1c69674f1ebbf30bdb09b7a5d94f8494795556384ab72cb189a2571581f616d0

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PXL_20260624_175312847‮gpj.bat
Size 69B
Sample260624-ynswjsft5q
SHA256 1c69674f1ebbf30bdb09b7a5d94f8494795556384ab72cb189a2571581f616d0
MD5 367c70c992a4d02d39b25cff654748da
SHA1 430f938f39444097ecf2397a73cc715fc9e1fbcf
SHA512 18739309175a64e4b71b9f470bf075fc5031a52feea8f23a1b465bc4669e79bc0604b5223bb413e2b0a6ac167fb4e60d8084ff37e11d62939b3caa3ff593151f
TLSH
T181A02223C80000820ABC2C80A0C2A808B32E02CFC020AB8FC00280A80CBBCF208CA00A
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_981265004\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_981265004\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_2001295458\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_2001295458\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_2001295458\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_1127087827\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_1451647635\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_1451647635\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1644_2001295458\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268045896613635"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{93D9B798-202F-49AE-9800-9431132F2A96}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{10A60AD2-012D-47E0-BA24-5899F9FB8D38}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1644	1128	cmd.exe	89
PID 1644 wrote to memory of 5468	1644	msedge.exe	90
PID 1644 wrote to memory of 5420	1644	msedge.exe	91
PID 1644 wrote to memory of 2240	1644	msedge.exe	93
PID 1644 wrote to memory of 2240	1644	msedge.exe	93
PID 1644 wrote to memory of 4676	1644	msedge.exe	92
PID 1644 wrote to memory of 4676	1644	msedge.exe	92
PID 1644 wrote to memory of 4676	1644	msedge.exe	92
PID 1644 wrote to memory of 1864	1644	msedge.exe	95
PID 1644 wrote to memory of 1864	1644	msedge.exe	95
PID 1644 wrote to memory of 1864	1644	msedge.exe	95
PID 1644 wrote to memory of 2584	1644	msedge.exe	96
PID 1644 wrote to memory of 2584	1644	msedge.exe	96
PID 1644 wrote to memory of 2584	1644	msedge.exe	96
PID 1644 wrote to memory of 1348	1644	msedge.exe	97
PID 1644 wrote to memory of 1348	1644	msedge.exe	97
PID 1644 wrote to memory of 1348	1644	msedge.exe	97
PID 1644 wrote to memory of 4812	1644	msedge.exe	98
PID 1644 wrote to memory of 4812	1644	msedge.exe	98
PID 1644 wrote to memory of 4812	1644	msedge.exe	98
PID 1644 wrote to memory of 1832	1644	msedge.exe	99
PID 1644 wrote to memory of 1832	1644	msedge.exe	99
PID 1644 wrote to memory of 4672	1644	msedge.exe	100
PID 1644 wrote to memory of 4672	1644	msedge.exe	100
PID 1644 wrote to memory of 4672	1644	msedge.exe	100
PID 1644 wrote to memory of 1872	1644	msedge.exe	102
PID 1644 wrote to memory of 1872	1644	msedge.exe	102
PID 1644 wrote to memory of 1872	1644	msedge.exe	102
PID 1644 wrote to memory of 2012	1644	msedge.exe	103
PID 1644 wrote to memory of 2012	1644	msedge.exe	103
PID 1644 wrote to memory of 4328	1644	msedge.exe	104
PID 1644 wrote to memory of 4328	1644	msedge.exe	104
PID 1644 wrote to memory of 756	1644	msedge.exe	105
PID 1644 wrote to memory of 756	1644	msedge.exe	105
PID 1644 wrote to memory of 6108	1644	msedge.exe	106
PID 1644 wrote to memory of 5640	1644	msedge.exe	108
PID 1644 wrote to memory of 5516	1644	msedge.exe	109
PID 1644 wrote to memory of 5516	1644	msedge.exe	109
PID 1644 wrote to memory of 5388	1644	msedge.exe	110
PID 1644 wrote to memory of 5388	1644	msedge.exe	110
PID 1644 wrote to memory of 4928	1644	msedge.exe	114
PID 1644 wrote to memory of 2640	1644	msedge.exe	115
PID 1644 wrote to memory of 6060	1644	msedge.exe	116
PID 1644 wrote to memory of 5004	1644	msedge.exe	117
PID 1644 wrote to memory of 5004	1644	msedge.exe	117
PID 1644 wrote to memory of 5136	1644	msedge.exe	121
PID 1644 wrote to memory of 5136	1644	msedge.exe	121
PID 1644 wrote to memory of 2168	1644	msedge.exe	122
PID 1644 wrote to memory of 2168	1644	msedge.exe	122
PID 1644 wrote to memory of 1720	1644	msedge.exe	123
PID 1644 wrote to memory of 1720	1644	msedge.exe	123
PID 1644 wrote to memory of 5900	1644	msedge.exe	124
PID 1644 wrote to memory of 2632	1644	msedge.exe	125
PID 1644 wrote to memory of 2632	1644	msedge.exe	125

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PXL_20260624_175312847‮gpj.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/nIcRK4V_Zvc?si=CixAr2MZBAooEZkF
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffa88e1c188,0x7ffa88e1c194,0x7ffa88e1c1a0
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,9095136174689722313,12291103072168545358,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,18305451020551979348,12009841128088649706,262144 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,17430519890032663789,9895527217694906389,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,10333823595535147247,1220420242992161984,2097152 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,14631482795992176291,3759751613780576446,2097152 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8242744268808745326,1000714070741867132,2097152 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16622185330640032977,18077083823527315853,2097152 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14758914068023139589,16070555415082151193,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5320,i,16422327809845241065,17299183070407426151,2097152 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5476,i,8777723488493104867,2127022833654917476,2097152 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,6249374653213232003,8233459360081437961,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,14852495206125154322,14504981574384987834,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,1425075579943601224,15050682347664810794,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:12
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,13338851933695883403,7358602029944277276,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
    3⤵
    - Modifies registry class
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,10898891833762532595,996041466172288538,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,10898891833762532595,996041466172288538,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,15606313136675557685,13722426484655987855,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,12287636108839112926,10692870124012166560,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,16859917746937347847,3497865306268992888,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,7795321528352919522,3707621914666698924,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,10086084669919802170,4974294450890182625,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,7238704598986222316,9493964040101031602,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,14246660299145641999,780440947300457722,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,5393358261622046323,11632464864959608389,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15600426444922610989,15865159343092241060,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7032,i,24958032889304608,2055545200118544991,262144 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,7929043728407014280,3388066335239589688,524288 --field-trial-handle=2640,i,7845011115488326586,2611390345490381446,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
    3⤵
    PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

606534d7-c140-4778-8169-b06d8ccb2ed4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\606534d7-c140-4778-8169-b06d8ccb2ed4.tmp
Size 15KB
SHA256 7f61c6eb2c1ffcfcd1a89bae1d94d0adae12197eb403cba81068e57c734b73ee
MD5 5b13854157ad66af5bdcc9f2c2f0427b
SHA1 dab3ec92b0957ec87f2be8f369f0a1762bb012a6
SHA512 6f1620f4149c89d39c5a1b6331d43c71b77184bb16557470d47058744a62cf3552ee609c325bb194c4029a1a65aded4663fb18f45a7d99038f10123e37e8bb56
SSDEEP 192:sxR1RxyM/jK1Ml8wcx/fEsTGZz9Z4zoA8pFazsc/g6+WNltV/BZ7S4pYJGCIgDcJ:sxR1rCx/fEsTGZzzBy/51/00
TLSH
T1CB72E916693459778CD7D219FA51BB57D2F95433A2D05E84EAFC8B0C00EAEED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b55d8a11788c39d62ed63a065e11418a8719278600a3a995cd66fd5c64f0a9aa
MD5 469f83a7d1a1c08576219e868806aa33
SHA1 045027c540ac78dd4ed170604460414f656676bb
SHA512 ca4d173c26858ab7811107f1a483d0e965e6cfd5b6456068040524712e688fa1b4a682475a8fc40caebdba99b72894176777245e20cf0a612be1ee1d6e4e1ea4
TLSH
T1D981CB91A8D72815DFF0B5B4E0D1249F37FAD09D30275E3B766D737F6506B09A891088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f7e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f7e8.TMP
Size 3KB
SHA256 a482781389eafb39e136ccd5b31765aee540bf0ec234bd4bb92ee7d7c440beb1
MD5 1421cbdf692570b38ece07ead6adbe8e
SHA1 64bfa906840024d017fde260a427b5ec30e17fa8
SHA512 01a9dec391f6092aff34bd3b368a15abb76d39452b77deebce25bcc371d1b538b9bcad1da8df7ae514ab4323b951da359a01a003f00a83646656c10f1fe56ed6
TLSH
T17A61B8D1A8E32819DBF0B1B5D1D1209B37FAD04D31275D3B7BAE73BF6506700A841080
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 329KB
SHA256 3cda6a0ffff65e31a953a1641d1b45e394723a66786ba7ef684ca0003f9e8486
MD5 28d01a4a7ba0d7905d5c651be37916d6
SHA1 c160961c9fe285591700039db1674957886dfa00
SHA512 aa6b903ff3d03edba44eea1f3887a0e7c09ff239127eb1bbdf4c344b7a7cafb2d523a13c81ba4749b1b35f69fcbaff181acd9b25df78f0e5a606921b4b19b579
SSDEEP 3072:7vITP5PrtoULruAHIcBpMwx1VAY3Hgc+TWBcSo9KstwhTigRLoLxRsfVR+:Ibbkx0o
TLSH
T13C64E934A1D572D5A12E837B2F639C07DB7A8AC8971C7099B871FB0D26E77403B90729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 02a65f9315df16f1d972a3c051a91b24d975b4a504921ff8151153cb80037f2f
MD5 ade3f454463f46f5bd960f64e2223388
SHA1 7265a3034b61ea4a0b6ab03c2a0efc0f33e261f3
SHA512 60b5355ed3c6448ebc042b4521fcac93457a08f338800d10e5fc45d759d9442d1c5fdb2bc16f2589676eda962859e2e2e17bc170f5ccd768dcba9eeffbeb0371
TLSH
T1A4E06838C4C9C32F2110A2DA91247B0DE5A7A10E97CCAD561F05C810744614C90AF1A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 556fff8f2ccc12c1efb0ae13a13cc2bee8555b8a47042002c9ab0cbfb6a63767
MD5 39dd45798540e2b9d09c44f4d85db322
SHA1 b552640119dabcdbf96b1e39c07407deffcc6814
SHA512 41465355ff28952c382eaece4167c8df36c561cda4f9eaa67a3f8fa94c1b9a9b15e4d79064b868307300eb3372876283e50ee22723033fe8b8ae7f29ea488c83
SSDEEP 192:DBuJ9WC3+Tlo/r2bHEOCTkeNegt1QYs9o:DBuJ9WC3+Tlo/r2bHJCTkeNegt1QYs9o
TLSH
T1EFE1CCE3C3E8C62DD81116F4AB683D1ADE2D1D6483283D2AC9E5AF4F53E5431E341A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a381961ab5dd532626c475319c89e87d9529fdd28ebe6a50b73082bfae0c2eed
MD5 47af4bc8b8b370d77ab088bd4f66235d
SHA1 9c6e3560410d026164481a1e715630e8212daaae
SHA512 c248c112204f33ca4726bd33825870cfb7bee53b6746ce717342d5aeb1dec388ea1903a2d31707c1de583284db6731e82f0a39cb4e52508b17c46e958fcb4acf
SSDEEP 192:sxR1RxyM/jK1Ml8UQ+cx/fEsTGZE9Z4zoA8p/azsc/g6+WNltV/BZ7S4pbJGCIge:sxR1rq9x/fEsTGZEzB8/51/le
TLSH
T1C272D85659345A778CD7E219FA51BB53D2F95432A2905E84EAFCCB0C00E7EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7069ae03106bb038c85d0ef9bf83473ed671fbe7ca29e6ea865d796d11b5825c
MD5 6187b3fe730c9b78706529fedd63f4b1
SHA1 9914e8c85e27e066100b4c3abe439490d648ae47
SHA512 3caa0cb2c55e906fe6ec2e56ac6020a59855b508eef92a46401c2da23c1dc622d6d29c5ac6839b0d9bc5c593ac42d19e353e473ac6ed49525ccaaf8fa7f5aec0
SSDEEP 192:sxRiRxyM/jK1Ml8wcx/fEsAz9Z4zoA8pFazsc/g6+WNltV/BZ7S4pYJGCIgTJ:sxRirCx/fEsAzzBy/51/0F
TLSH
T1CA72E916693459778CD7D219FA51BB53D2F95433A2D05E84EAFC8B0C00EAEED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 41923c0fea86c937e71712bc22314f6128a9cad8619b35c858ec7a45712f5d8b
MD5 66e152c34a3f8f586bdbca2bd278d66c
SHA1 4e5a98eb94717898aa07a2d8480a7554b4ae1657
SHA512 3e4a28842693455f9d6c72a19d26471ab12baacdb4510cdb5a484a9a43f7c09f5338438fe7ba152be341d8fb319ff9356eb5e18779671e7192735d500bcc74dc
SSDEEP 768:Nmymm/7pLuL7YpWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeJ3LxgBroRLGfz:Nmymm5E7YpWgvHfSvu1jatJ3Ng6RLGeI
TLSH
T14EE2ED3B680CCB7E4F844AADEC25BD9A6DD801CF5A98CD5447EA840C03C6BFB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\670eed9a-fa94-4a1d-933f-69f8c0e3a11e\index-dir\the-real-index
Size 2KB
SHA256 9bcd67c788518f62636683294afb8494e4b02b8a777a2a9ac3146c690f655797
MD5 6abb5de27e96a67d787b9c739c5b07cc
SHA1 a875b86a1dda0a61d11db3589275dea849764955
SHA512 98d5be0dc0b57b1d654db7a8f7a6b56f3ee58830ba9246a3e81c1c7b71fa7321a8e5e2e617607dd63c208d9f17cdd39c0e009bda375a5b5c72afc43d14b0a7d2
TLSH
T17F51424CC890ABAED87561BD29A424F293752C38FC5DC2A28194B1B530136681B47AFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e52b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\670eed9a-fa94-4a1d-933f-69f8c0e3a11e\index-dir\the-real-index~RFe58e52b.TMP
Size 48B
SHA256 cd372136253833b50215a70ad1aba3ca1f25cd9ddd47e25720667015aa094998
MD5 c30a4c15759863931e3292a13ec9ca2a
SHA1 1b883f2281fe68e25b422304cd7e06c8bc7c94c2
SHA512 f3e5015808b9539e942fcbbc2caa4fb2dc4b0fbc2690215d9b89b03255e489f59de33f21c441409495a84b539b001112c2760612414cefa164f489635a6aa67d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 fd3a8a1317225ed5909ff7b8869d81c52f1adcfe193270be008eae2ab52a825e
MD5 56a9b4c81d3b283912671e3a8105563c
SHA1 907df66069b80ca2753cb97703558db5e8d85158
SHA512 67f907e7473466b9dd4b1c2d4d7aa4b368760ca7e830be317706a62005538a65db1e60c2cbb826b9a1a4880521c9073a9dc38858d7f6e42776ee5c90687817db
TLSH
T1D5D023D14630855617729B882074710E960F9C05DC84CCE0598CB0D7387C602C201539
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 c5c024083758b833df6c3a7b75b473bcab143578ae9d20b85abc076b9311d6c3
MD5 3b7b25e4114c141f474af7ab27871eb7
SHA1 b426b310ad600d82b822782c6de2cfd41a2c5cee
SHA512 f1725a69c341f7a941dc98b63a9c6fe390cbee48414c62c31e96c720d98e8816068cbf90521d9df73d0f619ec870e976a7db30c94cb531d9dae70c8966f51794
TLSH
T17AC09BE35A3046D74F35D6C42074665DE70F914DCCC8CCF4585C50472674D134401535
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 7adda294b512393acf975b57abcfdc9398ebb3d18d98312baa52dd55dc0a8ba3
MD5 4d01e487b2988684b66e8f24c81ee3d0
SHA1 c0224c3c554ee442949a2bc52646d155273d226d
SHA512 935f9ccfeed2b21fb11c2a9968068a010983ef06db646b2d8dc68dc9ab8f5b7d1a6abee63b85d3cb20c91b5e24da5abedc85cf8cb3a54506e002a74a1c3f14be
TLSH
T195C09BE35A30469A0F35DAC41078661DE70F914CCCC8CCF4544C50472474A134501535
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588ce9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe588ce9.TMP
Size 137B
SHA256 a5ceecd3abfc93868b472cfc9f55339db8c56ff3218afbba5c0fe0bf925daa24
MD5 f577d1abf5048f527967491ca89d208f
SHA1 cd1cc54c7b516c071143a7793ec782e355b555e8
SHA512 a2276224e4afadf6b242d2b968a6851b9b79d2af80017a305144581d25aec40c5c453c970acef3fcadf49474d2b5063e3ea208d715131416826d478617282691
TLSH
T1B4C092E35A3046960F36AAC460B8664DEB1F9D5ECCC8CCF8A44E708B307C9238505939
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4d5b41838e5d7054b516bc53db52ac71d72d87e5281d4b6f85ebae5bb1ff4716
MD5 a8e6483c9bae99c1cf9794877c74a87e
SHA1 06bb6c9d5253addf1e885c5bc2c6a1669cb49256
SHA512 a8356677c6c9592765d9d554cfa96d0a31b819faaa6cdec6fdcf541cc6013db88590af2c17154b6318e09d4e5f2a991dd26211a65b897f35f7dd2be042c2fdfd
TLSH
T19DA00251865C3645C8084771904E81C5B3505C151106327180A44358CDE0171825A00A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58db96.TMP
Size 48B
SHA256 ae85c75ab06b94cac2f33aa5be40b3af1de211957c36d30436110ea6ca4106d9
MD5 39b0b5c0eea4f52830fe5075b59b32a8
SHA1 91c0ff8b11664fb76ab789e69a85c78413081b82
SHA512 b55c7d3186f88b79968bfaa549d85ab673d2fb2fcb69a730d261b82861a1e21d76eaa1925020ad8f12ab4a4cb0557aeabe3dacae5bc052a6e8a238a87a71863d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cdde20a25ee1bbe3ffeeae8e41e1f01672c3a2d8a211f698f4c3e7085b676165
MD5 6fabca6b2d781e719e136c2fb0a15d53
SHA1 205c8ca364e089cdb2f6e2bd234921bcb960c62e
SHA512 f7ad4383c8751305de511941a3c25e36be51dd74cb5c75c05c81cf3331235d7ef32d7f41256f588cc30f3957a88157139f0b26e41c71aec6dd37263463665c4e
SSDEEP 96:KQFyKWgiKIoKpKkclOS022ND6Hg5KNKhs50NlM0/aW2AWrIUek4:QZnjclOS022x6H2KAs50vM0/aW2AWrI/
TLSH
T10291750475BA264039BDA40882609A2F5A467473305EE86B7BFCB0F61D67E014EFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596c5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596c5c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 029436ae45c60b39789dbdc198f000fd96c5ad14e5e935534b32a8365ac5dca1
MD5 62e07fd1842a20e28180832bc9c179fe
SHA1 44e4f80ae0bfc243048589bd173f0fe510101fa4
SHA512 583b84f8ebd63a25c60e9b854f291c5556aaec8c53d8ac4e5c4b591e40bf71b2642cf771f7ed13f2fd42c76781e3e9aa36e7cdf733a2fcf8144a401e9a1fc486
SSDEEP 768:3jaeqD4MlshiLdMmf3hcfy4faeA7NpespIRM0UmkTziwjgzGQnApXLPQTU:3qcjhIdMo32fTfiQsZ0UmYInKXD
TLSH
T19703BF3698605EB78CB6E68A264376576FB00293C2C43BC8DCEE5E0D41976DC530B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 008e72efb78e4b87d3394b054f0eaf84206ab5b336c3e1d9e977e167b3658a63
MD5 1bfdb3659139bbbb9f7837fa77fa5a81
SHA1 9241d2febea0f9460169e62639d072808576dd77
SHA512 ce6d8bc582c3fcab70837660593a25bac78c3d74b6b4415c96472c546ced70e62b08fa91fb62f0b1c08eca83b6a1e263537a3f5fffd3e69032071cd360426c9d
SSDEEP 768:Ij+9S3GHfy4faifmtnA7NpespIRM0UmkTziwjgzScwn12bfOdvR:X9S3KfTf9fFQsZ0UmY8KySvR
TLSH
T1ACF2AF3198209EA34DFAEA8D7547374B7EE0126395C42A88D8D99F4D44C77AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 5c873c6acb719be8b1f85d6e18f094afe41af3c7a9f774dbc74d240f57bdb908
MD5 50707ad868380daaa3da22d42d143db8
SHA1 d7798bd2cf53e4492496409c96a6cc2bc92e3f07
SHA512 38dbc7b3fc6ed816fbfd253dd3cd91686a3ae20529ec52fe95257abde4e71a1a19e3e0454997d1b520cd96193905b23de2e9f6015117dbfee0d0aa6e13fec6e7
SSDEEP 768:+F1j+943Jwg5Cbcfy4faifmtGA7NpespIRM0UmkTziwjgzScwn12bfOdvR:79439fTf9f+QsZ0UmY8KySvR
TLSH
T1032339F288D38A76D8AE9787673D2E469DFCC163B1841984BBD54D4CCC821BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 fb7ad8655c4e1de0435b1762bb7729d712be72ba99c4b7ec3b2cc94099bbc738
MD5 499e48263a1c8241e285ea0ef0e87ffa
SHA1 8502bb3eef53a1971acc6814cb616a4286d64e1d
SHA512 f44693b2a5255541d943b67be1c57ed13a98f3c2ef1f474773042109ee345b3eb219cd7238a14a6d89eb686f654cf03024db8421fb0757259d1a6edb97907697
SSDEEP 768:Sj+9S31Hfy4faifmtnA7NpespIRM0UmkTziwjgzScwn12bfOdvR:h9S3BfTf9fFQsZ0UmY8KySvR
TLSH
T19DF2AF3198209EA34DFBEA8D7547374B7EE0026395C42A88D8D99F4D44C77AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_1069758397\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download