hxxps://www[.]mtas[.]ru/uploads/stat[.]zip

Analysis

geolocation tags

asiadelhiinindia
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
submitted
09/05/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mtas.ru/uploads/stat.zip
Sample260509-e8g51aax5v

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_103866008\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_2064530454\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_2064530454\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_103866008\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_1590876017\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_103866008\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4672_153296695\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_1590876017\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_1590876017\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_2064530454\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_103866008\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_103866008\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4672_410013308\_locales\sr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227750254537443"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{27379B1E-EF12-492F-AF6D-D806616E007E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4888	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	83
PID 4672 wrote to memory of 4968	4672	msedge.exe	84
PID 4672 wrote to memory of 4968	4672	msedge.exe	84
PID 4672 wrote to memory of 4968	4672	msedge.exe	84
PID 4672 wrote to memory of 340	4672	msedge.exe	85
PID 4672 wrote to memory of 340	4672	msedge.exe	85
PID 4672 wrote to memory of 5896	4672	msedge.exe	86
PID 4672 wrote to memory of 5896	4672	msedge.exe	86
PID 4672 wrote to memory of 5896	4672	msedge.exe	86
PID 4672 wrote to memory of 5116	4672	msedge.exe	87
PID 4672 wrote to memory of 5116	4672	msedge.exe	87
PID 4672 wrote to memory of 5116	4672	msedge.exe	87
PID 4672 wrote to memory of 5828	4672	msedge.exe	91
PID 4672 wrote to memory of 5828	4672	msedge.exe	91
PID 4672 wrote to memory of 5828	4672	msedge.exe	91
PID 4672 wrote to memory of 3664	4672	msedge.exe	92
PID 4672 wrote to memory of 460	4672	msedge.exe	93
PID 4672 wrote to memory of 3664	4672	msedge.exe	92
PID 4672 wrote to memory of 460	4672	msedge.exe	93
PID 4672 wrote to memory of 5352	4672	msedge.exe	95
PID 4672 wrote to memory of 3680	4672	msedge.exe	98
PID 4672 wrote to memory of 3680	4672	msedge.exe	98
PID 4672 wrote to memory of 5052	4672	msedge.exe	99
PID 4672 wrote to memory of 5052	4672	msedge.exe	99
PID 4672 wrote to memory of 5052	4672	msedge.exe	99
PID 4672 wrote to memory of 5588	4672	msedge.exe	106
PID 4672 wrote to memory of 2572	4672	msedge.exe	109
PID 4672 wrote to memory of 5348	4672	msedge.exe	110
PID 4672 wrote to memory of 3208	4672	msedge.exe	111
PID 4672 wrote to memory of 1020	4672	msedge.exe	112
PID 4672 wrote to memory of 1020	4672	msedge.exe	112
PID 4672 wrote to memory of 4460	4672	msedge.exe	113
PID 4672 wrote to memory of 4460	4672	msedge.exe	113
PID 4672 wrote to memory of 4148	4672	msedge.exe	114
PID 4672 wrote to memory of 4148	4672	msedge.exe	114
PID 4672 wrote to memory of 2432	4672	msedge.exe	117
PID 4672 wrote to memory of 2432	4672	msedge.exe	117
PID 4672 wrote to memory of 1916	4672	msedge.exe	118
PID 4672 wrote to memory of 1916	4672	msedge.exe	118
PID 4672 wrote to memory of 1496	4672	msedge.exe	119
PID 4672 wrote to memory of 5896	4672	msedge.exe	120
PID 4672 wrote to memory of 5896	4672	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mtas.ru/uploads/stat.zip
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa46dfc188,0x7ffa46dfc194,0x7ffa46dfc1a0
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,9561952135538362619,8002269007009345820,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,2222782906166261901,9600138439100708785,262144 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,12411481219539270059,16904796027557891739,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6095653688945748799,839035267109090046,2097152 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,12409233048163758621,17741974190225883485,2097152 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,15513496552358127020,8423090074717289479,2097152 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1213653997845470794,12791521493717082442,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,12470061156118199419,15681454127647141652,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,7641961217206028128,327737714777206429,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,7641961217206028128,327737714777206429,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=uk --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,884973758752577281,1473312023282995468,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6052,i,17129924806351740000,8772506047426231086,2097152 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12891465333960691602,3346838567960564568,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,16974268075150521009,6141557410761445163,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,17694733012776076132,6318430539925764255,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,2285452369673997255,2394789665147302116,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11286001321004781140,11624968182349691465,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,14544389904041862321,9655372162252282444,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4460850889311384752,1661381097296816561,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,7346630711518753225,15616718834674385627,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,16023301279124387302,11859511246066715505,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,17337553000376355458,9832260817805745121,262144 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,5346535011203259858,10085368367588461291,524288 --field-trial-handle=2296,i,12429979878029176613,11218723877451290623,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3987e6960d50d0b9f4805ddd01d890dd49f30972396d7aa724fe55264630df86
MD5 72df2a200dc3f360121221061041e05c
SHA1 a0ffce40276da9c8f22d0765b43ba3ecfce78466
SHA512 924446a32d5be59b3b032829b97b136ce0eb2369a0e4f2f5ab6d99d948a51ebd95aa3b14cf8487f6fa6eb13a3f5b22fced5b017c4cadbfc1cd31b4d2f40d463f
TLSH
T162D0806C15715D35CCD66970059577293726C863AD53975A1837243C1CC246115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

01cc17e9-afd7-413c-83ca-64aee120299e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01cc17e9-afd7-413c-83ca-64aee120299e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ff7119bc4350a9992b6f1b5cb52d3e4d48692f27619d1286c71c4a71483ab20d
MD5 70540add772aab5546eaf8c683def0c8
SHA1 d6ddd4140bf9ea5ec4da7774bd70f442117436de
SHA512 81f6e3f8a8f9bf363850cff11caa6cb64d284932c2e1312782e54fe264e0985c219b8bb4eda5bec69dde6234f2b2283231f583d2512bd5194eeb5ff49afeef84
TLSH
T1D1E022AACA209C3708F9071D6464464AEB501B5B2B81C95F363C960C8FB063B42CB81C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 109KB
SHA256 2cb2ede5d88aa316083ef8e0e01c04266187d253cf449de4a5969e9c2ff12167
MD5 03dd5c94977d688d168910d3eaa2c06d
SHA1 fe09ff9fc42c04c3b7a49eebd153be7d539bd403
SHA512 4516cb7badee1f28d4af8f8ef125fffa411a05acefaac57f255747b7ae36208ed353e8c6d8f1f8e51efb63e7bb50efbbb0f7d788425b35aa8ac0e7098124b623
SSDEEP 1536:wfEEjpHOefzGZqW3HkPDuVqpBOPcevcZsL62UpPq:JkH0aI5myUc
TLSH
T116B36336D6A54C7B01F16268EC651382F325036F9282A92F3A7C6D5D2FFD93A5502F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d75b6c70b25eaff5c5d57502bd7c48cac55fcedbfec8eb8accfc31ef5af6a1a7
MD5 22a7286dc200846178a9e31d2092bd87
SHA1 54008e45c101fe8b738a7a00f7428d18395bc152
SHA512 6d070617dcc9fdd0201c4cbfc417ee40855a7533770fbf7bb43b2507b0323e0706411ea1a151e0605e4b1d3d10fff5483a27e2d9bbbf1487ecbdeb072497c066
TLSH
T13B41DDF3C3E4866D8A0195F0AA187E2FCE2D0950432C3D5AC4E4AF1BA3E2470E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c16642dc4cd37b7612aabc11f463de53f4badc06c4b42d434b3aeca590fb9ce2
MD5 6f1f595f54ff941cb9c5b231b5945331
SHA1 994844d97f52279b31073f1ced39e15be197aefc
SHA512 0e0d12c65949dcba0b12780b1ca28c97395da66ddbfc55ecbda16e01c3544afa0c196907654f597a4a53be7b31e546021dcdd2605c33e4f03f67d6faa14d6f26
TLSH
T12231CEF3C3E8957D8A0195F4AA186F2BCE6D0955932C3D9FC5E49E0F93E28B4E10085B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d66d988e7abc95f9a54f371d1a60180f63d5946da0b67a05c1696d464fcc6ea8
MD5 3bb75974fbf79509cf105b5e681d7a6f
SHA1 b1ad0ad19627bd57674d95a4fc8d9be4623cbd79
SHA512 d4afd600685c1f9dffb3228212df88c4fca4016ee3aec8f32b927d0b4fa2e3c336ee4a537f4383f25e41e78513547b0b015a99eaff8fa009c117c9071305f946
SSDEEP 192:sxZLRry4pBKOMl8UQt9X/fPsp90jjo+cyrzoJpLHW6+WNGYttta5JIg5Q3IJ:sxZLGq3X/fPsp9K9uLHbGt8s
TLSH
T10872D916AA3859778CDBD219F6457F53D6F9153391804E489AFCCB0C04E7ADD220B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 02f72aa5b90b567bfd66e111fbe9cc0cfec55664dd430915df362dafcc6fcab7
MD5 bbd44d66ebbc14713ec1abe2e3629b0c
SHA1 0c3578a9ddd53b6f6aeed3220cdb711b43cc6345
SHA512 3684353a6ffac6bc5edfec1bf8bce9df627e857452fc0e13b808f0ced29a767ffd69f2a288819b82d6896ce183681d3ee776214dc0159d21170ba34ae04cc34e
SSDEEP 192:sxZLRry4pBKOMl8M9X/fPstPoW3ECcyrzoJpLHW6+WNGYtxtI5JIgjfJ:sxZLG1X/fPstPVfuLHbGDjh
TLSH
T1B362D715AA38597B8CD7D219FA45BF53D6F9153391904E48AAFCCB0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d4985c2c871f325130c68df867bb48e27fd0a91ad9547fa2e12041e9d63998b6
MD5 95199ff8c3883307c4ab08b2dc4477f9
SHA1 6bbc1ff5640f0625300145636071f56360ffce2d
SHA512 d484f1e1e18f5f70a8690254aa8a646c5fecd738a128d154086e0ed2ed40eca4d46d2f19ff95044d16aa8efc08e2305d24dd7d90fba0c757c4f3b6848df0fc40
SSDEEP 768:wsk8n557pLxLcPvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkI/eLlkqHdvroU:wsk8n5PNcPvWvP5kFu1jadI/eLiId8yz
TLSH
T13EF20B3B280CCB7E4F800E9CDC2A7E9E6DE8028F96D8895447F9984C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 e7fa5c171cb6e27b1399c2e523e52b675096530d67b312f3c7a9fb59dff92673
MD5 8f8ba782d48631d42463bf7c9c22bc2d
SHA1 f9bf3905d154b3eed1c5a7a8fd1bf7f55d1fe282
SHA512 27e4adaf05b117e859e4524399aba40473881e3944a4724d9e281c1698c96dc23f77b46ca37d9546d5a86024922103ea59678fb1df8b62d137210a2846d9e899
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAy:eflBf6532xxBzXcn5H3PQZ3qZnmJFQ
TLSH
T1F5C21351753A02913A7E69CA8595B82E52C335B37418E46B7BF900B60F6BE20CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 28880bc5e95a8417d612b8764cbcb3eec56a56b583804fed94455f4a64f50279
MD5 e48fa23d5804ed34aa8288052884e200
SHA1 367e56957e0a3700eb1a563093d5ce97a1be0df1
SHA512 284bff102852b1c841e52986b34b24488ee658b607133a2389a2ea13036ff2b42ea685c0a202b6625ad99774945ee994bbe946bc55f75a8af4a7c51b625f9726
SSDEEP 384:n3iFavqMg3sNW8TUNTUlImkrqOABApPVNvfnYxzM+HuS77HwfsRYV/Vw1mR3Ce0M:yFayv3fwgRLrYx7XQfsRYk1mV/00h
TLSH
T16CC25A36E898D9ABEDE68FD9E7197A07EEE00157C58C4AD8DAD41E0E00D71AD130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1d9bbc6cb843291c20cbb35cb8b935f05632b8c29c8807bd586a6cbc9da46e4f
MD5 c88f69b8c4e588eb009767727556a942
SHA1 a33a03a8a8441982cfa1673b60c7e33674bc46c6
SHA512 6a630e777f3f8108f605998e51b1e2c4d87f7da9885fc9c2dbdf708734d9deadbe429fa5ff21180d092640c2bf9ee6dd5f947f776a40c1df6fd185d54ea1191a
SSDEEP 384:ndZiF9CcmyWC4sNK8TUNTUlI4klz4qOABASJNNvfnYxzM+HuS77HsDM+f+yRLPP1:dwFccp4Xwg5zegzYx7XM1f+2LgHy
TLSH
T1BCC24B36E8A8DAABFDE64F99E31A7643AFE0015385C89ED8D9D81E1D008719D130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a73a885602f938c8aea40fecaefb4d308801673e8af0ebd2f9f3070ee6cb1e0e
MD5 b91f2559a30afa07b6c6c5faa77e5f01
SHA1 a5a0c8569e693dae5ba544699c779921cf7588fa
SHA512 7c4f07ae18066676034ebf8f751fa661a828f2ce36c5b209e175a3aa2f318fa84457e77ad09e597f50227e4bd801ec1c5b037f6c32f3dd6e6cecba226a304c7c
SSDEEP 384:nUiFavqMg3sNO8TUNTUlImkrqOABA49eNvfnYxzM+HuS77HsDM1f+RYV/Vw1mR3L:vFayv3nwgRKKYx7XMUf+RYk1mV/00h
TLSH
T150C24B36E898D9ABEEE78FD9E71A7A07EFE00157C58C4AD4DAD40E0D00D71AD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 06cdf12f9e3aaa9041948903cc08d54cb7bf704105b736d5d6e22b9ce1c1a83e
MD5 2d53945bb40eb4f997135919efbac8df
SHA1 c4419fcaf998d09f4a6daabf21342705970eca45
SHA512 0502801b63f7b6a977b5c7c2cb9df5bb3a3567d928ea2d21943342998278c95dd01c8e2a2e062e66ab6388067e33303a207cb7b2f216b2b133bbcb105632fdaa
SSDEEP 384:nVZiF9CcmyWC4sNK8TUNTUlI4klz4qOABASJNNvfnYxzM+HuS77HsDM+f+yRLPP1:VwFccp4Xwg5zegzYx7XM1f+2LgHy
TLSH
T1B5C24A36E8A8DAABFDE64F99E31A7643AFE0015385C89ED8D9D81E1D008719D130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1f3c55ce8f54138a39c80e1629ed241438572d08e47fd167c09e47d09d71fc2d
MD5 45abbf891106f06621d7b1ccebe8d9b5
SHA1 1a5fc99ce68930c03d6c7cc56fb4585d22253c07
SHA512 4a5ef2d1121ac294bafbcb4fa9cbc2cac1a913f8ae9097fd57a4d2ff48835e7af63a5b1ba2b8855796767333c52dcfa9754f0cb0040ae4edc5cd48dddaac174b
SSDEEP 384:ndmiF9CcmyWCdsNK8TUNTUlI4klz4qOABASJNNvfnYxzM+HuS77HsDMof+yRLPP1:dNFccpdXwg5zegzYx7XMxf+2LgHy
TLSH
T1EBC23B36E8ACD9ABFDE64FA9E31A7643AFE0015385C89ED8D9D81E1D008719D130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4a2793d3291b4e7e3e63f714eb270247c5379d0ce3c53334327ef80b8addee1d
MD5 7b7c852a269e31f77632b229708467bd
SHA1 509c8bd072f2583041dfc285759256688b027a4d
SHA512 8be64b8b375e10a9f3bd26484bd76687d45c2b927e5906cb9948364b95fb9fc80a6008ece61bbebf6babca1a3a641a73cca16f435dc0f06894d79c8a79273a27
SSDEEP 384:nVZiFavqM8sNK8TUNTUlI4klKNqOABAEjJNNvfnYxzM+HuS77HsDM+f+yRLPPErE:VwFaylXwg5KZm9zYx7XM1f+2LgE
TLSH
T190C22A35E8A8DAA7FDE64F9AE71A7643EFF0019385CC5ED8D9D81E0D009719D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3bca9518fcfa55195a7ce002b3b39acf4fbe4591332da58d6795fbcc539b7795
MD5 06368522886ed9833dde7f7e293ee13b
SHA1 87ec3973bf1170d79e6eb8e7630318a3402b9f0b
SHA512 14683296373be050c8018b2943de7914d93b7a9aa186d4e73196b543d9b2b2098bfe8fd4b70ec7181c3732a83cdf799cbadaed1b2a5c8e08ee04f81c7b6b15b7
TLSH
T142312FE1583D2AD1D4FE0A6E645B3CFC85D8D32AF5B8713D6824EE98073A60E654043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a59453b91a520192d05450610d50415b2b3a99bd474b3d48b715989c791e2274
MD5 27bb9a93ae73ac14c918be6d08d2860c
SHA1 da12de730f9442fe8896bfdae76b20528911e3ad
SHA512 7211548863d7e6a5a8a4736755e35545c0cd557c2b540cca5328fa39546a92b9af6ab7643e976aac47d677a632b4894196ddd391cb85e66273769814c1895beb
TLSH
T134312DE15C3D2AD1D0BE096EB45B38FC94D8C32AF9A8713D6814EE98473A60E654043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3f0f1cb5eb3be23c424bbf1a3af1f661a7725103db1cba7fb4146de106bbe2d6
MD5 d8bbb26a89c49335191da2076710d8e6
SHA1 5212b5b10fdddd8c3f9801151ec85011f8cf0e40
SHA512 86b7534afc0c08717ef4586ad7a61bdf46b7b910bd774766fd787efea9d1f2440554e2be4693d64b4b00cd319bcd304acad3c97ec71a67094d0f69ee8707055a
TLSH
T1CF311FE1483D26E1D4FD0E6EA05B78FC84D8D32AF5B8717D5824EE98063A91EA00143F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0a48aa775c0012b6c2d6a660cabb1cd6ec088e779b1d29e39aee869c094f0eb
MD5 d1fe58df8ab3d366f6047f6901d1c1d7
SHA1 1b5f57873ed1090771eac3d0e101ee212ad2e1b9
SHA512 3d5d3ef002abf34da06f3298e325b079c313c722363de2e8416aaaa629a3fea876d35bf1083f0c5a349699d08ba27a2613d6046da4d27846d8ed389b8b26e18b
TLSH
T1E641185CB6E91148B3B76F5A9FF7B8AD487EB9672E06D45D00110D4F0A32B04C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

stat.zip.crdownload

Path C:\Users\Admin\Downloads\stat.zip.crdownload
Size 3.0MB
SHA256 cf97efe44799b0deb03fc318cf63eac149fb668a6c17c5b83a0a099f32e367af
MD5 8e89fadb96d599ebc524aa3aaca766f3
SHA1 9d664b25b4d5dcf933556dbe49baf8effdae2a0e
SHA512 52b06409248c886d03f4cf6c0ececccd2e2ee12741bc45c1e0faf8697f72becd5aeda59d42554471e12254b4e2cc0fdc84e5c6c87c33006f828d037014ec674d
SSDEEP 49152:0yT+c9QmK2SOAZQTbhrUZssVeL34HmNP+voPzS0QEae47LVKhpNeeKS0duVGq:zT+UZ++hrUqsV5Hi+QrS1EaeEpMaS4G
TLSH
T152E533BD4D3D38458038968BB4FC6E85C22B65D9493B86F6A3D58D8E6013542E83F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5104-35-0x000001BD19E60000-0x000001BD19F09000-memory.dmp

Download

memory/5352-208-0x000001B7D7EB0000-0x000001B7D7F59000-memory.dmp

Download