hxxps://click[.]explore[.]thegreenplanetdubai[.]com/?qs=ABB7InYiOjEsImQiOjQ4ODV9ADMAAAAAADO9X6FmcWVeJX9_aPdnFr_1EePv2xQRFu9JXZBy1IisROauRp3tIuULtuGu-m5a_9b7L-TBFx6Tb7J6Rh_bfBwBvHZlnBwG1m3T584n

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/05/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.explore.thegreenplanetdubai.com/?qs=ABB7InYiOjEsImQiOjQ4ODV9ADMAAAAAADO9X6FmcWVeJX9_aPdnFr_1EePv2xQRFu9JXZBy1IisROauRp3tIuULtuGu-m5a_9b7L-TBFx6Tb7J6Rh_bfBwBvHZlnBwG1m3T584n
Sample260525-ffth1aa19k

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\wallet_donation_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\wallet-crypto.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_585035159\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\wallet\super_coupon.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-tokenized-card\es\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241581930830194"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{11FB6F07-6CD3-4848-A12F-189FEAD6CD79}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4792	2172	msedge.exe	85
PID 2172 wrote to memory of 1964	2172	msedge.exe	87
PID 2172 wrote to memory of 2224	2172	msedge.exe	88
PID 2172 wrote to memory of 2224	2172	msedge.exe	88
PID 2172 wrote to memory of 2224	2172	msedge.exe	88
PID 2172 wrote to memory of 4136	2172	msedge.exe	89
PID 2172 wrote to memory of 4136	2172	msedge.exe	89
PID 2172 wrote to memory of 4024	2172	msedge.exe	90
PID 2172 wrote to memory of 4024	2172	msedge.exe	90
PID 2172 wrote to memory of 4956	2172	msedge.exe	91
PID 2172 wrote to memory of 4024	2172	msedge.exe	90
PID 2172 wrote to memory of 4956	2172	msedge.exe	91
PID 2172 wrote to memory of 4956	2172	msedge.exe	91
PID 2172 wrote to memory of 4020	2172	msedge.exe	94
PID 2172 wrote to memory of 4020	2172	msedge.exe	94
PID 2172 wrote to memory of 4020	2172	msedge.exe	94
PID 2172 wrote to memory of 3100	2172	msedge.exe	95
PID 2172 wrote to memory of 3100	2172	msedge.exe	95
PID 2172 wrote to memory of 3100	2172	msedge.exe	95
PID 2172 wrote to memory of 340	2172	msedge.exe	96
PID 2172 wrote to memory of 340	2172	msedge.exe	96
PID 2172 wrote to memory of 340	2172	msedge.exe	96
PID 2172 wrote to memory of 4528	2172	msedge.exe	104
PID 2172 wrote to memory of 4464	2172	msedge.exe	105
PID 2172 wrote to memory of 4528	2172	msedge.exe	104
PID 2172 wrote to memory of 4464	2172	msedge.exe	105
PID 2172 wrote to memory of 4908	2172	msedge.exe	107
PID 2172 wrote to memory of 2732	2172	msedge.exe	111
PID 2172 wrote to memory of 500	2172	msedge.exe	112
PID 2172 wrote to memory of 1552	2172	msedge.exe	113
PID 2172 wrote to memory of 3596	2172	msedge.exe	114
PID 2172 wrote to memory of 3596	2172	msedge.exe	114
PID 2172 wrote to memory of 5504	2172	msedge.exe	116
PID 2172 wrote to memory of 5504	2172	msedge.exe	116
PID 2172 wrote to memory of 3448	2172	msedge.exe	117
PID 2172 wrote to memory of 3448	2172	msedge.exe	117
PID 2172 wrote to memory of 4472	2172	msedge.exe	118
PID 2172 wrote to memory of 5160	2172	msedge.exe	119
PID 2172 wrote to memory of 5160	2172	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.explore.thegreenplanetdubai.com/?qs=ABB7InYiOjEsImQiOjQ4ODV9ADMAAAAAADO9X6FmcWVeJX9_aPdnFr_1EePv2xQRFu9JXZBy1IisROauRp3tIuULtuGu-m5a_9b7L-TBFx6Tb7J6Rh_bfBwBvHZlnBwG1m3T584n
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc7580c188,0x7ffc7580c194,0x7ffc7580c1a0
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1363260387774347849,9024829453334643800,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,9700357525422008252,4608723089845367203,262144 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,11355938546419014872,10899410733829764946,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14091593353858301441,7684635509647899215,2097152 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13189406078976845733,12393635798508419649,2097152 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5056,i,4345022885628368756,17854411812812555338,2097152 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5252,i,4151995328164192770,8474929850391744422,2097152 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5348,i,15907994479745398953,6264926338616741891,2097152 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6380474113905594476,8576957030158944417,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,3394831199708640220,17129280297370961276,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,15962217431703585667,5878584987552153563,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,15962217431703585667,5878584987552153563,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8233486987055712568,5304037436701497354,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,10300081711445742949,14483657341730515952,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,6185843626301641453,11586971107317192263,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3927628542485166335,14095660705307410071,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2880,i,4737357055364191014,481804437589566036,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,8738818795480370367,13308322343451300065,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5636,i,12312650909120793705,1099516180810470373,262144 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,16890014811718952478,9458567345627292954,524288 --field-trial-handle=2260,i,14620694889878137809,6442049937792932762,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 77ec3f40d94040b3be84e86b6dfa3d7fbf21e90fe188079dd1659a35bb3f0405
MD5 831e58637cdc5fada059c4b1a83db567
SHA1 e4def1961d8a7af31331edc68ecb4cb5d560e3f7
SHA512 555fa7ccdf95ad43a945ad9a964f55efe8c1e9bc090279522db0f8ee2523da857b0c071f031aa0bc05892027154e868edc7c22d0f6b8c95902d6864254ae4168
TLSH
T117F0F9A5CD21AC3718FD1B1830A50B47E76013672B51895B3A3C930C8FB563B868595C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c2babd13993a7e0ddea681d3de56ebf85449a8933b2b0a6d7c64c1bc4d3cbcd
MD5 2e1d9dcca69e78d8e9a9c1b49435001d
SHA1 f4f51e325f666500ff5282473bc1794fc9012584
SHA512 27ca4ee18fef56c613f89b54a25d55ff89cf1875b24da831e84920157afeab8d0064243792f0d12d682741e734e04a623973645ab8156eac0a5374b934aa4e9a
TLSH
T11C517238DEB12B22EF2730B054DD5995353882C3F5A7AF2F9298A5BE263F320407A540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d37.TMP
Size 2KB
SHA256 a8fffcaa29d8cf7363ac6e541c2aed78d21e66345d8e8edc3df3be09c7ff20d4
MD5 541ffef1e55f99c0ca0a7930418360e7
SHA1 9ba807797c2543ee45d66afa9e933770f9c23004
SHA512 c758a170a718e0eb8904c8f9dea5037985ea28919b2911915083a74b9f7dad99228de2a0ec77c2972373b6c7e1c1d28ba2bb6d386e2bdb85e31f28dfa6f3c6ba
TLSH
T1CC518438CEB22620F7331071A0EC52A5327982D3F9A7AFB7E4E5B13D563D7248136044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 426a0681b2ab3f1660b6b4fb73201968ac25ce12484ce543cd09ec7ebe3ce6a7
MD5 27c6388776b6d692b0ccd990d8c86619
SHA1 a0d6b280110699823f29d24c6bb0f05182c798c3
SHA512 e34c284727a08004e4eacb4a3b28651b679de44e303f231bd8f9b30e197ce0e32ab8777e0661a180f79136b7ac14e3dc0eb43c2d49a78794b3054c2949193dea
SSDEEP 192:D1lGcr2QJeZeaebkAxxSaij6vS1e7eRVXRl+6tje/verR3q1/M/w+VDhKRGu+:D1lGcr2QJeZeaebkAxxSaiGvS1e7eXXP
TLSH
T148228FA3C6E4C71DD8115DF47A192E27CD2949A5D228385E8BD8BF0F93D15B2C14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 821ec26c3271b0fabb916f4d6e6c9559e6f1bc152f583b99d0eed32117105fdb
MD5 71110eebb74dada63794c980828e131e
SHA1 a5233d057e04f88e5c2eecf6f052db8d21e37df0
SHA512 99ebf890074a9a4aeb028c864068b3fa20d04e5433b8ba24e634cc2d2d4506edc58ccec3b66d781341fa80986d0d1599012fbfa8199fcdd80f473eaf6a64c311
SSDEEP 192:D1lGcr2QJeZeaebkAxarSaij6vS1e7eRVXRl+6tje/verR3q1/M/w+VDhKBuNKx:D1lGcr2QJeZeaebkAxarSaiGvS1e7eXk
TLSH
T1FC229EA3C6E4C71DC8115DF4BA592E2BCD2949A5D228385E8BD8BF0FA3D15B2C24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d5b501488afd9e8159a86f502594c296a762bb0750eebad95a06e255f311683
MD5 83805ee04b1002759244ca42c590cc96
SHA1 a16a409bd6dbae86d28811df7d9a976dabdaf8d5
SHA512 616537ca32348ead88d8bc29043b8efc1468e3ebc057914a03f536c9c60c45cfd8ac537887233ea72fac2a4f9ac30ab5840ff44441b2a3599240d3994802100d
SSDEEP 384:sxZ/5M1/ftsjQC5rl2zrpHbE/oe0mMjoVScf3S:sHm1/f+QqEJHb2UmkoocK
TLSH
T19772B8576A34497B8CDAE61AF585BF53D7F9056396904E849AFCCB0C00D7AEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 186485443cc8a4fc8de3577bc4f55af059481620778f3edeca4f861b2350d381
MD5 02e99946a1976340f4187cd26dc28973
SHA1 d06dd7a022d5619b4e7a7b1164c0705131cfefa1
SHA512 446c013e99f7e27dac8d7d4e0cd9a7e7c265c7b35adf2e8c142da05eef4b205b956985e7cda21b16b499451002b487ed515166626373e4224e52805980cfa2f8
SSDEEP 384:sxZ/5qy1/ftsjQC5rl2zrpHbE/oe0mMjoVScf3S:sHgy1/f+QqEJHb2UmkoocK
TLSH
T18672B8576A34497B8CDAE61AF585BF53D7F9056396904E849AFCCB0C00D7AEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d4b88d566e648e022cd8fb1ed98799bd703617af66f86e704e5c92169789cbed
MD5 8808d2014c0c7f702975222f67808858
SHA1 95151549ed4ed0a87b0b58e38ee1d5e559f3de45
SHA512 8a4c6691d1e0f5071f262b0681adced722a7b00772a486dffa7c788f47f70f98576bff053a624cd6365262b7b5941ec08ade28f563f057779c6ab6b37739a436
SSDEEP 384:sxZrfM1/fts2BC5rl2zrpHbE/oe0mMjoVPcfjf:sDk1/f7BqEJHb2UmkoFcD
TLSH
T12E72C7566A38497B8CDAE61AF545BF53D7F9056396904E849AFCCB0C00D7AEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 0cec550a3c49114bebbb11eefae41be1480f3b6016d05bd4490b686e156714c8
MD5 ba5b40cd61a0e5e16fd76a0d5d88f01a
SHA1 28d1e4354b265ad466b08a3e832740202e3dbd55
SHA512 410651ae2d991306d6c66aed72c4e454d07b1589798785e5f5a5fa79e32cfd62d36871ef47e8aac79d5c6046c978a3dce8659a65dc586f544410fa21cdc41a15
SSDEEP 768:cFADqyj7pLuLniGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGHSRLl5bKp7ro3:cFADqyVEniGWviq5iu1jafHSRLDmpIUM
TLSH
T1E3F2FB3B6C4CCB7E4F844E9CED2A7E8F6DE8028B5698895447EA840C02C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7bfe638bbe403d30a51f135258654008e2811c9a563ec9080ee4dc4eacdf3b73
MD5 084f979985b56e5601e4c6e5ab41f03d
SHA1 b5f08bd21920bf73822f54ded696c2fe7a6fd137
SHA512 9b8300ab400d4272ff215d771bbbcaa8d3378f34485853840bbaf7aac10940758d2f2b4f726f9e5470b8c4db6e433c5ec1aa52f86c6a1fb9ea63a4efeeaa4ff0
TLSH
T129A0026C45C67051EC8012F4734106892624CF108601278A80B51059DA521B08155040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588da5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588da5.TMP
Size 48B
SHA256 f47eaea2a2be139dd5458316bfc233658c78676408e736d5fd6ff1745dc9f554
MD5 dfc7efa14ec5e9f0cd782fc9b891e4af
SHA1 8095f8c3be41b631f172164627cfc1e0e7dc1a6f
SHA512 a145ab51a83d4518d3cc95691b65f242a4dde1d67012b58dc26b29572f206dc859afb80f9b3817076d00ccf8688d45f5909fa0549ba481e53cc4c6175770a2f0
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 b431d3b14a8816fcb849ec72ae6ae5f13e86b3acc7f9ba6a4f69c766a23d9667
MD5 741337a53a315476554aec22aad171c4
SHA1 2fcefab17a1213c24949c875583f283aac29caa2
SHA512 cba8e03aeff965fd6090e030388301ba1d005e9e8eacfaf4b5606bc781e437dddfedaed3d460a3ea16c8fd03d2ef4c629ddc4d7cf13d4a646bb4eb124474782a
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2s:cVSnNDxZ9l3iZ3QxVl/1hVPEzBX
TLSH
T1D1A25916713A4612387D6D4CB3A68A3B4F4271633418E5AF7FB810B60E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b9837ed4638d34bd92f30e9cb0bd1921e06358c6ec6bf95d5771b17f060d37aa
MD5 89219de58deb43f182fccc3314b92d2d
SHA1 75dc8ac584e51ccd6f0ce0c968a20e8664ec244c
SHA512 ea2603f3b48fae402365e2a99da3f40dfb4d2e95c443cef5789053238e04b07f906d87ee91845a1f3cceb2c3774297da883c5f901ee6a57dd3e6527a721c9385
SSDEEP 384:ndiF9CcmyWCs3sNA8TUNTUlImkrJ1+JCifbZoiZBhkP+lFYS/I1l1F7IgA:UFccps3RwgkloiZBhkoFYS/MS
TLSH
T104B25B36EC98CA7BECE64FD6E64A3A43DEE411B7959899D4DAD81D1C00CB1DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e549abbdb6c89863fdb789d597d68780c8b282b4b477569ec12327ef55473dab
MD5 8324a5a9ece4ec1516a0b2666e40bc52
SHA1 bec566e5df968d3285963661eb6605cdcdbc0bca
SHA512 0f2ee13ab14324a4ff617511cb87b91aa92d1b7a6196d38c30ff26ad7f5ce58f898b80cc325dc9127277e9f77b3705352209e49754fb8a20114310d60efea8d2
SSDEEP 384:n+uiF1tNnNnb963sNm8TUNTUlI4kFJ7zhCifbZoieiLXDqfNcDF7Igtc:IF1jZbY3/wgbtoieiLTiEc
TLSH
T124D24B32EC54CAABEDE75FD5A24A7A439FE452A785885ED4EACD5D0C00C729C130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cc6b1fa0ad5799d3fab35438b34cce6146b7022db91b28e1e6f27d5df40f219a
MD5 da08cf88e982ca71f802e7ae31b15e61
SHA1 a8627f1dd156dc8256e8ca7c4ffc0ce00ed5c1a1
SHA512 943e1e51e4a1d9f2f13e3f6c614361141558947ac8b3e802bb372b182846913bd9cb1ac35cc4f8832c874c0ee9c6f0c96212e5cf72e103ec555438e33e8f0222
SSDEEP 384:n+uiF9CcmyWCs3sNm8TUNTUlI4k/J7zhCifbZoieiL4KF7IgP:IFccps3/wgJtoieiLT
TLSH
T143B24B32EC98CAABEDE75FD6E24A3A03DEE45167C59889D4DAD85D1C00CB19D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8f3df4b6bd465643314ff94c9b35bf1d7a8a975629f4a4f9ed5176d1746e7f88
MD5 0bfd087be3d2d5483ac40186e910af87
SHA1 4425004d8f4fe5dd3cc9c7f813accac48cf093f8
SHA512 824467b1f376e673bf8bafc5b357b85614acff7e5f9b84463cc8fc5f0b7734a661e9da5ecba7ad969b248f257f11a8b19b9f6cf691e9cf740ae824594e5cd52f
SSDEEP 384:n2uiF1tNnNnb963sNm8TUNTUlI4kFJmzhCifbZoieLLXDqfNcDF7Igtc:gF1jZbY3/wgMtoieLLTiEc
TLSH
T102D24B32A854DAABEDE75FD5A24A3A439FE452A7C5885ED4DACD5E0C00C729C130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 42953c5f73cce4e97d86b6bbfe5005e89c70637b499fb110a129c951a27377dc
MD5 fcf1380d43b5075855931177a08f23fd
SHA1 6d4d987a771d43bad45358dc89443d7e073b1b88
SHA512 98b43814805cdde08e99ea010b8e5ca4987890035c842cc8ede47b1bdae776c85dfe53493bd9fd4b56960106f3435232700ad47acc45f733f58ae6e955be8977
SSDEEP 384:n2aiF1tNnNnb9Krl3sNm8TUNTUlI4kFJmzhCifbZoiewLXDqfNcDF7Igtc:8F1jZb0Z3/wgMtoiewLTiEc
TLSH
T123D24C32E854CA6BEDE75FD5A24A3A43AFE452A7C5885ED4DACD5E0C00C729C130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ed981ccdf5211b4454375091a6d80b13fdbb8ca2b8d23e7829502ef34b0b9684
MD5 67e771454449dbb0f09fd3ed54e371cf
SHA1 e275cf7dd0bad6d82d3c28847617c31824a01226
SHA512 82073d0bf17008736920beaa1b3eb909b6a35fb9e3445d0b2472ac4fc5f83ee0a860ed7b7d41d8daa394d66b732ca45e00c6869cc26d4200c22760700660728a
TLSH
T1F04150E15C791AC1D1BE0E7EA4CB78FC81ECC329F1A4307D6858EA850A7962D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1d0f7cb221b84c0bb8598a1b3ad66c1ee89d48d493b62079c1e15c8139c2de11
MD5 11e6a6525c60ec64050e66bf82c2ed0e
SHA1 59f890ac92404f5865fc63a02b10ba5969ba8e8a
SHA512 5d3987c3387b569fcc2868126c7b465534a2e0623d80030c9e272473cb25037226bd80babdbc0106c3908a43c4daddb285b9707ad838cdfb572b23014b545cd7
TLSH
T1814141E15C791AC1D5BD0E7EA4CB78FC81ECC729F5A4307D6858EAC40A7961D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9e4b950aec2b4b3cf3b707ffeacb49beaf3a3c3a8af3f1c3e3c56bcaf7ad19e8
MD5 fc999c7e0672a9f47c17fe7310de1904
SHA1 c015e84ad62aedbee4263b3bad9165ae5f05b6cf
SHA512 416610c558e0058f1541447a779a2d5330aba9888ecb965bd7bb8aa6751921000c63942152d3b4123d6baa0a7f1160c6f07ebf666aa4c6f3146729258ff61470
TLSH
T13A4130D11C791AC1C4BD0E6FA4CB78FC82ECD729F1A4317D6858EA940A7D61D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 28f65a8e93d989e99f26da0ec8464d2ea7e7dd4b2819e6f0f9b1c8f1c15435b1
MD5 b08a0af49cd29a546511aba6fa8e539a
SHA1 de88ebc997381acf9cf29dbd038ea91b04007d9f
SHA512 0cdb6f489687443f194a4a422d3525774fdf5473540fc333a9a06d21b23cb8239ef1252e757c0894dd912d5d9f0b7286bf42595988ec924d69450f69b4a4d438
TLSH
T1C141115DA6E92148B3B36F5AABFAA87D447BBC272B06C59D00110E4F0A76A40C861736
MD5 SHA1 SHA512 TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2172_2102933257\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4908-324-0x000002B6D0C00000-0x000002B6D1C00000-memory.dmp

Download