3ad4541fa87adf218e8fea73ef2fd82bdbb680c62e24a69fc0e896a996503920

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AssetReuploader.exe
Size 6.6MB
Sample260528-cgppnae18v
SHA256 3ad4541fa87adf218e8fea73ef2fd82bdbb680c62e24a69fc0e896a996503920
MD5 0c5af0a726e2d8f541065e07c039fd46
SHA1 18385db5b1fdf720ecca2245314d3297df71e138
SHA512 0877481c6fa066333b99003b66c8c6b6d38d4f16704746b07744c7cb7748c6e9054239b22015851acf8d898f376daf6d6b799b7006adf9ff43adfb7f2a87d849
SSDEEP 49152:UoyGDZszhfoE2Twj79QAnf9+/P12++w4Kwut8SCj9c5EBhYsqMZdq9sHq/grqIns:/qzRo1u7W/P11bEWAs9D
TLSH
T145664A07EC9555E8C0EED23585669263BB717C884F3063D76BA0F3282F76BD0AA79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	discord.com
123	discord.com
124	discord.com
125	discord.com
127	discord.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3276_1215618827\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3276_1822973407\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3276_1822973407\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3596	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244075949509540"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{798B2D03-FE1E-42A1-A282-9A7FEE847D07}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 4076	3276	msedge.exe	82
PID 3276 wrote to memory of 3596	3276	msedge.exe	83
PID 3276 wrote to memory of 796	3276	msedge.exe	84
PID 3276 wrote to memory of 796	3276	msedge.exe	84
PID 3276 wrote to memory of 796	3276	msedge.exe	84
PID 3276 wrote to memory of 4804	3276	msedge.exe	85
PID 3276 wrote to memory of 4804	3276	msedge.exe	85
PID 3276 wrote to memory of 4908	3276	msedge.exe	87
PID 3276 wrote to memory of 4908	3276	msedge.exe	87
PID 3276 wrote to memory of 4908	3276	msedge.exe	87
PID 3276 wrote to memory of 2992	3276	msedge.exe	88
PID 3276 wrote to memory of 2992	3276	msedge.exe	88
PID 3276 wrote to memory of 2992	3276	msedge.exe	88
PID 3276 wrote to memory of 2372	3276	msedge.exe	90
PID 3276 wrote to memory of 2372	3276	msedge.exe	90
PID 3276 wrote to memory of 2372	3276	msedge.exe	90
PID 3276 wrote to memory of 1372	3276	msedge.exe	91
PID 3276 wrote to memory of 1372	3276	msedge.exe	91
PID 3276 wrote to memory of 1372	3276	msedge.exe	91
PID 3276 wrote to memory of 2536	3276	msedge.exe	92
PID 3276 wrote to memory of 2536	3276	msedge.exe	92
PID 3276 wrote to memory of 2536	3276	msedge.exe	92
PID 3276 wrote to memory of 1928	3276	msedge.exe	93
PID 3276 wrote to memory of 1928	3276	msedge.exe	93
PID 3276 wrote to memory of 1928	3276	msedge.exe	93
PID 3276 wrote to memory of 3768	3276	msedge.exe	94
PID 3276 wrote to memory of 3768	3276	msedge.exe	94
PID 3276 wrote to memory of 772	3276	msedge.exe	95
PID 3276 wrote to memory of 772	3276	msedge.exe	95
PID 3276 wrote to memory of 3788	3276	msedge.exe	97
PID 3276 wrote to memory of 3788	3276	msedge.exe	97
PID 3276 wrote to memory of 1112	3276	msedge.exe	98
PID 3276 wrote to memory of 1112	3276	msedge.exe	98
PID 3276 wrote to memory of 4472	3276	msedge.exe	99
PID 4472 wrote to memory of 3808	4472	msedge.exe	100
PID 3276 wrote to memory of 416	3276	msedge.exe	102
PID 3276 wrote to memory of 1088	3276	msedge.exe	103
PID 3276 wrote to memory of 1088	3276	msedge.exe	103
PID 3276 wrote to memory of 2564	3276	msedge.exe	104
PID 3276 wrote to memory of 2564	3276	msedge.exe	104
PID 3276 wrote to memory of 2944	3276	msedge.exe	105
PID 3276 wrote to memory of 2944	3276	msedge.exe	105
PID 3276 wrote to memory of 4940	3276	msedge.exe	106
PID 3276 wrote to memory of 4940	3276	msedge.exe	106
PID 3276 wrote to memory of 1364	3276	msedge.exe	107
PID 3276 wrote to memory of 1364	3276	msedge.exe	107
PID 3276 wrote to memory of 1204	3276	msedge.exe	108
PID 3276 wrote to memory of 1204	3276	msedge.exe	108
PID 3276 wrote to memory of 1736	3276	msedge.exe	109
PID 3276 wrote to memory of 1736	3276	msedge.exe	109
PID 3276 wrote to memory of 1736	3276	msedge.exe	109
PID 3276 wrote to memory of 3096	3276	msedge.exe	110
PID 3276 wrote to memory of 3096	3276	msedge.exe	110
PID 3276 wrote to memory of 3096	3276	msedge.exe	110
PID 3276 wrote to memory of 3952	3276	msedge.exe	111
PID 3276 wrote to memory of 1012	3276	msedge.exe	112
PID 3276 wrote to memory of 3460	3276	msedge.exe	113
PID 3276 wrote to memory of 2564	3276	msedge.exe	114
PID 3276 wrote to memory of 2564	3276	msedge.exe	114
PID 3276 wrote to memory of 2428	3276	msedge.exe	115
PID 3276 wrote to memory of 2428	3276	msedge.exe	115
PID 3276 wrote to memory of 4156	3276	msedge.exe	119
PID 3276 wrote to memory of 4156	3276	msedge.exe	119
PID 3276 wrote to memory of 3448	3276	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\AssetReuploader.exe
"C:\Users\Admin\AppData\Local\Temp\AssetReuploader.exe"
1⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fffdfc4c188,0x7fffdfc4c194,0x7fffdfc4c1a0
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,13462914733022093547,5854406397177177074,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,16421209192382041004,560664457035314945,262144 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,10190236753525139018,6584657053841106536,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:13
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,14814007172274832856,8854663570515226610,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,3434246010764537090,17604785209408832438,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2094764046898416050,11719832132966895843,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,15283003152287043784,10819830053905712906,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4444,i,17804433247227766330,12311186800866949378,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4580,i,14478876374093391131,18068962721196098093,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15737187256318523102,4404093648737126883,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,15855969949262258740,11733244727545726450,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,14401170574173481299,6439367566787405622,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,6419193632710912831,5538853867122517798,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,2958302707837673156,7844423649547090315,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,15429620958352081784,11185060747033824123,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,15429620958352081784,11185060747033824123,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10657502115797839763,17747259678812537905,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15934149065409342900,4744152978850595991,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,12483333796379081579,959499175423596020,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,2523916258802602604,17213124309835040939,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,4238884783276430036,6246382519162082923,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,7055477543360554071,11793935233570978563,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6384,i,13107993431422614478,606276359755511508,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6592,i,12015396717119380246,14604020525089119900,2097152 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4790037766074397006,3924428351770039711,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,476585816218437394,4403741492031712069,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,494833290456880888,12936706987697490893,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,13770113302607977264,405860525994220833,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:12
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,13329022305981192433,13304137703026531106,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,155269866105201250,9549473688963726096,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,8853466257108414263,769660558020150953,524288 --field-trial-handle=2124,i,8290979104699818492,9823727665778651624,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b0f4f0e283eeb3c4e8086b4f09574714a29ac728593fe24b78fa485a02f7c4e6
MD5 40e4e3ea7f3f303decc45667f17df80b
SHA1 1d896c453eda074ed60476a32725c161153ad2f0
SHA512 7e5062046d6cbf9647908f4d956c6ffcf05a20c6b93a582e127b259565b50e651de6e2f51ce32f134320d4ae5e36069b7b87803a59ffe3aea1f2a9b13007a298
TLSH
T18ED0A924AEB258E2E2A4253959D18E003F8C99825A1B299503620C048CE50E38082AC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98ade942a8747b838525fab33e985cdad967132f18099e1927edd4ddcf705c
MD5 f204288b44f873d17a6ceedad1591584
SHA1 24474f57edf00bb3bed673ea9c6fbba1c2d5706d
SHA512 218a8f5b6756a36d75649cbf0e80cab71506f3cef44c8b62b5d9685a2a249d10ca13547cc8a461116e8dbf2c2b9cddc73426ef41d645a31b93a43585aab2d6c6
TLSH
T169D09B30F7995053D1411131DC915F506655499528AB86815331444CE959094E3D7146
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3ad7e0d242c8a415d18419817d9cb34b5c2a6b0e44230984850030db0400f8ff
MD5 271e21184aa9a2b921361a396b79e222
SHA1 1063aa1ecb81697663c28352175e42a006ce93d5
SHA512 27dadf59d2f85b15bbd994e444b024d6c98f3385b1bfa6ced5afceaccd70c778e8cad6ccff5af9ea52b35a254ffc4ffc7cb35aa7bd6c8886c512cf89b6de91a3
SSDEEP 96:zZPskGC7McZEZlY0KxmbALtPdSu9aP4BmAd5H7KU2eyahX70q:VPspZlFA+Md5HmU+ahD
TLSH
T123D198204491FC07DB55487EDCE31AC6272171450E5BDFC2CBA7A4301E6BAE9F143AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 44bf4b16548c6ebc2401b0ff207e6ff0cfc5fbd79490f77b60939fc7ccd86c44
MD5 3914bc739b7d970c5f26869a2ca5cb41
SHA1 658ddb4ae4193c6279e638320b00a97b4f91816b
SHA512 99d5ad8bf6164a3f4876ad6e69c51584cf923be883bfd5215cbc7fa5628432d52f052dad1552a69ac792389999d8491bbcfd669943c468f443dd20387df270ac
SSDEEP 3:MsEllllkEthXllkl2zE/lz:/M/xT02z
TLSH
T1E94402146B800406C50011384451CBD01370E4100A929743659106325D967804D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cb591e13815c5b27a6da7cbb9f20f369a24ebeb25f961e5d17ebb574dea51357
MD5 2749d39168249ae221558ae6a8d92c39
SHA1 b2a4c74f80cccf484781d765b20cb4930a06cdbb
SHA512 603b16e1ee7911005317686d90b8c4ad3ac63db46ce388e7e5f5cb86bbf2e9de0aef802f95e1bbc327858392df6bf820de18bd4a1114917953977fbdc2622556
SSDEEP 192:D1iLHf67fZvsYjOa75kj6VcfA9M/H2TaryUyruY8vrpbuvx:D1iLHf67fZvsYjOa75kGVcfA9M/H2TaO
TLSH
T1ADF19DF3C3E9832DD91156F0AA143E1FCE2D096443683D2AC8E49F5BA7E25B1F141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5b0106887a08e95379eee85d68dc5c9739aef75748bea02053eeea236feedc47
MD5 259117b7d44005e81804641e772e7c5c
SHA1 49dd4ac944312b38d1b635473d408c7420c1612e
SHA512 f1ad32d7301291045f0c814f35f270261f1d419ceff5142b912bf72e901e0756679d66a5587a2ac8948539b86ae4d2a0f7f02c098bd62c57390e57951491564f
SSDEEP 192:D1iLHf67fZvFjOa75kj6VcfA9M/HKGTaryUyruY8vrpb1:D1iLHf67fZvFjOa75kGVcfA9M/HKGTa9
TLSH
T156E19DF3C3E9822DD91156F4AA143E1FCE2D0964436C3D2AC8E49F5BA7E25B1F141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 948439bc8d94c94e3d802423651e9e1455a9ccba76c14db82a79576f51c630f6
MD5 726e4dd6e7f1ccc7bf6c692ae362e9f2
SHA1 c639bf7d4f6f8df678ecfeba119f93decc74df07
SHA512 c247718211cab6e73293ff9b836649836af52bb11a0164036f8733e4f4de32c1c39a2fc25508ecc03160ae4b2f2a6078091b921e1f25f01f5153b0be6fa9c715
SSDEEP 192:sxZ8DUnNRkyM/jK1Ml8M4J/f1sPS7iaSqDHbbfYdpjW/W6+WNBbwXY0oke+TqIg+:sxZVnNagJ/f1sq7/bwi/buX5AqqQt
TLSH
T16482E9126A348977CCCBD619BA257F53D6F81563DA844E4C99FCC60C04EA6ED2313C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6481aff77de1bbfcd49f24dad2f98583fa5136b0abe0c0b444056e1c8305c576
MD5 15e50b0fa73b24ac89aaf0ab4f4443bd
SHA1 ea5a03de19ef1d83b314a397f4d961efb33407fb
SHA512 e0cf6c6c6d034a80822cea7018b55826bc1054c8a56866c4771d7b550e5407e54888a6012740846d4c0910b35d177885eff21a0198b48ea8e71fdfb303984495
SSDEEP 192:sxZ8QUnERkyM/jK1Ml8M4J/f1sBS7iaSqDTbbfYdpjW/W6+WNBwn/Y0oRe+TqIgc:sxZinEagJ/f1so7/Hwi/by/57qqc
TLSH
T11162F7066A34497BDCCBD219BA06BB53D6F81562D6844E4899FCCA0C05E6BED2313C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 950151a377d9a708776493a0cac2cdf64cc8f4d221bdc09720a9bc47c991463d
MD5 0f23db2e6055cca23f0177f722595e12
SHA1 b92a99587c250a54909c3d72bd696f6b27231065
SHA512 071ef53b8acc97b2c1e1166570b41d3e0e98ab413cf420072afe1864d44415d1a9e36aafc1044fe3d82866e0151ff1a1134141167bef77b52ca9b66e52a18d0f
SSDEEP 384:sxZVnNS5J/f1s4WvQz/D01/bPEnXe4Azqkt:s9NwJ/flYQz/i/bP4e4A9t
TLSH
T14992E712653489B7DCDBD619F922BF53D7F81462DA904E4899FCCA0C05EA6ED2313C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 2e3203874e83a45d5f31c7151d7d7d7294a820b55581e98b6a83e7e06ee52b18
MD5 e3c26235f41625f5a14358358940fa49
SHA1 8b531275f82d6186baeb2838097c0cb59bf24ec8
SHA512 e82767ff76a9dbe744a44be0d71d2a6f5cebf70e11b2856bfe92839e79ffde85ab3e1c5010c120b14457f9c4975c47061c24c01e89f193634bc3503604fcf161
SSDEEP 192:sxZ8DUnNRkyM/jK1Ml8MNJ/f1sPSziaSxDHbbfcBdpjxl/W6+WNmYEFqbwXeBT0j:sxZVnNS1J/f1sqz/U0b/bG9XeycqqGt
TLSH
T17782E812693489B7DCCBD619B921BF53D7F81562DA844E4C99FCCA0C05EA6ED2313C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 98fe9b7452c24fdfcf5a01a814cef5cb71612d7bcd1185ed0d76cf23a0b4f5de
MD5 0d16151eb5bd5ae30d411b0fa6d1122b
SHA1 cfe8516efa38a0f99a22004bebe16b921a462560
SHA512 723023598cae769c2f51108f78392d68879fa4f84f5d01e80a66dde79e94f89a9d327ab0a8b93d2f349caeff2f4cac0552a87a07fd3c279d9d273dab51cf7efe
SSDEEP 768:OCc0s8Ww2CA7pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3acvOLlo:OCc0s8Ww2CMEX/fWRm/JQg1u1jaKacvZ
TLSH
T1A7030B3B280CCB7E4F844E9CED26BE8A6DE8018B6698895447FA444C03C76EB55175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 79985162a834e8ff27b230bef49ca02c31fe1f7dd5af3c2086a11765088f4adf
MD5 e63970cfb084b0ef4c05d7099fdc1d1a
SHA1 439fc5217a91721430dbfad20ef77eedcbf4e92a
SHA512 478baa764527a17bff4480a9aa998787b7a155f16eabb5a5f30947aef49577cb93e4c9d14a2ee6defa7d055183fc8a58fbfb2f57dd6d12c5cdbc1c127c2301ee
TLSH
T19BA002941A903201E04A12BE65E7116163605991020ED3A5C5D0004DC8D17465D4505C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 e5b51b434dc64b4e2e05bef65835ccea9b8a33b56bc9842d4baf3a6d48f03794
MD5 f8fc12648485b2dfba4831269c757147
SHA1 fcb64d467d6d9ea71674e00295433598deccd1f5
SHA512 388474a0fbebb3c7c08bc312235599bbb4d36999cc7ac3c8143d61688a0015e83b4d7421f4856b8fe90625c423d80681384601207fcddf291f78aff16529003e
TLSH
T192A0025123905006C85211B22AD202432301CB5011119317459144D9CC525D04D5104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 816B
SHA256 11d6a4288da10f63a3c42f070f60098c8f15c89f487b389f1338deae3de6a973
MD5 af2b7d35ca8a402c01a8733ca13df3fd
SHA1 fbc025f1a68e62bdd66124b203ff8f4ecba1ed48
SHA512 9b4105bec783ce3e384051e81c6978c4e740fc1e18050886f1e6e45904f20506f0d494fc17bfdc9c1d0473f2482b5eea94d6d1561098c05fb1fdf158435acded
TLSH
T1CC014752AED54D1FE945067719B9B0F4B2304DCCD711E633AC3C11331C2534919175CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 3KB
SHA256 29a3b5df88ea07bc182d34f4e0e59eb11aa9676789496fccc96e7ffe0dade79b
MD5 aeaa114ccb2f118f8970a20b77bac4f8
SHA1 b3c73deecc98e019d62e141ff0c03709550189eb
SHA512 205bf8f2ecf4622679609aa24774e31a3ad3cfbdee09b7e7b0c12616ceb6aac8133e1ff1e7425ca6a62dc3faa19cd6729e2724a0bdb7a7b90ab723a2eaf48953
TLSH
T13E51E90D4D4715A6DEA802B190B3184537B955DD3B428E2B48EE1038FCC77AF2C2D635
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe588e51.TMP
Size 816B
SHA256 20ec0a2ddff295c252033753a78bb4133ebcedee60c4955c256beddb58833286
MD5 d4913a935e9bef102c3c5ec4af3a6b1e
SHA1 19646a531c294d8114b0b9b2ed17167814050cac
SHA512 c59b7410baa1fd00056b580299f6fecbc200f3edef0a4b23808aac8941bb77d5f9505bf773a777bc41f78035b5a5fdd5e2aa0490f64398d6d01a62c8c7bbe9b7
TLSH
T10001E1678B924D1FE44811BB1DA5B0F8F2314D008322F7A3A43D253A5C7A7C909070C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b22dddd207ca8327c7dcbdbf320ee9a61119537d014062595ac04b55424f5a66
MD5 5b203d90e777e7e5fa734a81b60cb89c
SHA1 60144f04d716b757d5ec693f7eefbd3484827622
SHA512 96795407e263ff7fcf2bab965d2726781e02bb5eac73466c33bc01012f411546c9a3d5e3ace509caad7c7ae91d9142b5b6bcc46f6332470111e32731219720d4
TLSH
T1C5E020FB2FF75868E9AFE7D614B184F509017C5CD490FE1F606A91C710B1365688BC52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2cdb70430148df5b0bc7437b41df16bf2f25954fef66aa42016f625ba6e0e450
MD5 8aced20c51200c329c9ce63d0c5abba0
SHA1 b42dde7da48099cced3753e86552b36cb1b9882e
SHA512 dea0969c3ab74b5e2c940236c0030b21c696352e73972d133fa3846b82b8400ed2e9d5116cac987214aeb9aadf8b9e25b730b0953c0f436e42a2a51a256a3d33
TLSH
T16FA00223919D3006C641467860476250336049E2831766A1A4E090ADEDD73405152101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e5b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e5b8.TMP
Size 48B
SHA256 94d717944302b1c576c1c11740ff3162f74143289284b553cf9828bab9b58498
MD5 6235fdf68dfb7dd20a40b5c7baea84c4
SHA1 42fd8e6f8dfdb44cb801429c2158ebac8328518a
SHA512 875a488eae202fa42e31d0a8d5a7412861fa18b8d787686d6f5b78b5644c9e0c2192d64d69d22af25638b24cb94856d8012b0d0ec4dfa88f621b15bc51462196
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7b3c9b1c412ed0c97309fe29f150f5bc61327c18ca5cda5e1fab516324dabbe3
MD5 4a87898eb4405f1b0575ea273b378fd5
SHA1 6d2b8cdaff39baf63bf2cee27b1267cba40084f5
SHA512 d28ce9b80819e498b4b9c9964277c0d9f8c2ef7be84fa1e59e7a9186b4bb36369da6002a7df47865a9ce6740b43b59429691fbf746cd49c73143ce5544a94828
SSDEEP 48:KYbIhKYwkTyVZINKqgQ/ygAHkA6SSuQC51IbBdKica3d2PNhsxD:KYbSKYw6WZ+KqgKWRQK5CB
TLSH
T154913B92B0BB22613D3D6519B364B7575A42B1733028647F3B6810B19E2BE214CFDEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a66604c9-a436-4895-9db7-93228fdd40bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a66604c9-a436-4895-9db7-93228fdd40bf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 503f042df62a34f59bdf577fce639c0584ae5483c4a03c0cabd4c68157b67896
MD5 c45aaa91f7a364e025a552b48b117c72
SHA1 c5c2f348f039223948b036be6bff62a5f9f159f7
SHA512 56b5a570c617069483417878e2242345dcbefc63b696d3006d0b7849dbff0a48e78da15d47baeca72a20ae76d5174225d726987d0f7f6c32020efd0a844d865c
SSDEEP 384:yetNnNnb9+8NFUsT17bVYgnUu8Yhusy1Cuq/NOHbgltJeo:LjZbEC7bZUCh1yCB/NO7gvJeo
TLSH
T171927C755839AC63AEE76504F64B32975F78107B9CC42F45DAECAF0D01EB25C230AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dd57bdba31f26662c458e2d99790c5a3073f2295232b38033c9b141548f8e215
MD5 56c1ca5f9bccbf18bad96914271aac69
SHA1 083d0b1ca3c708db3539f39680389856d912931f
SHA512 19e4250dfed2f0a5018b7c2841ea95207f36aaf2b3080661bc0a2ca74f745130ae3aa7b2c37489ee1f2dff9c10d139b67226a140bd3f4c8bd9857e118b13719d
SSDEEP 384:yaiF1tNnNnb9G8N28TUNTUlIlXT17bVYknqDfp/u8Yhusy1Cuu2/NOHbgltJeo:IF1jZb83wgb7bJ8/Ch1yCt2/NO7gvJeo
TLSH
T183D2C4F588D79937E9AE5743A73E6E825EBCC05378881984BBC85E0CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 95745783fa82f7d3c949d563d242682ac0d279139f1cfbf46697a9b2f2560ae4
MD5 dab8d97951bf6c40ba14fed026237f25
SHA1 3cbb546aaae6b18df3b27e897803aab8092c3def
SHA512 831f1706b8fd988d9a01b371b87e67b6c028279c8677dc0e0e0cbfcaf51ded9e49954ea52605b7705d330b5636c7baf3c4528295797160334434c172734a41c5
SSDEEP 768:IFgjZbsbwgb7bTj/Ch1yCfeooffRVFf48srAVO7gvJeo:9wl7W0VfjFgvrAVxvJeo
TLSH
T1C1037EF98CD7993AD9AE6B47673D6D124ABCC137B5A81984FB841B0CCC6217FE306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d67b2d3aefdeb4f664eaf7e61c2c06b1ca9741d5a8d9976bd5828fa0505d6b7
MD5 c5f3b9fb0eba1bf93021c40ac6ea14b4
SHA1 9d93a367fcf9ee4e20321c49f99f6d3b6d4b8015
SHA512 ff5512c4059311e0a649af517d0627c723f0b6cf21a2c43229b9923c9c1ab7ce486251b88212e4fa4b2534272c56023e78ff72abb0364fde9d6f1f5ae817dce0
SSDEEP 384:ybtNnNnb9+8NFUXT17bVYLnUu8Yhusy1Cuq/NOHbgltJeo:OjZbED7beUCh1yCB/NO7gvJeo
TLSH
T1AC926C755839AC639EE76504FA4B36975F78107B9CC42F45DAECAF0E01EB25C230AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e88d7c535871335838fa9026e761e0cc4b3f5fd439abd5a8a3954ce2093c5ad
MD5 b030d1bea3b5ecf7ce59081c750bf5eb
SHA1 1257aaa37bd6ba30bafd22cae8381933041fa5d9
SHA512 cb3fa68ac1eed27329992fc657a162d2039f18c8e02832cf1247f63dce3f6ed38e8d1708376c59b9eeef965b98cb84ad17578e1b044321eb72042ed48e3be585
SSDEEP 192:XGNv6jeQmiUyM0V4SufoPxzY2Sus6f1XSugYxnOMG/V8NU6:XGNv6eqVju8Yhusy1Cuj/NU6
TLSH
T16E12E870986CFC67AEA36554FA8736539FA520379D856F44DAE81F0C00D768C330AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 741e38ac73111ae4bf22bfe756e29c4eb14f709c0b36e843aabfe3e7c35769ef
MD5 550b1236b8c4c6a8b1dc6e847a606e6a
SHA1 9349ad55bfde0bffda4016938269e55d79003bb7
SHA512 02ed25b9e1bcb6a792330a761d4bab1ef6f6800595db724079a66744b87b5ae45e88c43d43eb530e6a489a6a5881fc1bd4f010f4b153cec217bbc123a04db170
SSDEEP 192:XGN+6jCQmiUyBI0f4SufoPxzY2Sus6f13SnMz1U6:XGN+6qq7fju8Yhusy1o61U6
TLSH
T1F102D8356C687C6B9FA36E55FA8737139FA4212BA9952F44CAF81F1C00D768C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

11ba1fc8-0ee3-4d06-84ec-693343a8a46d.tmp

Path C:\Users\Admin\AppData\Local\Temp\11ba1fc8-0ee3-4d06-84ec-693343a8a46d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2542cf99-3b0a-4c9c-b0de-f60058890b00.tmp

Path C:\Users\Admin\AppData\Local\Temp\2542cf99-3b0a-4c9c-b0de-f60058890b00.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_1688748955\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0af9601-a3e7-4ed4-a4d0-8620eb2c2265.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_277645469\e0af9601-a3e7-4ed4-a4d0-8620eb2c2265.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3276_1215618827\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3276_1822973407\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads