hxxps://tunnel1[.]dlproxy[.]uk/download/pLY7i9H8fiD0pVYXWjxuovjRFjf8C2w5-wChqfdjKR_8LzLW1VVyDnrAqIwJ7u0nSpOB--e37GY8flfglEqimJ9ssYeH9f2nagpRLsd-LE5efLbl1oWrjyvO3zwbIre8AjyyiX4jSuWN8kmssFHNfryGEAhHtimlnlSbNqBgCZKozypS_weCO07rDGI5_2PGU6SmPygIHqcAeBSfytXlXYMaw0i1lx5QAMIeZZz2PSOC6Znv1rHp7FyaKluPBK1f6ntFSya8lPv251y1yEa3vGxt-SzG1EZbm9dTLHcqMuroaKpFIPqQny-taIlDU_x37jxuF-mJj6x7SJS0S9if6xIwF0JYmVoNDLvHFk4x6fOsE1ulbB8Wf20EQzdPji9DoFMpRTx4RAO5C7svGL2WBrM9I0C_n89Tx8luO4wfYTY6yhYCXvs4sJAnAlODJEQENC7iU8QFXKKV1mXLGA2MmdK3W1VTru4Hd4d5xmh0mlIHFZ951o7qb6doBoXHBgymuu_NW0QKnwMR_GpDndWkPLHL3mmk9qU8Y81s0hDeUkk7A0GfdW6zXuUwfs5AOaHu5EPCXPB7foUohArSiciH4Mo6G01Uitu94j0LtOamXLo?sig=xPe4N_J9y8tbp1ABO6tXBtCuf1IRWxkMUHB9R17fqMo

Analysis

user interaction
yes
max time kernel
1049s
max time network
745s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/05/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tunnel1.dlproxy.uk/download/pLY7i9H8fiD0pVYXWjxuovjRFjf8C2w5-wChqfdjKR_8LzLW1VVyDnrAqIwJ7u0nSpOB--e37GY8flfglEqimJ9ssYeH9f2nagpRLsd-LE5efLbl1oWrjyvO3zwbIre8AjyyiX4jSuWN8kmssFHNfryGEAhHtimlnlSbNqBgCZKozypS_weCO07rDGI5_2PGU6SmPygIHqcAeBSfytXlXYMaw0i1lx5QAMIeZZz2PSOC6Znv1rHp7FyaKluPBK1f6ntFSya8lPv251y1yEa3vGxt-SzG1EZbm9dTLHcqMuroaKpFIPqQny-taIlDU_x37jxuF-mJj6x7SJS0S9if6xIwF0JYmVoNDLvHFk4x6fOsE1ulbB8Wf20EQzdPji9DoFMpRTx4RAO5C7svGL2WBrM9I0C_n89Tx8luO4wfYTY6yhYCXvs4sJAnAlODJEQENC7iU8QFXKKV1mXLGA2MmdK3W1VTru4Hd4d5xmh0mlIHFZ951o7qb6doBoXHBgymuu_NW0QKnwMR_GpDndWkPLHL3mmk9qU8Y81s0hDeUkk7A0GfdW6zXuUwfs5AOaHu5EPCXPB7foUohArSiciH4Mo6G01Uitu94j0LtOamXLo?sig=xPe4N_J9y8tbp1ABO6tXBtCuf1IRWxkMUHB9R17fqMo
Sample260516-rmy8lsey4v

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4508	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_1439632356\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_508534981\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_415908437\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_1867632095\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_1469962488\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_508534981\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\crypto.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_2119940092\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_415908437\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_1867632095\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_1439632356\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_754053713\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134234147908257192"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{D89BBFB4-D749-4A09-818A-078BE82C2FCA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4616	4508	msedge.exe	81
PID 4508 wrote to memory of 4912	4508	msedge.exe	82
PID 4508 wrote to memory of 4932	4508	msedge.exe	83
PID 4508 wrote to memory of 4932	4508	msedge.exe	83
PID 4508 wrote to memory of 4932	4508	msedge.exe	83
PID 4508 wrote to memory of 4948	4508	msedge.exe	84
PID 4508 wrote to memory of 4948	4508	msedge.exe	84
PID 4508 wrote to memory of 3088	4508	msedge.exe	86
PID 4508 wrote to memory of 2372	4508	msedge.exe	87
PID 4508 wrote to memory of 3088	4508	msedge.exe	86
PID 4508 wrote to memory of 3088	4508	msedge.exe	86
PID 4508 wrote to memory of 2372	4508	msedge.exe	87
PID 4508 wrote to memory of 2372	4508	msedge.exe	87
PID 4508 wrote to memory of 5612	4508	msedge.exe	90
PID 4508 wrote to memory of 3852	4508	msedge.exe	91
PID 4508 wrote to memory of 5612	4508	msedge.exe	90
PID 4508 wrote to memory of 3852	4508	msedge.exe	91
PID 4508 wrote to memory of 5244	4508	msedge.exe	92
PID 4508 wrote to memory of 5244	4508	msedge.exe	92
PID 4508 wrote to memory of 5184	4508	msedge.exe	93
PID 4508 wrote to memory of 5184	4508	msedge.exe	93
PID 4508 wrote to memory of 5184	4508	msedge.exe	93
PID 4508 wrote to memory of 4192	4508	msedge.exe	95
PID 4508 wrote to memory of 1924	4508	msedge.exe	98
PID 4508 wrote to memory of 5832	4508	msedge.exe	99
PID 4508 wrote to memory of 1080	4508	msedge.exe	100
PID 4508 wrote to memory of 3104	4508	msedge.exe	103
PID 4508 wrote to memory of 3104	4508	msedge.exe	103
PID 4508 wrote to memory of 3104	4508	msedge.exe	103
PID 4508 wrote to memory of 1032	4508	msedge.exe	104
PID 4508 wrote to memory of 1032	4508	msedge.exe	104
PID 4508 wrote to memory of 1032	4508	msedge.exe	104
PID 4508 wrote to memory of 6044	4508	msedge.exe	106
PID 4508 wrote to memory of 6044	4508	msedge.exe	106
PID 4508 wrote to memory of 2924	4508	msedge.exe	108
PID 4508 wrote to memory of 2924	4508	msedge.exe	108
PID 4508 wrote to memory of 5400	4508	msedge.exe	109
PID 4508 wrote to memory of 5400	4508	msedge.exe	109
PID 4508 wrote to memory of 5348	4508	msedge.exe	110
PID 4508 wrote to memory of 5348	4508	msedge.exe	110
PID 4508 wrote to memory of 5348	4508	msedge.exe	110
PID 4508 wrote to memory of 4080	4508	msedge.exe	111
PID 4508 wrote to memory of 4080	4508	msedge.exe	111
PID 4508 wrote to memory of 4128	4508	msedge.exe	112
PID 4508 wrote to memory of 4960	4508	msedge.exe	113
PID 4508 wrote to memory of 4960	4508	msedge.exe	113
PID 4508 wrote to memory of 4248	4508	msedge.exe	114
PID 4508 wrote to memory of 4248	4508	msedge.exe	114
PID 4508 wrote to memory of 2160	4508	msedge.exe	115
PID 4508 wrote to memory of 2160	4508	msedge.exe	115
PID 4508 wrote to memory of 1036	4508	msedge.exe	116
PID 4508 wrote to memory of 1036	4508	msedge.exe	116
PID 4508 wrote to memory of 4468	4508	msedge.exe	117
PID 4508 wrote to memory of 1644	4508	msedge.exe	118
PID 4508 wrote to memory of 1644	4508	msedge.exe	118
PID 4508 wrote to memory of 2364	4508	msedge.exe	119
PID 4508 wrote to memory of 2364	4508	msedge.exe	119
PID 4508 wrote to memory of 5944	4508	msedge.exe	120
PID 4508 wrote to memory of 5944	4508	msedge.exe	120
PID 4508 wrote to memory of 1288	4508	msedge.exe	125
PID 4508 wrote to memory of 1288	4508	msedge.exe	125
PID 4508 wrote to memory of 4856	4508	msedge.exe	126
PID 4508 wrote to memory of 4856	4508	msedge.exe	126
PID 4508 wrote to memory of 1660	4508	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tunnel1.dlproxy.uk/download/pLY7i9H8fiD0pVYXWjxuovjRFjf8C2w5-wChqfdjKR_8LzLW1VVyDnrAqIwJ7u0nSpOB--e37GY8flfglEqimJ9ssYeH9f2nagpRLsd-LE5efLbl1oWrjyvO3zwbIre8AjyyiX4jSuWN8kmssFHNfryGEAhHtimlnlSbNqBgCZKozypS_weCO07rDGI5_2PGU6SmPygIHqcAeBSfytXlXYMaw0i1lx5QAMIeZZz2PSOC6Znv1rHp7FyaKluPBK1f6ntFSya8lPv251y1yEa3vGxt-SzG1EZbm9dTLHcqMuroaKpFIPqQny-taIlDU_x37jxuF-mJj6x7SJS0S9if6xIwF0JYmVoNDLvHFk4x6fOsE1ulbB8Wf20EQzdPji9DoFMpRTx4RAO5C7svGL2WBrM9I0C_n89Tx8luO4wfYTY6yhYCXvs4sJAnAlODJEQENC7iU8QFXKKV1mXLGA2MmdK3W1VTru4Hd4d5xmh0mlIHFZ951o7qb6doBoXHBgymuu_NW0QKnwMR_GpDndWkPLHL3mmk9qU8Y81s0hDeUkk7A0GfdW6zXuUwfs5AOaHu5EPCXPB7foUohArSiciH4Mo6G01Uitu94j0LtOamXLo?sig=xPe4N_J9y8tbp1ABO6tXBtCuf1IRWxkMUHB9R17fqMo
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffa8d46c188,0x7ffa8d46c194,0x7ffa8d46c1a0
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16850669220103521058,2861800082946104881,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,11391750321546102224,2295203018299419691,262144 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,1354366647028705784,955573722642064289,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2413751849877048418,11623757339389285116,2097152 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8398060868156015489,446393598754773607,2097152 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,4301074619103059497,17392824848774771179,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11242493869448721403,7502070327125457286,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4719322886520703207,10223870351230490781,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5600,i,16547731221651726221,10974873007123626785,2097152 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17771800639447410361,17546602076249565660,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17771800639447410361,17546602076249565660,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18170592768646669346,3751455991723133744,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,17152824944336933966,4634924551108547372,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,18259378171559676165,6475032169021906454,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5672,i,7473289550219634400,4520490328637243559,2097152 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5028,i,15774773939611267867,15042779670875057261,2097152 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10530275496427206452,15826792287467479138,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7511952838262781955,7366991214298960106,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,15810547823544866,15155816631166337942,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5744,i,11999994542132450605,10619758053084151143,2097152 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,7597986476138392408,17144170623555879886,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3536,i,6656799507772032008,12781167592070547886,262144 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11409748746213555575,7646568495050800901,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,16050219014586676712,11969832990931278159,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17266187422757577313,2998776635663231718,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,12096020894166478593,1776369384362407095,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3196,i,14412463272729205761,15045396167696214747,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,7393382016633870889,5326861347711141406,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1536,i,13655803154781797227,12370139379499227586,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,3639924444294827432,17149859534350107338,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,1412580298883706081,5715756480752629389,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,9864185366662373349,4585114474799925661,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17460665036325906421,5499504886101453881,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14358074039254288279,15158173689207068337,524288 --field-trial-handle=2908,i,5516339020546957836,13147646176487778345,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 4ff975ef2134a9ad6c8c63bc48e658c486ae0c626f5f073dd6aca3d68f2c94ac
MD5 e441e794a521c69957a88e481fa1f992
SHA1 a51bb7aa8c9ef5d59fabccc49e6de4a712b77ca5
SHA512 d47634c7be323d5c30fa575d7704815dae87be9596705ad55a4f3c3587f02fc9f81bbd18f7f58070fa28b76188eee794b8ca3747e231fbc632b4cf2bd41feb1c
TLSH
T19AE0D89A33C6CD672AC5B68683C6AF14D3A275C5B14E98D9B344E4AC284680093EDA98
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 efe1888412ae030d0df6e5d496b4202e86234f93e89a97fa0eff01736c98eb32
MD5 7caeef00fb386ebd2a8568c3e2e7e051
SHA1 da323202473eacd31231c00d8edca432eb2ea0f7
SHA512 e02e8e7f537065a386a20aef1f90a10055ee53936e137b00e5e8aed0f47f159f6cdf5cb4b44709a94b75f2339fd52bc86d5ccfba447c3ad501de754e4dae0a78
TLSH
T1BAE026E89CC8C22FAB58A48753785B0CC3E03A0AA6CCED9B2700C48C3005080A2CA994
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 03f53fb0c418cafe3a8ccc7957c45e802229d575bacc7c6d577bc673bc6690a2
MD5 e8c3793ac5364f5da632b609ea7a3554
SHA1 1057d74c5fdeaa3fe42be1b601b1551c130048ed
SHA512 8aedef6ab15fba4fa7cc510c3af4e68367b18375acfa48e15496fbf3ec35b878be6311006dfb5324591e5d6ef6d6a0bf5685a2626a43056c98e1668526af20a5
TLSH
T167E026C495C9D29E965066C74268570CD2E0364BA7C8AD8A2704CC883246484A6E669B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bb2e66705d14745190544a9d90628a9196f8aeb6ea14a60d3894aa27e934602e
MD5 c7bb2de3f8fae42e92b6a1d296483429
SHA1 6c98e5534a015eefd5c331fe2a87278cc90a365c
SHA512 0eb58c4259f2c03ec17946e5541bc2bad38aac84714520e2fda870b274b7cbba458ffef8b0a19f56a65ec99f840a38a253ba4bb650d7148f5cd04e8fae35f841
TLSH
T167E02BAEC9259C3749FD1B1C65558747D70013572B40895F3B3E510C8FB26376696C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9dffb76892137a6316145563dd7fb17859f43ba2919e68c61fa88f17778d46e8
MD5 cb1f68795fdd3673ca327d0aa5ea1802
SHA1 d461e2b797fed6d710d2ad435d83fdbdb2da9a58
SHA512 5d66b06129827cd7929eb441b4f1abb80fc98d61be205560c6fe2d8d500954fa19cc2a8f65290e8993fc273d74a2ca249eedf1c68caf1434019398ffd42396d4
TLSH
T13341BDF3C3E8866EC91156F0AA18BE2BCE1D0914436C3D5AC9E4EF1B93E2071E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd99514d6a2ca53222c78510453974a04dceb210e5198eb2580fd2aa482f623b
MD5 238ddc6aa0edd78b7467e61194d5a3ca
SHA1 cb06a33642dd55a2b77292d2c712f92b65ca3293
SHA512 37b9af97546ff489954eb43360990daee2df2d125ca3d18039ce03a7ee2e6104fdd3d24ca32c226704a22d09eacf6b160be0ad5420d27b024ecd2395913ae84b
TLSH
T1B341AAF7C3E8866EC91156F0AB18BE2BCE1D0914432C3D5A89E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3c206813a66be690a5df3bdb6849dd64614e20586217c804bdb5978454dc7e65
MD5 d19f17ec611abf132e12090e71d414a3
SHA1 9c9fbd5b64eb6dd7685045c59bbbe22fa1c43a4a
SHA512 83bd11bc003542a4b68cd971fd735fdb567d916e2f156a3299a8b801bc1e32a0d900a4f10b6fb37c1626a7eb3e5a1483c05efe19d48ec45a59cba8aa536ba50c
SSDEEP 192:sxZHRnyMqZjK1Ml8M9//fvsN7uo43HrgpzodpLHW6+WNGYXDMkaIg5Y3J:sxZHU1//fvsNq1HrLHbGCmuZ
TLSH
T1FE62D8166A289937CCDBD209FA457F53D7F9556392905D48AAFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1e00ea6a8567526e659d7b6546d847fca61c0657a723e007984872add9c6cad6
MD5 c931114402e727bcb7c3163069a9462b
SHA1 125b8eb677e4cd9a74c6c4c591af1aeb4fa967a1
SHA512 8c9595b91786b2a5d0aa292bb82813b662abb7033679edd03b5b2afa99f7ea9f7ea44c9945cc9aa5058158c97f258c3f1cfb50e6c7ce94448a3bb87b4d02ba91
SSDEEP 192:sxZHRnyMqZjK1Ml8UQi9//fvsNduo43HrgpzodpLHW6+WNGYXDYfkaIg5YKJ:sxZHUqU//fvsN01HrLHbGCuuG
TLSH
T10162D9166A289937CCD7D209FA457F53D7F9546392945D48AAFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3d148c36312f7c266f5576025aa500dad774ffda16d15aadb4e6efd4da7a2b4a
MD5 2dd91e5e6e528e966fdc5041db5fa49c
SHA1 0c82516d726b8403dec94ad731eb8821647ab5b0
SHA512 c64b062db1ab61c0e9f133c937222dc9a2bc1f454fbbbb19ff7e1828fc9f6700f4ccaeaa5790234452d08aff7a5ac98dfcc6642357c433993089720e4ff0ca1d
SSDEEP 192:sxZfRnyMqZjK1Ml8M9//fvsI7uo43HrgpzodpLHW6+WNGYXDMkaIgj3J:sxZfU1//fvsIq1HrLHbGCmjZ
TLSH
T18C62D8566A289937CCDBD209FA457F53D7F9556392904D48AAFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a20f9efdd767862907e425beff0d065b50a10e0062d369a668b8b0e6b0caedc1
MD5 26e0ce246e6fa17650c38156b716667b
SHA1 048655d758b03736ab2bfb6a556a4ef497572c3d
SHA512 65da39db9cac0843dcd16022eb25ab7e755d8121b048d3716836091a0e377e088cea37cd6f13abc1fca8ab9d127314ae1d7a60cf547181771f77f2301f43c09c
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLeHiLl42vJ4roX:/Zk4PfeEnXDWvXt4hu1jaKeHiL+QJDW4
TLSH
T148F2FA3B680CCB7E4F844E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 9262c18c2efd833e8ab4641960d0674b77cc36e3b7860cb8fddab8a03a672a5b
MD5 7bb37d7feeb2cb087409fd8f02bd574d
SHA1 f1716d10fac9a724034ee85267b6f73caf9d99a0
SHA512 0996645bb0232aefdf2af9347ee18a8cd79c312518e1698f96714840cd3c6455d76fa80b749d113e7fdfe17db77a6ab7866f67ab4dd0d760cc425079d9504c83
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1I7pN3g:EJGnYNSv9PpHV/qjqNNw
TLSH
T1C9B20A13313A03423CBE2909A3A686779E4231B33059E67F77A904A54E67E224DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6b83cd9a6b82cd3d3cd1a5fd012d7a8fdb17ad0a2d9a18bde8327e7adda3a2d4
MD5 b7cba1bb2e6166f2c01fa584bd996547
SHA1 79d83461378c74ed1cad07b618e710d2003cf30b
SHA512 4b8ca9f6585bd9f61130f17bbd8d8dff3f1c32bff32f49fc259cc913e15936b76cddd258d49805f64ff49b7dfe1ab1528a58c3af2534e63078ef69c70837ba07
SSDEEP 768:UOFIcpnJmwgXarfFV3usGGNYeWbhkoFYS/RV:UgniarWhkYeGhkoaeV
TLSH
T116C23A72EC989ABBADE64B8AF71A7A43EFE001A3858859D4DAD91D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 00f636324d71fa018e2e40374d9a4da0fc2449d9012b1509ca2e2ada2d4000ea
MD5 35dc22aa7efa886be044be225a51f7e3
SHA1 0e40414a2a8c8e9b0598da481ce43ca47cae4689
SHA512 e502d6fd2611e6f9e615f23049d55ab2a296eb3b378c130954a172dda4f58584426de250588c9398eca684e7f371cb35448ff3d7eaa0d2203cf93c8ac19bd39a
SSDEEP 768:UOF/cpnJmwgXarMLV3usGGNYedbhkoFYS/RV:U9niarBhkYeFhkoaeV
TLSH
T1A2C23B72ECA8DEB7ADE74B99F71A7A03EFE001A3858859D4DAD91D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 974c8d0585fd1bcee03c74d303d7c84b03f1ed28a5ff08d66b04837897d2ba34
MD5 264a5eef37bbca033032563cda760c36
SHA1 ad224c61b4ae3fb4e75234c86eaf359930552012
SHA512 b343224468d76c656c6dc49293c6471fdced780e3bac325c32569a983ae42fe6a0653e767f50abb349eb6b6da58aa7520f1f288b74e7d9fad925f9c9f09d4d2a
SSDEEP 768:CBFccps3JmwgSK84FV3usGGNYePbhkoFYS/uP:Cls3pK8rhkYejhkoalP
TLSH
T104C24B72ECA8CEABEDE74FCAE75A7A43DEE001A385C859D4DAD91D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d728640851b52daa1399abff7289cd6f2609e349d90864663d1743d8da8760e0
MD5 225894214f4113a3a19fa386ed23d6eb
SHA1 e0a12cc81d4cdb53072947d43fbb4e4e3206c4c8
SHA512 219f097c36020cd72e57d322ee39f75e89f00208658d62689e2988b0012b0e3e599cae726d151b84e6724f67094d920cee6c107f47104b924884b1d89a32f95b
SSDEEP 768:mBFccps38wgQgNyTCV3usGGNYKlhkoFYS/u+:mls3JgNOhkYwhkoal+
TLSH
T1FCB24B36EC98CEBBEDE74FC9E74A7A43EEE001A7859859D4DAD81D0D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 485b3822634f9b559a8a663a0bcc93c90c5b83a567b9b3f9985a77bedd549f6d
MD5 1469237a33d61098ef3c7b4038f36d9b
SHA1 74b4b2aefe23b764568fb25e7b3e2f40b9f2b636
SHA512 72ef1cd9e6792512d770fde510be2551aa9a8eb6db000e979484b6cca452f7b2fbe6d14419862f1b4c6253a7552181cb7161b42850623da92aa36d9d0f2b4782
SSDEEP 768:UBFccpQJmwgDaroFV3usGGNYeKbhkoFYS/RV:UlQOar7hkYeihkoaeV
TLSH
T181C23B72E898DEBBADE64F8AF71A7A43EFE001A385C859D4DAD91D1D00971DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1a9521286a48b1dbf64dd3ebe89a67d3357ae19d6ffa5e3a8eb7b960e73de9b6
MD5 c0e8604953251b430a620cc493968f3f
SHA1 c6ce3ab1cb2a3e0587f0f5f5fd0fcdc6bbf005ae
SHA512 f7675a9409f8663ef79aeb38d454286acde7b41bddf6f0d9dca80d454756413ec1c420f42d0d5d11ed4f7651988128d39f931183a75a4a5af07f48bb84f0c89f
TLSH
T15D3144E159381ED1C4FD0ABFB8C734FC48E9D72AF1A4307E6854D9A80B29A4E658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a820cd1eda7fe985091ff7a402962ecc7ebdab329d80f2a5c5ecb9ae3fa067e5
MD5 cb243e25150f53fd41533c61c42e8718
SHA1 30caad19cf3fde08a144f7168c641ebb46ed78f7
SHA512 edd449d966e3ed7688c92ab21efb87fd59997cd30d9afbd754e8d7cae1549da4322f267a22243ef018986f39048acc8309833d6c5273b7a93ffd0b06c13ce96d
TLSH
T1F73122D2693C1EC1C4BD0EEFE89738FC48D9C229F1A8717A5844DD94072954E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 676ad5241c51d6171d22c8332c4b4b9e3ccef222cee7cbedccb58f97e2ae2a62
MD5 5b2baaff5c1093ee8fad5fcaab15c5ce
SHA1 3e640111c30e7d0e70d1acec7a885e6695e12ec8
SHA512 29f0733a502fcb785cd52a40680608f66290cc3aa67471fcabb88f9d09fbdb2da91fb3ba263068936e14d8b6d287968bf7a81fd9ee569053299d899a107c0167
TLSH
T1F63143E15C391ED1C4FD0AAEA8D734FC44D8C229F1A4307E2854D9540729A0E654543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2cb3ea18f408b2f2e39ca66daa46bbbd831687bff62c02225baee32d3c954ec5
MD5 8738da2c25dfebe06f568c1037618bb8
SHA1 4f101240151bd17c56ca9fa4b921a1ac661239e1
SHA512 3a993bac9643134ca93ac483a6bde92089134f7614578c5740f35d948c806df40533ab1ca4964ab51c1ea3e9782d109b51bad11f45f1b839a2c922236f381f41
TLSH
T1B93123E259391EC1C4FD0EAFE8CB34FC48D9C22AF1A4307A5854D9640729A5E658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2d54702886224d51da8866254ee4fdfbea64fc1985ff651f46dc2531a259d479
MD5 1ccb97915f195066685bf20b5406a1ec
SHA1 bb6176a853e8fe844b84f0017d964c8edc7c8206
SHA512 51e96c45599bd8d959129f40435ef10479ffdc551c979d2138d615e565d18b8a3a98852147b44bbe72addb8e173a8710e1dfb5432196a100820b51f8444d6805
TLSH
T16B4161E11C385AC1C4BC0ABEB4CB74FC85ECC729F5A0307E6C54DA980A29A5D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5af9190481c88e5c774172e4b178ff9c9704e7f1f694f1892eb1299693d63695
MD5 3bef35176f04ebdda0e85e7a4d06d7ed
SHA1 3ffe763cb067294540e582e6ea4bfe04906a7bb7
SHA512 725649f8efe022278bc1bdaf578c308febb0a9925f4c6d374f56c4bd8483b49d6e3493b623f1c2a4adc018df3fdd27505ffe898870f31de51faa6d66f7ed4c67
TLSH
T1823152E269381EC1C4BD0EEFE4C734FC48D9C219F5A8307A6850D964062954E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 63cb26c6851ada90bcbf31d4b2d09743cb62b4b889f87dc05fa3b661546433f9
MD5 1d4805ba2a4f066b699a18a848384efe
SHA1 8571fa64cb673e799aaffd9ac08de49d43401296
SHA512 c7b28da131b6e4d8087fdae057111d006dc4fa59c6a4e94b626ec2b46571ec344716f54cd84d1dbe283467c5cb1eb4f9b940b0c8c6b9c0bc8fdb6490c6cf5ca2
TLSH
T1DC414FE11C785AC1C4BD1ABEA4CB74FC84ECC629F5A034BE6C54DA980A29A5E648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e066c4073f96c047ab0266b84cbeb78cc32c8a80de941b2f466fc1664cabb7e5
MD5 249ed7456f0f2d2ab3382f25fb8eac5e
SHA1 b15c1953b1b7e93390ddf307b5c40ed6834ebbb6
SHA512 876f35511ddea7195ee8ac84eb9061749f6de0964ac5ce4d47fe1102e3284463d7bdd40c43ec12ed9108efa047e74be9600d70a523f9d9c12fb0368c8a151314
TLSH
T1E9416FE15C781EC0C4BD1A7EA4C774FC85ECC629F4A0347E6824EA980E69B1D708583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d0e77c8d13884db84b914e8b76c31a2f03f8aee1e207b1b0bd7055f7b9313c72
MD5 1488659ff3297f483a61f646cb87a101
SHA1 0cf6f45946ac2c852b307fca4de8dbd105ba79ba
SHA512 b0935c3130b3afe25793e2cc0eb8e022e54c28ddffc1add6e824da1a3f893446397813b3b2451e8fbbed613807ec4df9aa199190447841279709a325ab630293
TLSH
T10D4140E15C780EC0C4BC1ABEA4CB78FC85ECC629F5A0347E6C64DA980A29B5D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2c75084f7c46fbdee368c61dae075d607b1a2d42b99617750fad3b7dd64efe79
MD5 b5a485a7b537dafa6914374aafdb5bcd
SHA1 ee01dbd1a0da2694cf050d8e961c73c77aa49e35
SHA512 8810038b148e217e6eef405a783d3a236813c74e5034d80819117f1f0fdb06d0687dd88a79c6ac17b7547b5654336cb736c7b9b00b96c475bfefe00088ca9c24
TLSH
T1FD5160E15C781AC0C4FD1A7EA4CB78FC84ECC625F5A0307E6854EA880E69B6D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bb6d04be65a812d5bb8e0083fe7a7feb229123383028d8e9d3481e70489fe687
MD5 d54bb6ee70d06c76b9090ff671980940
SHA1 015cf0cf378c03d0accec3630c41de5c27053448
SHA512 bb4a3e015085fdea9c5c2690d436667f977c32bd8204a997ba7659c589323f1c2cad9791dd21b3d110e10c0f7a232914c50e0fd1a345baae4510fd7f2f9c17a0
TLSH
T1104162E15C381ED1C4BC0ABEB4C734FC84DCC629F1A4307E6C64DA940A29A4E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 be824087784a02d588cdf012643694b4ab511d24e9e5e375afde72a790173b13
MD5 c2c24c6f85dc1e52d636b59af51d5742
SHA1 902035c531e23d452d8adc641e808421f7ee76e2
SHA512 81530a2efa0c1fa2b1d76d88729c04904001eae2aab189e59d79c7eb8d76443eef7a70e913f49dd7ec8f894d9d9e09be236345f4276e2eab2458ed7e38529434
TLSH
T16041E65CB6F91058B3B7AF1AABF6A86E44BE7C772E06C59D10110D4F0A23A41C971733
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_415908437\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_824330010\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4508_850460988\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download