hxxps://cdn[.]discordapp[.]com/attachments/1375505666495479820/1509216074091200663/test_crypted[.]exe?ex=6a185e7f&is=6a170cff&hm=f8196ed516142f7b13cb6167a0df73cae890ec7b754cc318a9b6f22101b0c14c&

Analysis

user interaction
yes
max time kernel
130s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1375505666495479820/1509216074091200663/test_crypted.exe?ex=6a185e7f&is=6a170cff&hm=f8196ed516142f7b13cb6167a0df73cae890ec7b754cc318a9b6f22101b0c14c&
Sample260527-st9tcsby4y

Score

8^/10

defense_evasion discovery pyinstaller

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	4048	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
3704	test_crypted.exe
4596	test_crypted.exe
1676	svchost.exe
1444	test_crypted.exe
4808	test_crypted.exe
2220	test_crypted.exe
2676	test_crypted.exe
1524	svchost.exe

Loads dropped DLL 21 IoCs

pid	Process
4596	test_crypted.exe
4596	test_crypted.exe
4596	test_crypted.exe
4596	test_crypted.exe
4596	test_crypted.exe
4596	test_crypted.exe
4596	test_crypted.exe
4808	test_crypted.exe
4808	test_crypted.exe
4808	test_crypted.exe
4808	test_crypted.exe
4808	test_crypted.exe
4808	test_crypted.exe
4808	test_crypted.exe
2676	test_crypted.exe
2676	test_crypted.exe
2676	test_crypted.exe
2676	test_crypted.exe
2676	test_crypted.exe
2676	test_crypted.exe
2676	test_crypted.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
94	api.ipify.org
49	api.ipify.org
50	api.ipify.org

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_1501226334\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_1501226334\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_2056552916\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_2056552916\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_654633198\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\test_crypted.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001b00000002b582-478.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4048	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243691857699771"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{A4D9B298-D52C-45B7-A514-9000321420F6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\test_crypted.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3372	WMIC.exe
Token: SeSecurityPrivilege	3372	WMIC.exe
Token: SeTakeOwnershipPrivilege	3372	WMIC.exe
Token: SeLoadDriverPrivilege	3372	WMIC.exe
Token: SeSystemProfilePrivilege	3372	WMIC.exe
Token: SeSystemtimePrivilege	3372	WMIC.exe
Token: SeProfSingleProcessPrivilege	3372	WMIC.exe
Token: SeIncBasePriorityPrivilege	3372	WMIC.exe
Token: SeCreatePagefilePrivilege	3372	WMIC.exe
Token: SeBackupPrivilege	3372	WMIC.exe
Token: SeRestorePrivilege	3372	WMIC.exe
Token: SeShutdownPrivilege	3372	WMIC.exe
Token: SeDebugPrivilege	3372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3372	WMIC.exe
Token: SeRemoteShutdownPrivilege	3372	WMIC.exe
Token: SeUndockPrivilege	3372	WMIC.exe
Token: SeManageVolumePrivilege	3372	WMIC.exe
Token: 33	3372	WMIC.exe
Token: 34	3372	WMIC.exe
Token: 35	3372	WMIC.exe
Token: 36	3372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3372	WMIC.exe
Token: SeSecurityPrivilege	3372	WMIC.exe
Token: SeTakeOwnershipPrivilege	3372	WMIC.exe
Token: SeLoadDriverPrivilege	3372	WMIC.exe
Token: SeSystemProfilePrivilege	3372	WMIC.exe
Token: SeSystemtimePrivilege	3372	WMIC.exe
Token: SeProfSingleProcessPrivilege	3372	WMIC.exe
Token: SeIncBasePriorityPrivilege	3372	WMIC.exe
Token: SeCreatePagefilePrivilege	3372	WMIC.exe
Token: SeBackupPrivilege	3372	WMIC.exe
Token: SeRestorePrivilege	3372	WMIC.exe
Token: SeShutdownPrivilege	3372	WMIC.exe
Token: SeDebugPrivilege	3372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3372	WMIC.exe
Token: SeRemoteShutdownPrivilege	3372	WMIC.exe
Token: SeUndockPrivilege	3372	WMIC.exe
Token: SeManageVolumePrivilege	3372	WMIC.exe
Token: 33	3372	WMIC.exe
Token: 34	3372	WMIC.exe
Token: 35	3372	WMIC.exe
Token: 36	3372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4456	WMIC.exe
Token: SeSecurityPrivilege	4456	WMIC.exe
Token: SeTakeOwnershipPrivilege	4456	WMIC.exe
Token: SeLoadDriverPrivilege	4456	WMIC.exe
Token: SeSystemProfilePrivilege	4456	WMIC.exe
Token: SeSystemtimePrivilege	4456	WMIC.exe
Token: SeProfSingleProcessPrivilege	4456	WMIC.exe
Token: SeIncBasePriorityPrivilege	4456	WMIC.exe
Token: SeCreatePagefilePrivilege	4456	WMIC.exe
Token: SeBackupPrivilege	4456	WMIC.exe
Token: SeRestorePrivilege	4456	WMIC.exe
Token: SeShutdownPrivilege	4456	WMIC.exe
Token: SeDebugPrivilege	4456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4456	WMIC.exe
Token: SeRemoteShutdownPrivilege	4456	WMIC.exe
Token: SeUndockPrivilege	4456	WMIC.exe
Token: SeManageVolumePrivilege	4456	WMIC.exe
Token: 33	4456	WMIC.exe
Token: 34	4456	WMIC.exe
Token: 35	4456	WMIC.exe
Token: 36	4456	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4456	WMIC.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1944	1220	msedge.exe	81
PID 1220 wrote to memory of 4048	1220	msedge.exe	82
PID 1220 wrote to memory of 2996	1220	msedge.exe	84
PID 1220 wrote to memory of 2996	1220	msedge.exe	84
PID 1220 wrote to memory of 2364	1220	msedge.exe	83
PID 1220 wrote to memory of 2364	1220	msedge.exe	83
PID 1220 wrote to memory of 2364	1220	msedge.exe	83
PID 1220 wrote to memory of 1264	1220	msedge.exe	85
PID 1220 wrote to memory of 1264	1220	msedge.exe	85
PID 1220 wrote to memory of 1264	1220	msedge.exe	85
PID 1220 wrote to memory of 2840	1220	msedge.exe	86
PID 1220 wrote to memory of 2840	1220	msedge.exe	86
PID 1220 wrote to memory of 2840	1220	msedge.exe	86
PID 1220 wrote to memory of 1336	1220	msedge.exe	88
PID 1220 wrote to memory of 3328	1220	msedge.exe	89
PID 1220 wrote to memory of 1336	1220	msedge.exe	88
PID 1220 wrote to memory of 1336	1220	msedge.exe	88
PID 1220 wrote to memory of 3328	1220	msedge.exe	89
PID 1220 wrote to memory of 3328	1220	msedge.exe	89
PID 1220 wrote to memory of 416	1220	msedge.exe	90
PID 1220 wrote to memory of 1248	1220	msedge.exe	91
PID 1220 wrote to memory of 416	1220	msedge.exe	90
PID 1220 wrote to memory of 416	1220	msedge.exe	90
PID 1220 wrote to memory of 1248	1220	msedge.exe	91
PID 1220 wrote to memory of 1248	1220	msedge.exe	91
PID 1220 wrote to memory of 3148	1220	msedge.exe	93
PID 1220 wrote to memory of 3148	1220	msedge.exe	93
PID 1220 wrote to memory of 4116	1220	msedge.exe	94
PID 1220 wrote to memory of 4116	1220	msedge.exe	94
PID 1220 wrote to memory of 1088	1220	msedge.exe	95
PID 1220 wrote to memory of 1800	1220	msedge.exe	96
PID 1220 wrote to memory of 1088	1220	msedge.exe	95
PID 1220 wrote to memory of 1800	1220	msedge.exe	96
PID 1220 wrote to memory of 3304	1220	msedge.exe	98
PID 1220 wrote to memory of 4548	1220	msedge.exe	99
PID 1220 wrote to memory of 3304	1220	msedge.exe	98
PID 1220 wrote to memory of 4548	1220	msedge.exe	99
PID 1220 wrote to memory of 4548	1220	msedge.exe	99
PID 1220 wrote to memory of 1684	1220	msedge.exe	100
PID 1220 wrote to memory of 4016	1220	msedge.exe	101
PID 4016 wrote to memory of 2352	4016	msedge.exe	102
PID 1220 wrote to memory of 1440	1220	msedge.exe	104
PID 1220 wrote to memory of 1708	1220	msedge.exe	105
PID 1220 wrote to memory of 1708	1220	msedge.exe	105
PID 1220 wrote to memory of 4948	1220	msedge.exe	106
PID 1220 wrote to memory of 4948	1220	msedge.exe	106
PID 1220 wrote to memory of 4536	1220	msedge.exe	107
PID 1220 wrote to memory of 4536	1220	msedge.exe	107
PID 1220 wrote to memory of 728	1220	msedge.exe	108
PID 1220 wrote to memory of 728	1220	msedge.exe	108
PID 1220 wrote to memory of 5076	1220	msedge.exe	109
PID 1220 wrote to memory of 5076	1220	msedge.exe	109
PID 1220 wrote to memory of 1684	1220	msedge.exe	110
PID 1220 wrote to memory of 1684	1220	msedge.exe	110
PID 1220 wrote to memory of 1684	1220	msedge.exe	110
PID 1220 wrote to memory of 3704	1220	msedge.exe	111
PID 3704 wrote to memory of 4596	3704	test_crypted.exe	112
PID 4596 wrote to memory of 3044	4596	test_crypted.exe	113
PID 3044 wrote to memory of 3372	3044	cmd.exe	115
PID 4596 wrote to memory of 4372	4596	test_crypted.exe	116
PID 4372 wrote to memory of 4456	4372	cmd.exe	118
PID 4596 wrote to memory of 1484	4596	test_crypted.exe	119
PID 1484 wrote to memory of 1676	1484	cmd.exe	121
PID 1220 wrote to memory of 4076	1220	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1375505666495479820/1509216074091200663/test_crypted.exe?ex=6a185e7f&is=6a170cff&hm=f8196ed516142f7b13cb6167a0df73cae890ec7b754cc318a9b6f22101b0c14c&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffd4d8fc188,0x7ffd4d8fc194,0x7ffd4d8fc1a0
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10875571087542862538,7456727134650432878,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16438505703297369762,11781614971193480551,262144 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,5247793423357769431,7459002703860377610,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,13465267500794145669,138924434905783014,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,16975616573313231078,3784879352294167634,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1895415228266480919,17109805464033641785,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,14760411030254634295,3787286990539876316,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4316,i,7884468990269167113,13415290575649537613,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4420,i,2464506822429177841,4864325820821466531,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:9
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,14643635303062580634,7340550594268562682,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,17355270373277330057,6308464112344130982,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,17841046551888184654,59062893584476124,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,11428022491934944598,15336510265213887736,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2714039291949166425,15125830013269681791,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5816,i,6723700028913129666,12731536140296133560,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3272,i,17806236702191949542,2158917235949710633,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,11634881656180962594,13927569207758103068,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10374298491711064863,5174623008682547776,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10374298491711064863,5174623008682547776,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,5333281777346278057,14201464826145875136,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,18078652753801044325,2922378441696647365,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,3922037643850713178,7034348068642926141,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,10571301479750235566,7789961026449147896,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:14
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,8197517321169073717,6825626364781349019,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5868,i,3200647282629954877,4256789325728700625,2097152 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1684
- C:\Users\Admin\Downloads\test_crypted.exe
  "C:\Users\Admin\Downloads\test_crypted.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Users\Admin\Downloads\test_crypted.exe
    "C:\Users\Admin\Downloads\test_crypted.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get serialnumber
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get model
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        6⤵
        Executes dropped EXE
        
        PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,10856506374744008565,3841500009322271027,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,14833054720670071579,4164769233090031171,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,7189266363985717138,14165154535843369308,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,9766120570504568619,12583044971506758663,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,1771114629201939186,1116015803344619621,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3205750755830073991,3784845706913069275,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,3404285680311396551,16645184417627333828,524288 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,11345874457971747115,7465391058137466867,262144 --field-trial-handle=2236,i,16292701433252732727,7504186914308395501,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1204

C:\Users\Admin\Downloads\test_crypted.exe
"C:\Users\Admin\Downloads\test_crypted.exe"
1⤵
- Executes dropped EXE
PID:1444
- C:\Users\Admin\Downloads\test_crypted.exe
  "C:\Users\Admin\Downloads\test_crypted.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber"
    3⤵
    PID:4360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
    3⤵
    PID:4132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model
      4⤵
      PID:4628

C:\Users\Admin\Downloads\test_crypted.exe
"C:\Users\Admin\Downloads\test_crypted.exe"
1⤵
- Executes dropped EXE
PID:2220
- C:\Users\Admin\Downloads\test_crypted.exe
  "C:\Users\Admin\Downloads\test_crypted.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber"
    3⤵
    PID:1072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
    3⤵
    PID:1204
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model
      4⤵
      PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d828057f07dfbe3bfc6a0c4bc579bb4d5e008f5fc9b795e491f3b3aab378ab0
MD5 31c984231d08fea7664088a93e56a734
SHA1 bcc4fabce8df1b3a7f53ee88ab10c86e7574dba6
SHA512 0346d68239833533e19a1ee95fb39250ca928768f5557149e784e844442e98a68b44c0c6bcfb72cae79e95812dcbf9e2252b027747ee13bcace7b908c9cd607f
TLSH
T1C261610A7F520053F711FA70A7ED170B34720595C9CB5E40129484F929B6B72F0EE07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f2a08bda2d539b8268dfec74439fbbb7d022dcc9a9bbb55a1ada1a673ec634b
MD5 01079b869ad8b7dfcfbcd20f0bb83b7a
SHA1 faab51eeefe4b16023e0e467b1cadcbb2e595a36
SHA512 cb633af6ef645e737e6c79482c21575b3b19b667d02aba6c2f2f0455dacd36a994b5c9991cbd9229b7c19bd2fa870022baa38de4c0b3e60ce1c34f7e8fd7ef0a
TLSH
T19B41CDF3C2E8866EC90156F4BB146E1BCE2D0A14532C3D5A88E4DF5B97E2971E14194E
MD5 SHA1 SHA512 TLSH

Submit Download

dffaf58e-2653-4aba-b091-9feb8d1cc569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dffaf58e-2653-4aba-b091-9feb8d1cc569.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8772388ff4c005f4ab84d9afa4e861ca2353b534bbeac538bb73278558c3ace9
MD5 ba791765b1d1f5042cdb5468342bf012
SHA1 50247872fb58e820f70b723c6758010a6191d954
SHA512 3faec4d66121ccec4153efed9ade245fa2bc2b56eadbc292d680b7fc96910a4498ffffbc4920a7f1923b35013892eecfae1de404a200210c66f41f40c55341f2
SSDEEP 192:sxZxRNyM/jK1Ml8Mog/fZXsB+73ijIdpM/W6+WNGY0aVzxIg4J:sxZxZQg/fpsB+DHM/bG5ic
TLSH
T1F152E9066B346977CCCBD209FA45BF53D6F9556392940D44AAFCCA1C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3d64f97883aec9a672802423100fdb1ae8b774089cd9c9c58163ea352cbcae5a
MD5 94e2d6ad133248c1ded9a1acf607eb7b
SHA1 299684b3cef52297decca7e743dade3beb5529ee
SHA512 abd6c5038a175e92ec9b072acbdf8b31cc467780508d52ab73400d8d91caab6818da7ce4dcde8ef0fcac65bbe0b1a1215535bc3f1bb2fc344e2b70486b592090
SSDEEP 192:sxZxRNyM/jK1Ml8UQmHg/fZXsx+7kijIdpW/W6+WNGY0aJzxIg5IJ:sxZxZqOg/fpsx+4HW/bG5UG
TLSH
T19452FA16AA345977CCDBD209FA467F53D6F8547392940E44AAFCCB0C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1f15c1d65d33043646b0f2f38b06b93dfddc8b19fd86a6e2aa72ab4dfe25fa27
MD5 7f3b5e72ad38bebc5dcf31b40fb95370
SHA1 0f42f4e19258992de0fae1dbb9720b037013c59a
SHA512 171247f30258c2cfe5b5b90279eebc8124601383313159d7e3f87dca3feccb4abdcec6498e4d16491a1a0af40c5f74e3d4054de02c9b1a006bc8937e14d0262d
SSDEEP 192:sxZxRNyM/jK1Ml8MHg/fZXsx+7kijIdpM/W6+WNGY0avzxIg5IJ:sxZxZ/g/fpsx+4HM/bG5SG
TLSH
T18B52F906BA345977CCCBD209FA467F53D6F9556392940E44AAFCCB0C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7413c0ebace46cc0fdbe70e62128ff18fc6d3ccddb5960651e7f542e9f07bbac
MD5 d6bde869be3b18ff16c1c2fc05520ca2
SHA1 89398f0204483ce5ce0efe81a631e7318fe2e00e
SHA512 3b571d1a44c90f66f19b84ebce5332a1f86d823e328a9b4dd742743e2369601ebc1efe1611dd319bac0ee39749245d184e6d853f0620bb010331781a7c5256c6
SSDEEP 768:EL/zh8dF2iW7pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3e7JjLlj:EL/zh8dF2i2EXEkWRmEcQXwu1jaKe7JR
TLSH
T1EB031B3F280CCB7E4F804E9CED2A7E9B6EE8018B5698895447FA894C03C66DF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 91aaa36bb3c072631c765dffe7aeb0ee2b57e300029983ae920876052929b96c
MD5 90b7bd139e5bf4f1003825d62db9d32d
SHA1 00a094a8390a6b62bbfcd11a8e0440007cb1b403
SHA512 04dbb54e0015f4a9037899f5b27febbde2a0794b16c68cf243700e3c88989512b55b6cc7a078ac60edbd72d81fe3dbf5e08063a128f6229e3961072d370c2f3c
SSDEEP 96:KEWgKvfN6KmAoiwgKd2GSkKHKefU9YkqW6g2Obz88gKk18SgIM8LyvEJOKMU:2aDbeLd+EJOKMU
TLSH
T1DED1140232BB02523C7F2908E6A597A71B4171637019A53B7BA940B1CDABE354FFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f99fe1d9-5185-4685-98f5-bfd97d8582d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f99fe1d9-5185-4685-98f5-bfd97d8582d2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f25a3c5e5ea725ae7f9830469ba74f3f7c6c5fef2e43d707e72d099064087fef
MD5 1cef8cb5950dcaeb2a990e7a7a97f43a
SHA1 977964ba5948517ff06345b17b4cf30e7aa18796
SHA512 e3037ade9cdea2ed89b5da185fbf078316bb250ab7527aa0ab08958c63b457081e1d6769cc303732c1100040976c9bb88f5c99e7d7c55431e05fca078e5109e3
SSDEEP 384:nrtNnNnb9e8N7Uju6XxGnsbOjdRBSTK3RlUVmp2:rjZbM99asbOjdRBST+R2I2
TLSH
T1DE927B362D342D778FE69A45B94B3713AFFC10AB95852E84D9D85F0F02C769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7f95314159cbb94e9eab4603b263da654b782ac552ba45b53dbf9110534b5693
MD5 c3f4f972e431ffa9cf85f1a7b34e0356
SHA1 02b754c3ec3d35b57f435d89b8cdb3055c854c0f
SHA512 fadcd5b45ecfaee564414482dfe61b2ca944d04758489e274da49453b63351f96ece5cf6f47ab0565a9f38065e7b7450206842d62762c28e6bc05bcb99590247
SSDEEP 384:nrtNnNnb9Y8N7UjukXxGnsbOjdRBSTK3RlUVmp2:rjZbO9PasbOjdRBST+R2I2
TLSH
T10D927B366D342D778FE69A45B94B3713AFFC11AB95842E84D9D85F0F02C769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 c8fc6687583aace958be1cd0be2a218a93b19d086883b59f354d82ad77849db3
MD5 bbe1e7a89952c9f7125fe7939362b2d3
SHA1 5aa9552a2ef2c600cd3d5ff541ff0a31d9547263
SHA512 26e27f429934bf97ec14fb533cb74e9044f8d6731a839a411f882816612e3966d993cbe13a1522ce2da2cb12ba350c36fad374d4145128b2c06c1148865b3649
SSDEEP 384:nCiF5tNnNnb9U8NF8TUNTUlIlPjukSxGtDf4HsbOjsRBSTK3RlUVmp2:JF5jZbu4wgN0tHsbOjsRBST+R2I2
TLSH
T1CCD2A3F598E38A36D9AE4787A73E6E029EBCC15774881980BBC81D0DCD831BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f23dbbdbee17cfd47ae328a2e17d3bb46bd57bd456c2b81eec4ad9d3dc095968
MD5 daaa8eb46b4f83331408cdd066b54c30
SHA1 bcdecafffe388d5cbfaaad07b2d3721bbb321f83
SHA512 aefc12c022e31b335b2fce7464dbd88cc665f9b2190082ccd359689b80b8a930ece54d8343ab0cf53e4fbfde8e4d243d6a07863d86909bb8e68bcbe8b5398ee2
SSDEEP 96:8bqGNkQQsjpfN2dYXOR95ih/cIPURHl8h4otop5T1ISD+BYP6vVjhLcgz0a6OVlz:BGNE6P2UOcQmiUyhIU+qGv0bOvwSpPU6
TLSH
T18602E9356D786CBB8FA2AE45B88737178FD8107BEA952B80D9D41F1C01DB65C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e4be66607bde2c331c966733d8f66f06a2a21bb3bb26c5e4fdf7880ca746e1b1
MD5 b357a46e44d156b2637e36534e3a0c94
SHA1 d64cae865050bc049b1d9c9ae528f9139dc35da5
SHA512 6f85f6abe1236a433ff7cfb9a467238ccffcfff0d452ab5b03e207ea596dac63a6c0157d0f6cffa99580d5e3375a3b065d683f80bb5a67773c7d9fb7e42dce91
SSDEEP 192:BGNG6P2UGQmiUyaE+SGv0bOjUG0BX/ZU6:BGNG6eBbpSGsbOjURU6
TLSH
T14012F7757D786CB74FA2AE45F88773178FE8106BDA962B80D9D41E1D00CBA5C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 385df33f858f20d72c90fcf63c585b887ef088e27f422867711da9859e3a4c50
MD5 1aa94025580db435e91cb1f8669174b3
SHA1 6c0e539ec3a50135ebb3d0122b4e7e38b58cf532
SHA512 479b3415361a523b0dce919555a8cc8fe5af56d29f97f0ac1e30bfb949ee0793ef9bedb26e16c8791b47d8b0f0c5c1533a5106a8001983de14bc8f7685b2fcdb
SSDEEP 384:nltNnNnb9Y8N7PjukXxGnsbOjdRBSTK3RlUVmp2:ljZbOsPasbOjdRBST+R2I2
TLSH
T11A926B366D342D778EE79A45B94B3713AFBC11AB95842E84D9DC5F0F02C769C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0424643b-6281-4405-94b2-45432ff849a1.tmp

Path C:\Users\Admin\AppData\Local\Temp\0424643b-6281-4405-94b2-45432ff849a1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2b1ab985-25ae-4035-b104-83cfd6f47f9c.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b1ab985-25ae-4035-b104-83cfd6f47f9c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\base_library.zip
Size 1.3MB
SHA256 01350481d6ea9735fc3a353a400675766270417148974f3a941a42fdb90276e7
MD5 3da5e278aef55213605115cb8ec8fe58
SHA1 d32c1ae3e06a000b447e03935bdae627cc2e1b08
SHA512 b33c87f02981be456dff095480d395402b4818ecb5bc316c860f39135e483481b2aa9834436bcf9a1205ed5d5c76ccfced7b0bc0476ec14b09ce0a6340ff1055
SSDEEP 24576:TuUFtRpU+LUdRhQeOdP2m2dfX3lbTHo3Dt:TuUFtR2dT/1o35
TLSH
T18A552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37042\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76dea477-238b-49d2-bff0-710d75dce841.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1220_1005553801\76dea477-238b-49d2-bff0-710d75dce841.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1220_1250853878\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 815KB
SHA256 85f9edfab1eea76e51fcc499a0b5c9d747de55c33aeaca6b5649a2e540ac256c
MD5 1635c6023a40be5804de07804aea4c2e
SHA1 fa515411f4758bebeafcac2f988f21313ace0cc3
SHA512 59264ad50c011379c961b8c5a5369ad5f38146e07cf44fdfa661a7fb5ab27508f42c2a3565279874edd1455f4f39c0c321f4da3327a108cc8fa16ab5d0502e6f
SSDEEP 12288:2JqD95+ZFdtmsEESKsPVUgaW70oQCEzkEsT33nnWhvCXz6:+ZsUGaWYBCTEsznnAvV
TLSH
T10105D7247B94AE01E540153E92BE2618D73660F22313AB87370BF7615D44BEEDE6C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test_crypted.exe

Path C:\Users\Admin\Downloads\test_crypted.exe
Size 8.7MB
SHA256 866ee460e5b3f3e81d4ba9179670f4c8a15503292b10875e80b93cbc55327e8b
MD5 c70bd396e8ccbdba9c0b873fd4f04e77
SHA1 5ccf4e33acd85e33d20543a87f118acd1114bd52
SHA512 a99545ecae8273d8cabe85806c62d7fe188b92e33ecf47a66b2dfd069b3afe1c54e47c8c169b5030350bbf45fe36a41c54dfefe2728533980433cfdfb12e2942
SSDEEP 196608:NqqLKmMrsW4gXyTntTFqq8N3t4HsGXqrhpXFSFE7E:NqqLKmMrGtZq5X4HsGXq97SN
TLSH
T15696334892D01CA7ECA3667C4EB7D59593A2F8221732CDEF1791433D2F772904839BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test_crypted.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\test_crypted.exe:Zone.Identifier
Size 224B
SHA256 2d9cfcaaf933e5ca3485fa0828b7cf57cbc9c7d5a4c894464e756432cef5c4a4
MD5 d0abbec121e7b341c8dadb7b09f6f8a5
SHA1 b9b8623d1d12bdbe2a7e707cddf5a8a3774eadc4
SHA512 93fe53375754b824833718cbb4be45bd641702abc3ef0c0dd0e95a2fd16f312ec0ca06d6756dd27407195c3256a4c672cfa619fa396927f7e964bf67982210f2
TLSH
T1F7D02363340445080C4E09CC82D8EA41900DBDD3D94364108108C0E21C4211D339B81B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_1501226334\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_2056552916\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_654633198\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1524-705-0x00000207C8600000-0x00000207C87B3000-memory.dmp

Download

memory/1524-719-0x00000207C8600000-0x00000207C87B3000-memory.dmp

Download

memory/1676-626-0x00000213E2F90000-0x00000213E2FAE000-memory.dmp

Download

memory/1676-694-0x00000213E2FB0000-0x00000213E2FBE000-memory.dmp

Download

memory/1676-613-0x00000213E4400000-0x00000213E45B3000-memory.dmp

Download

memory/1676-704-0x00000213E4400000-0x00000213E45B3000-memory.dmp

Download

memory/1676-693-0x00000213E4400000-0x00000213E45B3000-memory.dmp

Download

memory/1676-625-0x00000213E4400000-0x00000213E45B3000-memory.dmp

Download

memory/1676-612-0x00000213E2EB0000-0x00000213E2F7A000-memory.dmp

Download

memory/1676-673-0x00000213E4400000-0x00000213E45B3000-memory.dmp

Download

memory/1676-526-0x00000213C83A0000-0x00000213C846E000-memory.dmp

Download

memory/1676-656-0x00000213E4400000-0x00000213E45B3000-memory.dmp

Download