a2816b8d8e6c559e30dec4991e0c20f54b4e6f42611680d63a9ff163e987f62a0d16d6d81e1b2ad20caa1759922ad0c71c527bcd24a2b835bea2edb0a9ba
TLSH
T171D08008A2777C30C4A8D470244F7B453919C5774653571558723D685C6305114469D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 693630de12772afbca58d0e311382ac6546952d2c7417697c9cf04290bb383f7
MD5 650f9e39d68dc868fc760e52f68f7fb5
SHA1 8b7b2b313c1da23b2f296a7f87709a346e2744fb
SHA512 98ea53683e8cb8bc12fffcf18d524224e29f680dfca75b769a7dd80a6420fb8b47b781e800f0fc1baa2bdb4aa711d5432260a9c09219b84450a279883f25dcbf
TLSH
T140D08004A2737C30C494D470248F7B453A29C5774653571558723D785C6305118469D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 72aff565e66e1aa09691a73ab3f88aba83235e303fd9063c373ee029160ac951
MD5 325ea40f28253de4316a9d506c05c128
SHA1 70052a330c93fa8feb529b1906a38a8ed0145edb
SHA512 4c2bf917ff3e3e60822cfe40417471a4b8a71500c1b0e216795d4ddbf9b22a722b9b17623cc1fa6b553ff616fc545a048ee1eb6d7c322ad8ffa6770e0afb0132
TLSH
T146E02B9ADD209C3B09FD472960440B46E68113672B50495F3E3E92098FF5A36458BC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1894fc334830f2c42d8b2e0dda54e8dd21729069b0c265b3726f03e63c7c8199
MD5 4b6e3511cbafc55d48f3ac35cb958dbf
SHA1 491f32d1539870c59cbea20640305ef1b3974032
SHA512 01a1d905947674b80a61af60c4d1392d2ced2efed33489584f0b6048bff21623674aab9d3f9ff659709dc4fe65f8ba333ac196ebe9267b0e755b8049bc2781f6
SSDEEP 96:DDVZmOLisHS0tEiBdzd181Wkab5OwE/Xaj68Xm:DpZFLisH3EKdh181WkyYF/Xaj68W
TLSH
T161B1BDB7C2D8836E891156F0AB297E2BCE1D455A432C3C5688F4EF4F63E25B1D20169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a5b74c4471dbcf21009b9ab23fcc8c7faf982518d8bb311c44b2c53cec2f60a9
MD5 642756f1fbde3b4fd8c8f5901f0ad26d
SHA1 e205baf5f6c63441fe2d662bb0fe24e304668ea2
SHA512 ed02fd2d326cc9484b72fa1fcdbb8d7a41c12b5c7524844918b14e02ddb4be86e6685580a9fde76b2446395d13b8b04a9d59485056b44a8a21f119028e8714eb
SSDEEP 192:sxZJRyyMqZ/K1Ml8Mkp/fFsQeYGhyTa6RFUzodpHKHW6+WNGBYhVh6kfYpVHPIg9:sxZJNMp/fFsQeYRTRqHbGFUYVPlr
TLSH
T17062D856AA38597BCCD7D219BA45BF53D7F8156391504E44AAFCCB0C04EBAED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e411befedc1aad8a36002793bb58f7a8c2ffdd064dc83be7cae9ebfe221c36a5
MD5 bb37a3d034823ab82696e585e1caa012
SHA1 fb7cddc3754e2999136dcd9f9a0d3e4e47088e9b
SHA512 59697759b2c00c0b50ba3e7cdb1131f77dad29ec8d916ed438f3c2dad4049a1d5120a3b8f071c4122a3eb327bbd06acd7bda3159641aed5366d8f76901c7ace2
SSDEEP 192:sxZBRyyMqZ/K1Ml8Mkp/fFsQeYKLa6RFUzodpHKHW6+WNGBYhVh6oxVMYpVHfIgP:sxZBvMp/fFsQeYMTRqHbGFhYV/Ndv
TLSH
T14072D806AA38597BCCD7D629F645BF53D7F4116291504E44AAFC8B1C04EBAED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7b94d52e9e6d6d3f13b058dbc7f1a3c46b5f1f7a8fcb1799bc5f67586ca29698
MD5 b3bed07c909ec515013936f9a7a0afe5
SHA1 534c6b89643119e8746c9dd9d48711b1ba80d6cd
SHA512 f3983d6c88f3d6beeb9b111093b219dd658d6599f6ae926cf860f6122c665d730d5fb3375eab3f43e6f8e16e70042ae9915c86e73a53481ad9647ca81930bb6f
SSDEEP 192:sxZzRyyMqZ/K1Ml8Mkp/fFsQremGhyTa6ReUzodpHKHW6+WNGhhVh6zfYpVHPIg/:sxZzNMp/fFsSemRTQqHbGi7YVPjr
TLSH
T1F162D7156A38597BCCC7D219BA55BF53D7F8156391904E44AAFCCA0C04EBAED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1b806e541b72922cdf1ba5790333d5fce6bc69d29ff6f5ab0b0697c38150c901
MD5 7719d1a727d40feb4fc4ee1a6738c314
SHA1 88d1547d9a4ea4266ada77b5b13e98df20611576
SHA512 97b70869e1725d18b290952fe4c07d00fd704bd0133912b63857e9906da03773a27dd18509c271df6ac4397fc451044763395f40bea9c2b24e2965b33403a796
SSDEEP 768:Q1Mj2/B7pLuLndmWvOKhC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0j+xLlh7WxLroM:Q1Mj2/3EndmWvOKhCu1jatj+xLLqx4KD
TLSH
T119F2FB3B284CCB7E4F804EACDC2A7E8A7DE801CB96D8895447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 142b1a4114086a11ae0f4561bbb36943d6f0164a7eb756e8cb450557a8ca30f2
MD5 5ed1e0b415b65e7d23b65f8fb74b4587
SHA1 01196f46bc6f64415ceeccd73169b610246c76af
SHA512 89c0df4d852d8d2ca2a6c35e3742a168f42f936e2c8846b857412de90685c4684ec1669a8fec83b6982fb265c1d7f8b05f7e413085d1435141434a04634ea2df
SSDEEP 768:QyMj2O97pLuL/OmWvOKhC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfj+xLlh7WxLrop:QyMj2OrE/OmWvOKhCu1jaKj+xLLqx4QU
TLSH
T155F2FB3B280CCB7E4F844EACDC2A7E9A7DE801CB96D8895447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\a7846c3f-17ee-4b2f-b959-dd8a9900945b\index-dir\the-real-index
Size 48B
SHA256 0712ed0f36a52f383e51f93af0357fdc5ffacf3ab9dfd4b7265df345b25844d1
MD5 d55f5f46ecf80b1cdd96e717ef27a032
SHA1 6de81ec8acb40ae8cee6f26680f447cf7fce4182
SHA512 a7bb950650b3b8cc16839c067c91efaa7ef102cce3058a90c051fdc92aefa9d0c8379f25845ac140bce40766a00c63e3dfd9b1d5a9c7ad59348892629ed32041
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\a7846c3f-17ee-4b2f-b959-dd8a9900945b\index-dir\the-real-index
Size 1KB
SHA256 bd4f292cf6947d256e448d430aad98f8f99914c02690b55567659d1a8a1e1e3d
MD5 d9558b16f01d7d464497512ef432418f
SHA1 79ea1ba13dfe7ca469e841eaf9937b630f32a7c1
SHA512 915f814b28478df052c792c6100fe44e1811c02789dd2e86a265ac51aaa7039f6c81e516e2590a4b54cd42224adc23378c7b5726a22492bb04620e1f8fe2b4ea
TLSH
T19531938DC8C063CED87022B7296400B263F41824FC19C350A5A4B6A574027A81B936FD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 189B
SHA256 7eeb625430764067568879b6d25a4ea1753bf83b13942553d14d578dffc3c30e
MD5 553efbd8f132ba3f8a4e9a95c84dafff
SHA1 90db7e2ab177476b8652a8c83740abdd41f9a163
SHA512 1ee95a7565bdad64974e7d6c80ddb4b1c27e410bd6eb148c884db8ad7c7c7afea371a556fd2236c8bba66b8feac5cfc8d48c80aae64638138b9ff5b3001c2963
TLSH
T193C0C0F4E3310F3733E1191645080449042EEC00A900AFD9B44F33463474A03C4D61FC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 98B
SHA256 a20704c6d72c328f08651dd50acb1597a7075b72f43341f612973ca336f15a86
MD5 384c098d21af752bbf141602e0383a1a
SHA1 91dbff835bae99048f2c672756c34908b4d5c5bc
SHA512 6509744bdbc16f1d1c1028b8b23c5dd1d1136fffba37c953e037670252996995622da7b953227c91392b60a814d70a7b279fb3ba23c92b8835ea505318da4b49
TLSH
T1A0B012E0B2210F1757FA570402481B0F1C0ED90094306EFCF04D11078831C1308D15F9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 100B
SHA256 979fd888b87901f34b3003aea464643f29f9cfa14fba0b61a60d20cad905c3f5
MD5 f6fa421b4e18c4e0b6c8b8345387f61d
SHA1 bbdeec1c5447f93f6a747f81601a9d78e7c94da3
SHA512 f6d78e2286104112e54554d71fd04b3914e8a4b4d3fb5a166a771f10b3ff0bb2ecf0a4809a885080e943a1e20a2124718b8ab3372dde05b8fa02d619f6f01f04
TLSH
T1C4B012E0B2210F1357FA530802881B0F1C0ED800D4707EF8F45D11078531C1308D05F9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe585cf0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe585cf0.TMP
Size 105B
SHA256 2e4e5545119d0e006b2e8f29371ea6549bf1c46364f99a9fe103d258559e2ec0
MD5 b73edc3fb96cfe22df2bbfd4eafeb914
SHA1 47220a4f9fa0d50e130fed5e227e5fac6dc35be1
SHA512 cb697aa2fa496397020f4a4f4470786b9dd7989e0cf2cc30f7ce2f20ff9edbef7b3a176cb73608bba01fb28b81c6a7a9b0c81d7d9dd1921482d315779d86db53
TLSH
T16CB012E0B2310F6767FB120142481B4E1C1EDC0098206FF8F04F31065431C1348D45F9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1d0753a649a6cf1c4cfca7f146b2bc328b174718af15988933de250a894e4c18
MD5 ed9ad213b2d89f1d735be2c807667c9f
SHA1 44b17706d60cca13563b48d497dafd579e9a1117
SHA512 eb1575405c29c18d8b0693a566b32e61b99135fc2c1788930dbdc0c97a43fbfce5569e2fdf2611fd3b266a15e619830631c93868a92829b348bdb3a68ab718c8
SSDEEP 192:sh1WlDub/kDnmtTYB19srn97bQHSr/54UdaVtq/5bfsRLQNHb:sHWJujkjmxYpYTslQdb
TLSH
T159B21411727A02813A7E79CE8194B96F46C330777118A42B7BB914A64F6BE20DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d053ae68fab2ec65033e93a2c66446cfe1103b4ad241f26af27ec360c068b9b2
MD5 87a6f9f9a937e239a329998abd3c844c
SHA1 06682ea6362e174ac1343875619db0f206db458f
SHA512 ae9a1e0557fa59a107706e9b244194992ebe77d30cf49df918b04b42fe3fb17ba37da8e5366649586ef44166d2af93f67560658c849a061a994c83e9d235ac9e
SSDEEP 384:nTRiFavqMg3sN98TUNTUlImkrOgU+TNUzz4fbYCfRF6SanYyZHCRYV/Vw1mR5arl:T4Fayv3wwg2beYkv6SaXRCRYk1mCl
TLSH
T128C24B36EC54C9B7EDE68FD9EB0A7A03DEE00167D59C4AD4DAD81E0D009719E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cb64f949208dcedfa206e2ee094fe59f30a668b232ad12bc5aad857ef0640867
MD5 9b81f802a5ec01c0be6e600cbbfacc35
SHA1 7393a17f55315c69933912e71753ae0cf5c58e4a
SHA512 a23fb892261520c3b6ccaf2b2918c3c2d6ce9cd79f4fdf7ff72e06b9e27090c0c170fa7780625513e6ac823aa52b69baeb9f64cf1d1087cc2a99ed69bf3bc2d0
SSDEEP 384:nXYiFrcXqnav3sNa8TUNTUlI4kPOgU+8bUGz4fbYCfRF6SanYyZQXFr4tmIJTlqr:XjFz03TwgcydYkv6SaXe14AIJjHY0z2
TLSH
T1F1C23A36E854CAA7EDE64F95A70B7643EFE41263C58C5AD4DAD85E1C00CB2DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4aa072dd321144e9bdb4bee8e5a981a728375819235e70e476ec784350d74fba
MD5 b8452ec60123296a028baff34cdb39bb
SHA1 083fe5bbb785cecc4fb2e24b37efa2391a3bfa37
SHA512 0b811efafd405403aac2fffcfbc4cb12ee1b3c9912bfb4e50e705f2221777bd8b8d586c86223a9007732e49d1414f071d2d7239b18cc933811b0a0a8713edef2
SSDEEP 384:nbRiFavqMg3sNO8TUNTUlImkrOgU+A4znz4fbYCfRF6SanYyZQXFrhtmRYV/Vw1D:b4Fayv3jwg20CYkv6SaXe1hARYk1mCl
TLSH
T136C24B36E854CEA7EDE68FD5EB0B7A03DEE00167D58C4AD4DAD81E1D009B19E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ce78bc30659bf4b3b891bc1097670e96d6b8b34f7c3997cc177af1c679795532
MD5 88e54935eaeb76943b27248dd62df63b
SHA1 1a0c894215723ac006f6d254673dae5bd5505b00
SHA512 c75fd0c9c7badd226075d49150809ac0fc6410a900276678e0c458c692ae85220c28e0ff30bd3ac50a3bc199d0c092a3d287465e7ea0a5ed2feeb690ed102458
SSDEEP 384:nXRiFavqMg3sNa8TUNTUlI4kfOgU+ibRGz4fbYCfRF6SanYyZQXFrrtmRvrN1k+X:X4Fayv3TwgkxdYkv6SaXe1rAR75
TLSH
T19BB22A76E868CAA7EDE69F96F74A7A03DEE00153D58C4AD4CAD81E1D00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9b8c56cd364dd7bf70509e25dcf18de645e36a8d029bbeff0b8cd9d8fb3c02c4
MD5 11d631ce547669b46364c7c14081c437
SHA1 91f975341a8d916528e1b737372a6004adee0974
SHA512 ec60b58bc1bfd13ad7d3387bc66f2573b55824d65d8d45f77c2c91437c5a69ce05e88a17378e75f324b0245588d5c7c3d225edb390e9e41a9fcaeb9f77ad5cf2
SSDEEP 384:nIRiFavqMg3sNa8TUNTUlI4kfOgU+ibRGz4fbYCfRF6SanYyZQXFrrtmRvrN1k+X:I4Fayv3TwgkxdYkv6SaXe1rAR75
TLSH
T159B22A76E868CAA7EDE69F96F74A7A03DEE00153D58C4AD4CAD81E1D00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c28bf2aaa129cbc322762d321e71a6cecb645586f70232fa1e2702d7829d52a4
MD5 22bf7dd434d7f34471c3321b07d0d316
SHA1 397c0fcbac1fdcc462bef8fb37394366f087de6d
SHA512 7ed278e31e3ebe5c3c7001171823eed665f757ff705c9fba64e01baa1d01e71011c385823f327c8163c20f1019f4b3424979dde40fd7286289ea2db5c2c02476
SSDEEP 384:nXRiFrcXqnv3sNa8TUNTUlI4kPOgU+ibRGz4fbYCfRF6SanYyZQXFrrtmIJTlqHL:X4Fzv3TwgcxdYkv6SaXe1rAIJjHY0z2
TLSH
T1A1C23A36E854CAA7EDE64F95A30B7643EFE412A3C58C5AD4DAD85E1C00872DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1fcbb7797cb6f21e02b06ee8af1e9d98c4684870d0696f9f1495cfc1c66ec4df
MD5 e07859ecfaf1dd35e8a98e560eb13185
SHA1 df84a7cd5f17aa9c1a30054aa9118480a98b5cd0
SHA512 23fbf67e4257060dec3053f14fa07174927c7ca8e9e743547ecdb56b5bc8f6aaddc076985e906d9e8b2e033c7d587505bfd4c49ccc91800867d6f7280eee9dc0
TLSH
T1724172D14C3D66D2D8BD1A3EB08B78FCD5DCC62AF1A4357E2864EA88063A51D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4642bfea1a12fcbea13673812fe1c416d79b0e6f54e8d774e2cf05a77c80f978
MD5 ecec238cde07834bbbd20c45ce25bf46
SHA1 1f5a79b2d775eae4321291baf65eaf0628da94ff
SHA512 6ba208eba3d7a898c9ba5f77e5b0b33f5b7e2064c992511100758db8c40fff7c51d3341ff7ddd6583b7bb48c73a12e828b90ad7d484756904ae220e437659047
TLSH
T1F641D898A6E91148B3B77F1AABF7A86E447B7D376F07845E00010D9F0662A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads