e207da0ac82972dcbccd976030b34c66182ddc465574553426fe2a31f98df339

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedTiger-Tools-1.0-Beta/Program/OEmailLookup.py
Size 4KB
Sample260623-2jpvwagy21
SHA256 e207da0ac82972dcbccd976030b34c66182ddc465574553426fe2a31f98df339
MD5 a405c20a796d9d12a436a93c90fa5b6c
SHA1 f6059be98a2a5696cef72c4c35d20be5380eb987
SHA512 50c7fcf5cd8df257960b340680f5abdd77d2ce3cb1a84a8fb785a9e6c82d556e5c2ef8b94d6ab335634c58ac3c9769c7e0663ea7b5ad738541f17246c987aafb
SSDEEP 96:xhPibDIRnpmFxIR7IRpSVIReRl4w8ggMTKebp+OeKga1ornTi4:+ApmFxA7ApWAM3kn
TLSH
T1FC81F2189D2024F3AFF6876D346FB1417633B9170E509835BAAC4A840F62A397C716FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
242	discord.com
243	discord.com
245	discord.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_2019009462\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_2019009462\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4672_233306273\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_2019009462\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_2019009462\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_148572841\_locales\sw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5428	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267279701344983"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{05F36135-E55E-4A43-BCEF-28A4ACDE44C1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B8131EBC-595E-492C-96FC-8771929DE83A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	OpenWith.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4672	2568	msedge.exe	115
PID 4672 wrote to memory of 4444	4672	msedge.exe	116
PID 4672 wrote to memory of 5428	4672	msedge.exe	117
PID 4672 wrote to memory of 4160	4672	msedge.exe	118
PID 4672 wrote to memory of 4160	4672	msedge.exe	118
PID 4672 wrote to memory of 4160	4672	msedge.exe	118
PID 4672 wrote to memory of 5240	4672	msedge.exe	119
PID 4672 wrote to memory of 5240	4672	msedge.exe	119
PID 4672 wrote to memory of 5340	4672	msedge.exe	120
PID 4672 wrote to memory of 1792	4672	msedge.exe	121
PID 4672 wrote to memory of 5340	4672	msedge.exe	120
PID 4672 wrote to memory of 5340	4672	msedge.exe	120
PID 4672 wrote to memory of 1792	4672	msedge.exe	121
PID 4672 wrote to memory of 1792	4672	msedge.exe	121
PID 4672 wrote to memory of 5372	4672	msedge.exe	127
PID 4672 wrote to memory of 5372	4672	msedge.exe	127
PID 4672 wrote to memory of 5788	4672	msedge.exe	126
PID 4672 wrote to memory of 5788	4672	msedge.exe	126
PID 4672 wrote to memory of 5216	4672	msedge.exe	130
PID 4672 wrote to memory of 3788	4672	msedge.exe	133
PID 4672 wrote to memory of 3788	4672	msedge.exe	133
PID 4672 wrote to memory of 5128	4672	msedge.exe	135
PID 4672 wrote to memory of 4188	4672	msedge.exe	136
PID 4672 wrote to memory of 1984	4672	msedge.exe	137
PID 4672 wrote to memory of 5628	4672	msedge.exe	138
PID 4672 wrote to memory of 5628	4672	msedge.exe	138
PID 4672 wrote to memory of 1440	4672	msedge.exe	139
PID 4672 wrote to memory of 1440	4672	msedge.exe	139
PID 4672 wrote to memory of 1440	4672	msedge.exe	139
PID 4672 wrote to memory of 4984	4672	msedge.exe	140
PID 4672 wrote to memory of 4984	4672	msedge.exe	140
PID 4672 wrote to memory of 4984	4672	msedge.exe	140
PID 4672 wrote to memory of 4420	4672	msedge.exe	141
PID 4672 wrote to memory of 3304	4672	msedge.exe	142
PID 4672 wrote to memory of 3304	4672	msedge.exe	142
PID 4672 wrote to memory of 6088	4672	msedge.exe	143
PID 4672 wrote to memory of 6088	4672	msedge.exe	143
PID 4672 wrote to memory of 1696	4672	msedge.exe	146
PID 4672 wrote to memory of 1696	4672	msedge.exe	146
PID 4672 wrote to memory of 5396	4672	msedge.exe	147
PID 4672 wrote to memory of 5396	4672	msedge.exe	147
PID 4672 wrote to memory of 5396	4672	msedge.exe	147

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedTiger-Tools-1.0-Beta\Program\OEmailLookup.py
1⤵
- Modifies registry class
PID:1536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffcdba6c188,0x7ffcdba6c194,0x7ffcdba6c1a0
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6360964764561117160,4985461158295506716,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,12717729040214474273,5273156908512533091,262144 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,12889822596650163127,4922891106901507928,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,12675448019228225123,928870021871575928,2097152 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5529171773425778229,4898756508352060247,2097152 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13221802253488781249,2671032639085128825,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3437809502920520121,12246237400685692380,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11113663796503291099,6903820749300390878,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11113663796503291099,6903820749300390878,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,16481979829379548721,4002242483938411388,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,11904296394176784618,13240853356922067657,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,7401495133952954720,9380125179695793485,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1964319900785732725,6298709638868876314,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,11381238388423956753,259212370863758888,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6604,i,6886795722798225296,15796366099110086910,2097152 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5212,i,12196920842993924311,4900255334921933361,2097152 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17782740541969626197,6616941973762831735,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    - Modifies registry class
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,8989385639938682986,535648208777065849,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,1532527594927300587,17770984729931631575,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,3290542575329283623,956559251769799807,524288 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3516,i,1303764478680704794,13915362435833711027,2097152 --field-trial-handle=2352,i,10250704048324800077,6050273673273625839,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_2019009462\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_2019009462\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8271e4913b3fda358f5593b1ff2bb8eec11b0062ca96ea37569b39470ddfc796
MD5 b32af102188a60d00b137ed7ca9a74c0
SHA1 319ce4b7afd2fa165e8bd70363d8844e8d739320
SHA512 162af1ca099df975aabb13c0e155d59a3cf6a20913577c33305e122cc205733785932a873d1e0afbd1095a1b96f0651f3cbd9e462b65df698ddb6c45a7509f47
TLSH
T143E02BA6C862EC2708FD072874098A5BEB0217173740495F7A3C82088FB4A2A45C589C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 381204232dd15d8a8b41f1e85bd702b7645466ac705725b12c7959d3ec0adda9
MD5 4698ae8f98936885e4f12b3f81c598bd
SHA1 7eddc3c81ae436202101ed8458b5d555aee0aa55
SHA512 c55b7f2cc86a3d22f74b0ea1a75d3e77459677fda542667d4be3792a74a161af0e30997fd440e055c9e4d2dd8868f395b29e22db7d35579162854758ded5c307
SSDEEP 48:Yshi34Q7z3MxtvK1xa1kBBa2T0XRr/gNM4XsjWhGdL6rm9:Yso3d7IOva6BXT0XRrX4XGYQem9
TLSH
T1CCA1BA386CB770A3DFD06D3697F20EC42B2306D9F4C25B8774749528E927ACA105AC9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 074334aa6804ed28722cf3294c7a945e224941fd006df3fe2eae076a5e984688
MD5 8b63034706f7227f86e575185e143e0a
SHA1 66f946051f62addb7ae5dd2a3e893179372a9a8f
SHA512 b2dd80511adf0b4d43c4579ad9ca0595e0a450c023a35919dea24ed0e08465f99317dc84070f6770a44bdbb865278b71707a85863b213d40411fdcb5347d5f79
SSDEEP 192:rR3+ygj0aMMPUdvwIej/G4kRcmS+0SM0k7JJkaSsBotnk7DdMt466XGyuvjyUkb7:rR3+ygj0xAUdvwxj/G4k2mSnSMb7JJkU
TLSH
T14932B63458F630E6DB815EB9CAE349D4773341D8F3B35FAA74205238E826F8661D984B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59a31c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a31c.TMP
Size 2KB
SHA256 a0003fde1752182f10d464b71ba1cf4a7abe17accd76469c47a4897fa2eec9f5
MD5 c92c84b9a7eb8d5dc7cb88535daac9f4
SHA1 94a2211bf23d3a956b4ac802e85cbbcea4f72619
SHA512 737156b6540db10b9a6b59bcd6405267a9b8746a096386fbef3d93891af14fb87a89e61ec81f61e268b021bd95c0ed6505f94aa1f971c3bd00d803c0f8435c8c
TLSH
T10F515239395301A7EBE0523657F00F0435768BE8F9E39ECA457824383E3A7198069E9F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 df81b60e1e003038b5ab7b2ff552a9099315bfdaca97afbc621895fc8ece01a3
MD5 848213fb910a18a43f1aaa37c71bda1c
SHA1 a87f5c7d593061f8c8be7604a37751cb937a7352
SHA512 7fc0d14372b518e522c50b08ffe59cec07c58ffe802d46ce20ccd6111dc054995eefa538f291169c92bdc56c204b60ef1470d154520ac04d97489b3c63711b30
SSDEEP 96:D15O1If9ueuEaij6BzB7g5cmOxj36ttw9HOGj9u6fueAulO:D181If9nXaij6B17g5cmOxj36ttAHOG2
TLSH
T100C1ABF7C3E5822DC91195F0AA14BE1FCE290455436C3D6A84E4AF5BA3F2871E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 bca05c480b151c643f20a6cbd2059f7f654724c9ec6e289e7111d54702ca4b97
MD5 f9b163fa7ccc768929af2bee33cd137c
SHA1 f47afcacc48db6f889f7ecc5254e214fcf5fb3ee
SHA512 51a9bd2f3f550106e6c45c33e2f60c83b37c8edae956a8a7d42bdde057e80462568a940888858808e331a34a1f9e7bb33238781fc325b2cbd660d637c2e87223
SSDEEP 384:sxZAn1HMO/fjsJn9zIKY9sfoHbmba/oOv/lN84:si1sO/fen9z9oHbmstnf84
TLSH
T146A2F80366248977CDD7D615FA217F53C7F91462AA914E489AFCCA0C04EEBFD221682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 330aace160f202472c199639d07d8750641e4a3d95e448560e086326a1d035c9
MD5 b8f201840511a098d8976f8f4ebb87f5
SHA1 5f68dd47c69bbd1901269fc7e66b465ee70ad1b7
SHA512 0a05cd38c2d1efbfe1c8f1fdc93473219d917eac453c0e3f89dcf6ebe98d66fb85385b07bf510a4adf3a8b4b7903895d9d5151a7226cc48d116dd0e12c1efd0f
SSDEEP 384:sxZAnqHuOO/fjss/nbazIKY96frHbR/oJvjc84:siq5O/fR/nbazdrHbl+o84
TLSH
T1F592F8026624897BCDD7C619FA257F53D7F90463EA944E4C99FCCA0C04EA6FD221682F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 c55e25ca99e932b58a96e43033ea7c6ca50ec54563175e7456fa3dc731547f37
MD5 bcbef2dfe60fb9b3d5021a4f277c99d0
SHA1 9ca65f4f6c1a6fe46974d966132e588a82a2a5e3
SHA512 ad68c588ec90252b71732c98d7c81eb315d7152dc6c1531a90a9ce0ea33a5f8a0d0bd70b5057c28f045fbcf8968ab25746325c7c39381e7f4f26b32dd7a9aa7b
SSDEEP 384:sxZAn16MO/fjsJn9zIKY9sfoHbmba/opv/lN84:si1nO/fen9z9oHbmsmnf84
TLSH
T170A2F80366248977CDD7D615FA217F53C7F81463AA914E489AFCCA0C04EEBFD221682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 bd09d7931fe8bbe623833ddbda2b8fff4be054c910a8f76ca249862e11ac6ebc
MD5 fd4f6f0d8d7fd3d243026986ad6f8452
SHA1 dd72b418e40c23573154c7b66131b2303e88f2bc
SHA512 0598d1f2457bd31a17dc2a92d343983445925db79d621e7506f1c25a81535579a3bd0696bb41b61927bca295ae6b7bb4110a16466cb8af7aab8edaa943030f5e
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJysy10Lly:eY8Od/HEnFhWvFvmXu1ja5t10Lm2NuSa
TLSH
T13FF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index
Size 72B
SHA256 d1a6e2858dc01be9e82ce586b98807b121d1eec65f3ad8ae2785d0356879ff63
MD5 48d84bf70c102d9a460a46a7fea6f29f
SHA1 acff2ae442f6603bbd145f01812ffcf6794e8f0f
SHA512 bc1201dccdbe1c11439a7bb1a1b6888bed6a4ab07940a060ee4a308d1b002f15ed03e46c841211ba2effc456a837cdfa4db95ed195a869bea6171aca9566c360
TLSH
T12DA0029C51441297C6810B7061B129D66729D8153A6A125165E08596F9A5980410F489
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59812c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index~RFe59812c.TMP
Size 72B
SHA256 4f14fe1fe7c3816bd6f4081f9313e24ea60a120c24e5197c033dadd5e888b373
MD5 a156dbb2ad634b06ce48ae94010103fd
SHA1 fdab10519ab33788c291f113ed1fc244204d9ce6
SHA512 a90f843fbcca3ccd2fde846e1c18b2267407526808d3bb774cbbc2cfa13b68b3755c126a9d08425e47222c41dc98b846f5a6a717955d3880a42af233ba0f1177
TLSH
T1CFA002100240C1C8DB455172304512721610BCE051900FA34AE920989CE50C0B715544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 7d62582274909ca7a2d3dba069f16763716e4bc4d6a6fd7d9bce749c8df8af95
MD5 6a2680f6cf03b992a5095753b2a96d1a
SHA1 51ce6a75e47f1e5edf367982e284be42b3b061e4
SHA512 cc196410cad5e1b0550f5efaf61a592f19e368fe21d1b3ae77b9fe14ceeb0849b997149510abae769857fde0ecb62aeb1e56e3b11212a8225b23c77a5e518d67
TLSH
T176A0027045A51062C2812BFA5593019023A9DC291109830590DD189DC8616E89D51484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe597584.TMP
Size 72B
SHA256 f513ffa9f753177ee210248d6334129589b9bc77238fae628f950d8ec262c1c6
MD5 00118a14c3e2dab2a3919f9f96fc2d85
SHA1 957035ffc6b1451648bae1a8a8d060a51d8d1277
SHA512 3dcb1f9034398f2b804191a5bd10af78b2f21630cc79e1f5b3dd6b3ccb12e6c62d07f0483a14c48e35fe1cf97b23e9a902e922d699b21bacc75f213749a6411c
TLSH
T1D0A0022487648170C5560A7155D18250A30CAC117803574749A204F98E5546D5553484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 313a27cfafd33fb9f0b401e1d0f6d6f61fcefc8ed3e3263ad7de90cf16235de6
MD5 d04618841cef572925372d0a66acb59c
SHA1 10cdf83a16f3d1fdb37875bbb7afdb306e077452
SHA512 4a9b9583e4e7220006ff7b9443cc1e0cb4ea4b42500545f7f7c5656047a5e1ff61484d62a67f2197e3ad206cb607614f632970697720b611609027854a507917
TLSH
T13151B54D5C476B1AECAC257364F604483B79B8EC29888A1365BCA139AC8733919E979C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 bd539266d1acfae9136daee319bca2a38f731ec65bf5ec32b65589fec894d8d9
MD5 28c3c818784446eaac33065e48004c1b
SHA1 68e26742f1e4fce6fa8640c33ed75c9dd479da4f
SHA512 77c313106c7da37d2869aacf3091b0d3ed0527c0ad9e4b9af3a9e936c84724094fb6430071352442f18a2d08a27b8f2cc7052c4e40d9f9980c9dab7d0e73132f
TLSH
T10EA0027142805401C04332FF25D20551729148391B5B22155599005CC8505C04D5616C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5986da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe5986da.TMP
Size 72B
SHA256 29fc6647b468c697b333ca246ced33dd854b9cdb0898f6c76e1b95b044f0e286
MD5 d378d483318900de5f01e0365f5acd1e
SHA1 51b293ce784909d94fb096e8ffb07e32a5255029
SHA512 feb2af31d43724006d2904fa32497fe4f1a61eeaba66188cd4d66fb0720fcfbe662b0a85609e34acbbf6149090904ea4f91a3a455751f5c455863d500ae3db1f
TLSH
T1F2A0021017A0A105C92311F215D282421615C9253100120640A301F8DF50490564311D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 bf3e7067e5419303ab84b9a8ccaa80382511cbceb09534585e800135f8de5058
MD5 06f93f0378bc3f784871f06f9c2e1194
SHA1 d54eac6fcdbd4bed7bebb8dd3f7d626176fe8c74
SHA512 9d83fc0314bca7d1099552528cf382e96183c481cae7e0348086bfdc70feda9e00419dbf44a4d391ead7674f675f1f7887ebf76336875b35163fa17ffbc2d3a4
TLSH
T15DF055B73FFB1810FCABD3DA20316DA0010AB8608894DD1F7427B287A5B231C215ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 f6d89f6c408d7a2db27b6cb11c5d50f8882426e1a1a26924d2b45c733b41739a
MD5 b0447eea58526c0cc2f2f55bd9ecf816
SHA1 752155ac627751486544edd7f5f7678557809974
SHA512 df54aea08d985252eed698f4657b746f783935d53f6a5e5d1e414baf80e7e4b2f0052d117b3f69fa1a1623a1e9d5b1bd1ca881ba76007c647f50cae94ee48763
TLSH
T117D0A7A7F0761E91D76F87835762619DC7907C885888845CA403282D59B0A47E761E57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 1ff6114c15ae565ecf950ce20a4383662c3d5c50405d79b91e562cc3e9ce11f6
MD5 746f589202cb493911dd0443327de010
SHA1 7c993805b572208ba70dc0f6bd2d5365a6d60c31
SHA512 8181d554e2a1210decca730fe57c950da4ea1bc6a2e7dee2794d93f70a57e263b4239c7750b34307af931b6f3d5b906e17d84a3c689c7d1c9222d27ecd44464f
TLSH
T1AFD0A7A7F0791E91D6AF8B82175261ADC7507C885448845CA40308299991A57A691E57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59ef19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59ef19.TMP
Size 138B
SHA256 05c6aeff4391971fbb9a9ccaba0cc0bc9d01dbf78ee05c5029c61815a0389ebc
MD5 2bd6ddd2462655784d6194c2f07df6ab
SHA1 147f1949a0f9f7acf249801608375a5562c54a08
SHA512 ded658d70ef0c923efd93738f64c783df26514d5f44b231d10aec5cb880b3f7547f3565314a876adb017082bcfe75fd3f0a025363a961395c4ef9d43865fb11c
TLSH
T174C08CA3A0210611C71803810222505883012CCC4D8A804CB003381920B4E236209E96
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c3fa33ea463dde6f24fcb0a2f9dc9160a72faa80b8f8487b1d5998504f5cd1e0
MD5 eddd5af15f7f5e69b6d7fd8719adadb9
SHA1 cc1411f9ee436e21d76b4b2a7d46004940692065
SHA512 f16e3c4ace39ec792899795510ca025062c08f42cd3df4c19444471b2ebcbf8eb09b13073d5aa27472c4765ad8e3f3ecf89a9c474800147779730417d1a6b39f
TLSH
T175A00290825B2822E95007B5744656417351CC6111051313E6E4E4D8EC9364061C1541
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d26b0d9ecc02d88740d1e9f0c762c12a76fe3c77d0b9d1491d5a8dcfdba7de5c
MD5 73d4e18b8ac2bb643d68389898269a46
SHA1 c8ccf4e9571ebc36401193d10bb5899b88d8ac86
SHA512 f64fe6765014c3c9d58eaf0c1964ed2499509cc35c459f7a0d1190cf843cec70b07998fab89d1811cb419ab69f1f453380460cd26b2060a8b3d1e7996f70e1e5
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGT:05ppxnY753RNBvRJJdt7p5J99lHv
TLSH
T120B27B5A703A0212397E3948B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e80f51e7a6fe5f2a6de4ddc649b1279623c62650eb5b82bf71e334522c72f54d
MD5 8e47f59d8aea5852714933a89960b856
SHA1 055368fa755bb3b05439f99b6320cc5519b81bb5
SHA512 19bb9c366003898ccda9b3dad88cc3038590fcdba4c362ff678ccc0fd7246e4e2b1807eb750d103d331a2de13c3c328a719eb196b7d9592b3b09d09e7c085dc9
SSDEEP 768:p5Fccps36wgbkU1koGGr7cjGffzI8p0IL9:Ls3s4sMaTI8p0IL9
TLSH
T190B26C36EC58CAB7EDE74F89A75E7A03DEE4122785DC59E8DAD81E0C00971DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3dde2739738f395cf6b541400d8dcc7c2a8c418c840819d6c0083104d92c798d
MD5 4476fdc46404a5d8e07c3d17f54f8675
SHA1 9835408d0348c87af9f0c330dc1fc63c657d10df
SHA512 114909eeed7a988cec226868c2d5d86dc785e8f3e823b82d1657940f0dc4a33e3635b24993f9bce0b61551ef51e71849edabc696aba7035c74c0ee0a9e08a24b
SSDEEP 768:pxFccps3+wgbkUJwoGGr7cjGfkSRTlI8p0IL9:js3QcsManI8p0IL9
TLSH
T14AC25B32E858CAB7FCD64B99B74E3543DEE45227868C99E8DACC1E0C00DB1ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e2d1db4f04444867d7ba3c0b2225e9deae9c611a5eb8548fc2acc5fe3dcb73d5
MD5 341ae9b5859c3f772d745737cea407e5
SHA1 5ad567be7664fa26343a88cae83b30a2065030b8
SHA512 202610ec14970c4768a65442f8eb09924727519d13327e3267c279d03fae03693fdfa968669487066c15cb4a3fc65bb7229d3ba64d42af773a5eb4c95d0a08a4
SSDEEP 768:EF1j+9I3uwgokWToGGr7cjGfkSeTloG0fURe:D9I3HJsMacoG0F
TLSH
T196D23A36D895DAA7FDE74B89B71A3A479EE0426389C85EE8D5CC1E4C00DB1AD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 96c0316dd22892cb3e9bb5a5c1fae0881e7087f28e3c17bd42ecd1c42fa05dda
MD5 dfdf31d3d8742ddf512cbe35a99a1384
SHA1 a1d35aa4850425632be433a65692534da4244636
SHA512 0e430f6d7643a68bb2be39ae6004aeadaebbcb493bc8b2259a0aa78881c387f233effa64d438e12be46e42752df8268427c317c009deedef1eb16165792f42c5
SSDEEP 768:BF1j+9EuwgokwToGGr7cjGfkSMTloG0fURe:A9EHXsMaOoG0F
TLSH
T133E2A2F298D78977E89E4B87673E2D429AFCC25375885998B7C81D0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 18ee2a63cf2383333a965bf85a9fa373a7e62e62804748cc092a83937e93e966
MD5 9c1fe3eb0f4d4005e3da240b9cb70c2c
SHA1 f2a6122e44a336e89173da5bb50733bc3f42fc46
SHA512 b121fe3ae548a562d34d3ddb67def48bc2d4881bb92b676ca044d7b17a163e30c90c77681dae3f8cb03cd4f949ec5efac76291e204d6452030dac6e677ffa055
SSDEEP 768:p4F1j+9I3uwgok3ToGGr7cjGfkSeTloG0fURe:B9I3LesMacoG0F
TLSH
T1E9D23B32E895DAA7EDE74F89B71A3A479EE0426389CC5ED8D5CC1E4C00DB1AD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 14f35ec7b58aed84db5865e482d1758b3ab8f73734f321dc1dfe70f8d6c41133
MD5 1e87c35fd0979dc081ee539945000f40
SHA1 7288cd61033108306bf372e20c3809496f3622fc
SHA512 b1d850e81f53efb8feabfffe937863acd33910ecf4c4c7f8bb2ad0323cd78b870a8330a459fee91325b82c0bc79a6d862d81133f717d03fb7345a671671a0a75
TLSH
T1854141D15C381AE2C4BD0EBEB49739FC85E8D725F1A0347D6898EA940B7D94E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9a5787ee02c250e34cbb9e523944a9790d1f8770295f2b223c6e5d0209cc0041
MD5 ad4a2f1f14784173ffcd9597fe165678
SHA1 819649aa0c0241c5cc90151c53621754e2d86887
SHA512 456e6be3f33f570a3197339024f3e3fe0907a662b062f0758fef5dfc2f11b895e14141d9cae46e6a19024ca9d5aa85ad1b8764a7fc63765c0fe538c7981e6e5d
TLSH
T16141165CAAF91158B3B77E5A9BFB692E487FBD772F07845D10110D8E0623A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads