945d3bb4d3e3b3476b4a9d30bd158af42b04afe28e3992abcc7e0063f7375a6f

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.jpg
Size 6KB
Sample260703-2tn2bsds3l
SHA256 945d3bb4d3e3b3476b4a9d30bd158af42b04afe28e3992abcc7e0063f7375a6f
MD5 f790d58d7221f5ad419e9e22240c8b4f
SHA1 c092ac2b91fe19e9e87ecafb48eccfbd53aee1b3
SHA512 6442db42d50a72324e413df15d12eb2dcf42b6412f04b0aac50289f093706baff19009f6e55d016d3eefb48509c97c0f7f1dde8b72883444bf2bcc29ec44737a
SSDEEP 192:Tadw1/h3j8puUbhfNdRS+pwfpzL/y2P9g:TKm/hj8puUdldypzL3u
TLSH
T17DE15C6122C1390EFFCA69335063DB706665253154BCC048AE6D6AC3AEFB95988247F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_859206059\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_371861093\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_1909274699\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_1909274699\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_1909274699\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_859206059\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_371861093\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4964_1909274699\crs.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6632	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275927880738978"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{A1B8EF70-C6DF-422A-BDE6-02C80B8C1A3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5376	mspaint.exe
5376	mspaint.exe
6264	msedge.exe
6264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4964	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5376	mspaint.exe
5376	mspaint.exe
5376	mspaint.exe
5376	mspaint.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2856	4964	msedge.exe	94
PID 4964 wrote to memory of 6632	4964	msedge.exe	95
PID 4964 wrote to memory of 4424	4964	msedge.exe	96
PID 4964 wrote to memory of 4424	4964	msedge.exe	96
PID 4964 wrote to memory of 4424	4964	msedge.exe	96
PID 4964 wrote to memory of 7156	4964	msedge.exe	97
PID 4964 wrote to memory of 7156	4964	msedge.exe	97
PID 4964 wrote to memory of 6044	4964	msedge.exe	99
PID 4964 wrote to memory of 5188	4964	msedge.exe	100
PID 4964 wrote to memory of 6044	4964	msedge.exe	99
PID 4964 wrote to memory of 6044	4964	msedge.exe	99
PID 4964 wrote to memory of 5188	4964	msedge.exe	100
PID 4964 wrote to memory of 5188	4964	msedge.exe	100
PID 4964 wrote to memory of 1344	4964	msedge.exe	102
PID 4964 wrote to memory of 3124	4964	msedge.exe	103
PID 4964 wrote to memory of 1344	4964	msedge.exe	102
PID 4964 wrote to memory of 3124	4964	msedge.exe	103
PID 4964 wrote to memory of 3768	4964	msedge.exe	105
PID 4964 wrote to memory of 1476	4964	msedge.exe	106
PID 4964 wrote to memory of 1476	4964	msedge.exe	106
PID 4964 wrote to memory of 1476	4964	msedge.exe	106
PID 4964 wrote to memory of 4796	4964	msedge.exe	109
PID 4964 wrote to memory of 4796	4964	msedge.exe	109
PID 4964 wrote to memory of 4796	4964	msedge.exe	109
PID 4964 wrote to memory of 5688	4964	msedge.exe	110
PID 4964 wrote to memory of 5688	4964	msedge.exe	110
PID 4964 wrote to memory of 5688	4964	msedge.exe	110
PID 4964 wrote to memory of 4848	4964	msedge.exe	111
PID 4964 wrote to memory of 4848	4964	msedge.exe	111
PID 4964 wrote to memory of 4848	4964	msedge.exe	111
PID 4964 wrote to memory of 6808	4964	msedge.exe	112
PID 4964 wrote to memory of 6808	4964	msedge.exe	112
PID 4964 wrote to memory of 6808	4964	msedge.exe	112
PID 4964 wrote to memory of 7004	4964	msedge.exe	114
PID 4964 wrote to memory of 7004	4964	msedge.exe	114
PID 4964 wrote to memory of 7004	4964	msedge.exe	114
PID 4964 wrote to memory of 2412	4964	msedge.exe	116
PID 4964 wrote to memory of 1380	4964	msedge.exe	117
PID 4964 wrote to memory of 5432	4964	msedge.exe	118
PID 4964 wrote to memory of 1220	4964	msedge.exe	119
PID 4964 wrote to memory of 1220	4964	msedge.exe	119
PID 4964 wrote to memory of 4764	4964	msedge.exe	122
PID 4964 wrote to memory of 4764	4964	msedge.exe	122
PID 4964 wrote to memory of 5144	4964	msedge.exe	123
PID 4964 wrote to memory of 5144	4964	msedge.exe	123
PID 4964 wrote to memory of 6264	4964	msedge.exe	124
PID 4964 wrote to memory of 1272	4964	msedge.exe	125
PID 4964 wrote to memory of 1272	4964	msedge.exe	125

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\download.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:6600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UnblockSkip.xml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8914bc188,0x7ff8914bc194,0x7ff8914bc1a0
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,17537258260857217807,18292486289394071499,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,18192770806110177793,5203430073378316304,262144 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,11569418914941578875,4334678755745631010,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
  2⤵
  PID:7156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17894018804776578218,17066395041924960095,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,3450418310639657158,7071857273465500761,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2777505699224823974,12940409199226851917,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8126422061485422357,494377614267193143,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,3012307498847538625,14436898909990730055,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,3012307498847538625,14436898909990730055,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6208,i,17981863558336436150,5027133683954333165,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6832,i,5387428546050534570,9128557657133439727,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6788,i,12472911239475101290,3805925355339891725,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6916,i,11224493132447345239,16701394260937113286,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6976,i,5917131447289338609,16289700933249942767,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3940,i,15863533868308378014,5565727231551248891,2097152 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,17965235836838313931,15366913999896416474,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,9884972749458265863,15619680805705907994,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,14274799417319596880,7484093763080647400,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1228048318359146810,15453926878169678302,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,814045546553805940,2468365536707986106,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,5656084732701488855,6630486123113889798,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6016,i,12597856831735439778,7031101887683540112,262144 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,7695124169931438335,6106858950081843174,524288 --field-trial-handle=2460,i,1202295542058338730,8559353430815718663,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 502324a16067fdb14eaff8047b630c8a8c77d21fc6254d878cec77ada2d02350
MD5 ce9c1d76369aa1b362ca1c2dd88b1a6a
SHA1 a5274eb9e01002472113067541384a35f319a16a
SHA512 6c5bcf7fd15404fbd5ecb9348e66c2728a0080fb298047a059c9cc912a721230193021de50e309b019c240f9dd9840e0079091300452425a489fe21f097a26ef
SSDEEP 96:tC0MGaAB/4x1O8dOM24y+0PnmIq2OGl17thekUDYpAg1P3eYql8C3:tiGaAB/z8UM2n22TlZthekUDYpl1QB3
TLSH
T1A3A1A44A9DB225B1CF3DE9B4D5D2B984337861A604270FE60C39F87CEE273E55C69608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594888.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594888.TMP
Size 3KB
SHA256 2473076f5f55a97ead9d183d7547bcf7d9d0128eaa8494513803886cb7ba2922
MD5 b791698828a87b2e4f2dd4cee6ab4940
SHA1 37d00a5eb58ea477bb86db21d7e99968c71a985a
SHA512 aaf7db68b66972e5892edbc98e8e4c9dca194065623eca1da653d9a340e0ac1cf6e4de0a56137944dba87584d848beb72717cf2e4d8a52304459d5a6bead8b51
TLSH
T1D461C75B9C740971CF3AD0B1E2D178C9B77CB4B241576EF91074F534EC2A78A8C62660
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 16KB
SHA256 5a4ddc3ad48d10385448e2cbfc4227c07ceb3c02f847ad93ecb8aa4b72595d77
MD5 006de0f17707c2399edb111a92bd6c8b
SHA1 eaf4c07a84af19b7e16ff55a5f37d4f4aa2913f7
SHA512 3e90d9aae95939b48a9a41f9dd10e3021a2f4d4e90b921266eb05c39477fb00f34c4d656174cf99d880f671b5ce52e6336e714268355b678363f79b2475a9201
SSDEEP 384:fBuCmvAPtyaeao4OHk+sakrkIkBk0kBkrk5kakGgx7XRkM3MA0im0:JuCmvAPtyaeao4OHsTgx7XRkM3MA0im0
TLSH
T1C772986675F8060DF2BB9FBAA8711BA1487ABE452D00D85D68B0725E8C71F40C973B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 7bda9ded99ab5bf0046fd26abe9ea5999461f5c8c96d7cd33fa7d3cd81a16b55
MD5 09f4730dd9ec490aeb5c363125cb47b4
SHA1 8a50f7d8c698879781388205138b1c7936ca110e
SHA512 4e45178f79e8675c19c0be2e185d81a956ca16e3335e0bcf1394812c0499ac3de3ac7c7f0edcb506e9e5deb03ba3dad4b1700c5abfbf77942336a92552a69821
TLSH
T15CE0D87C89C9C21FA19450D61535BB0996E7770AAB886E464F1DD918B042488F96D1A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 93101b0871ddfbddccda452b5e2dce98375346690b87ded0324abe3c6fef7a79
MD5 a60ac1cf1dd0e562c855afce3039d192
SHA1 031fd7715e8c74b1bc8b5eb4a2b2417dd09a7106
SHA512 af34bcc93fc25fa8d4d044868446398695a569824988073423ccacee076634561492078771fe07fba71268354a401f16193fbc7cb08e94a414a3f4681df8f166
SSDEEP 192:D1th3Qg1uXMNIjhnZij6I1j9vgyoKx2MUT7MOzciu/6GckJ:D1th3Qg1uXMNI5ZiGI1j9vgyoKx2MUTK
TLSH
T172E1ABF7C3E9862DD91191F0EA186F1BCE1C0856436C3D5A84E4AF4BA3F2471E191B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d1cb1d89dba4da0e7c89f3d681b265ff567116170206643f2bdaf26a111a8b2f
MD5 dff67d3d0585c6393b59e344aac8d17e
SHA1 bbc20873a898f96fdd1b3d795d271fed4db29ea7
SHA512 3b1699876cb1f509a6d76b27fbe61446ab6da2a9ad7c378be94cde4dcb43362643b3ee08605b41850db475db8409b12ff9899d345b18ba381d28856f6170681f
SSDEEP 192:D1th3Qg1uDfMNIjhnZij6I1j9vgyoKx2MUT7MOzciu/tc37GJ:D1th3Qg1uDfMNI5ZiGI1j9vgyoKx2MUy
TLSH
T183F1ACF7C3E9862DD91191F0EA186F1BCE1C0856436C3D5A84E4AF4BA3F2471E191B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7ea32689f9f20a37b60a573b4d00703a00fa0a347c85d3bb212a59354b2417a4
MD5 2035a4fc6473ac0be5f08e041f5bc8ce
SHA1 2acb2c0865ecaf07b737839e2e7e406622ad45f7
SHA512 92657e63c30d83cdd3168a7549d1cebc70536bf9fec4123599ce0756508ab81342b94f5ede3e9d791a7d73374dace5861a30294e7c53be2da82a0221ea88790c
TLSH
T181D023A3550830F5559C7ED54075ACCFC73630684C42DFD810E05558193789F07171C1
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b892f72b4d689a0e10f51d2a3149b14b92d268f5cb1aa7e846360c62fc5384f9
MD5 94df181da812db3e6862ef30bd9fb775
SHA1 2cd716b9a84256dded3c1a87f44224bc6d0f891e
SHA512 99cbd68ca8d3514c7abd27a35a27f8ee469a8baf1beadf62b542d8f16dd935fd0c41179205fa2cb323ab12a93699ab3cee23b5cb642c6b038a67dff3fb53b204
SSDEEP 192:sxRlQUnKRryMqZjK1Ml8wHa/fvsp5pTAZUBM9Wsbk06eDmXoA8pXQI/g6+WNPKOO:sxRNnKgxa/fvsj1eUBT0sSB/5P4/Vjj
TLSH
T1E9820A1A6524493B9CD7D219F9867BA3D7FC1123E6905E44E9FC8B0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 025a52a1a7b6cc649983a2a1e632540f3dcc8101f02752d722ecbcd831429226
MD5 90608cea6f369ad17e5f58b6afade8af
SHA1 331b2203f56de5e67d6f7eae2e2971a2309baeed
SHA512 acff32ab9d96a8484c6063253989abb577c5d6a0b049f1b34c90f46e5732b3385d8f4aa96fc6e27e3337b089e6efe0208b21dea0ee92774b372b48c04cd7baf6
SSDEEP 384:sxRNnVgCa/fvsO1eUBEJ0/lu5/594/Vtj:sZVBa/fr1md/59qr
TLSH
T11B920A0A6524497BDDD7C219F981BBA3D6FC1163D6905E44EAFC8B0C04E77ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8b26b44e91424c1000952b59ef6ff8a9c003f5a4912cbbf0661fa721bea5b2a7
MD5 0e8a6aea6a7409b214fa27a21ac536e6
SHA1 8f478c0ebc1bc68f1453d9aae8d15b5f65f66758
SHA512 64fde895a07a27cc21522eaccd708c2c1cb4a7e082f3008a9b9d5a974596f825751d26f5ee5d3fe284ffc997050541abace99f7d848ef08ea16f67a43be35d12
SSDEEP 768:4eOlrA7pLuL7P6WgSYf9S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRFpuOGirocT:4eOlrME7P6WgSYf9Su1jaeFpTG5o
TLSH
T1FEE2FD3B680CCB7E4F80499CED29BD9A6DE802CF5AD8C95447EA440C03C66EF561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ca367c8-912e-4c94-870f-e9cb7e06272c\index-dir\the-real-index
Size 72B
SHA256 a29e8ae5ff53f7f8515a63d988e3a489b3dd1d676976841bd0ffb5280459eaac
MD5 140173bc6120adb29c061e322e767812
SHA1 5c0e2ad2b7248f121ed03bd700ecb5d80bc8768c
SHA512 7d13731f83760612a7662a0f9291203b406ac288a0c0d387ca474fd01144af3dea388b4a38f9188a0b66c2c4b7975e168c4382595b5b576262a84487de140038
TLSH
T1BFA002D591524221E64053B97D5713882A3958105922064186E5A06999F91848142706
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59380e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7ca367c8-912e-4c94-870f-e9cb7e06272c\index-dir\the-real-index~RFe59380e.TMP
Size 48B
SHA256 4e9b20282952e41fb8df32b606fedc2ff636510fc0e64887a153f9bcc6b8a3b7
MD5 652760d48262d96e21f116838e3def1f
SHA1 41300d2e043c35466cce494afe5a60e595c6ed8a
SHA512 2de5e89d6c761fae23d8d59a0aecbac7c555f5a059f62d5f37332b10f55370e486d858b665e63cf5e0c982febf1ec0e31c10b7a96da9d85ae856bd78cfa245c9
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\892b9a56-88d3-4307-8832-03de005ecb6f\4f2277ea2139c475_0
Size 61KB
SHA256 fd67312946e1d5fcdbac10f90cda6311f8a33352ff2eabff78032a3d6ab2cdad
MD5 c1516084fb8ee187a3868eed0c1832b5
SHA1 6ff4bd430a884c1491fa1a8f948158ffde38ea8b
SHA512 7ff362682d6dba4ed2b6bf4a651a9f2f553d40b3824aa816060ccf110607a271fdf051c64fdc4180babfa9e52ceed7dd9e00e97a72e7848da3106fb26fc4a215
SSDEEP 1536:c1nxkgeB+BHKut3JHjvGEs7RONVIqtNRBoDnUaKHHPwqpzGx/H:cvkf+0ghGEEROfFR8/H
TLSH
T13A5319A7A1626036C7AD21D1A49B7F00F12B17561504C9ECF0AC66953F18E8B57B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\892b9a56-88d3-4307-8832-03de005ecb6f\index-dir\the-real-index
Size 72B
SHA256 8571617456a56163b3384487abb20d7c01482ad375f1b35e6427cb144b310a09
MD5 a8e91fe69cd67e646c1a6d80e1f65ec8
SHA1 63a33fdaed9c7cfaa4f91a7461f469d8ae39daf6
SHA512 de3c09875b2e558a0a2004136955b2c2c0e721f03459ea23972b3b9b96d4570ec226ee3ead509baa8af63593877f873b56f23d8cc52b7a9bbaf50891f5dcc88f
TLSH
T1FDA0026201643451C00617B253C601742754ACD50129437690B1045DC9D17E8850104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\baed1163-a8ed-4c5e-b26c-85c50260ee11\index-dir\the-real-index
Size 3KB
SHA256 ba6edeeb1b176469dcfac5796a3fb740a0a92bcd549bb03ff906e5b15b2dd9dd
MD5 c8584d4bef210404eb59df3747305eb0
SHA1 c144f7c622457e1c3831874d8424dbd982f5fa2c
SHA512 cb0f41d9b9df6dab1f11cef2ed4e88f3a01fa4be3b2011c6b43ced0c6fc0882be28f3a062246ae8c4563b3ad0d62c71c0f32688d272e66eb99d539e67356d803
TLSH
T13951C55D8C862A2FDC6D267324FA04C9337928DC2B984F176CAC553CFC8763C19A4369
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592030.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\baed1163-a8ed-4c5e-b26c-85c50260ee11\index-dir\the-real-index~RFe592030.TMP
Size 3KB
SHA256 e90c5a06c1014bfcfa16910f9d78a6068281512247e8b5696d271121b8487c73
MD5 6fd280758e1eff6e1f58f732df29d1ae
SHA1 f27001b26cee37bac5a689a00327083b06b913f7
SHA512 a492d1b2afe22ac19d5adbd3d7cbc3e3517b813cb25d7661fb4ec8db79d3b6ce6d74570301f9a282a2b94d86696667a64d3371b6ee426024ebac8a50e40a36dc
TLSH
T13051B22A9C828A2ADD5441B30AD7089C373EB5209648AE0730FCE53A6CC362D7D68299
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c8a4b5a7-3465-4b85-a330-bf6bc8fed920\index-dir\the-real-index
Size 72B
SHA256 df170a2e54769136fd0a442c7f23f3703bb8499d35f2cf455499a625d56063c7
MD5 02735882d53be446745fa0b34c8bff95
SHA1 302151bf402c16099879b15629374b4c8c30e7fc
SHA512 5f14aab697cae1a6e9216c3d5fe7d72da2e0293f44b557e3d2fae98a17f0e26ef42ec33f1fb0a67d3cca64bf62a6d6fab02a11505ce744f57f3310f404470ec5
TLSH
T11EA002F003B02015C21392F0F7D6415563505E650353530DC59202DCC8557C1814120C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c8a4b5a7-3465-4b85-a330-bf6bc8fed920\index-dir\the-real-index~RFe590e2f.TMP
Size 72B
SHA256 f67e80534241ece88372c1948654b498039a15853d0de45a990eda598040e38b
MD5 194dd061eb3bb463691cd901f7c69b17
SHA1 c3dc112ef5578b603b4a1521a3efee83a2aae312
SHA512 c28c94d52efad10031b0383fdc4395a6814a8cee7a6893c069ff5bf6a02601cd996c3d11e89e61531b985173ea65912f67936cd9e6a76cc1dc527ef473b2eb89
TLSH
T100A0021007E08615C01261B11552C651B6808810A100531FA0D21089CCA09C14A8540C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 e96e90b5ce53ac19f36d625e5382a1c2588ee4bc273b428acf23f0334b5de68d
MD5 8e76eec43b8f815269994f2b360c4439
SHA1 de30517679a5fd9866890ab693fdb2c0bd752a53
SHA512 23d4b21d3d77a598daf49df9b0fde33317db3ce1b23e455c0d566f4d400672a9ac7014149c119702a4266a83b0f90ad13da4eadc6efede6072567870bb491a00
TLSH
T1EFF05C7B3EF31844BCEBE7E618B1947215067454C5A8EC6F116A724350B3228344BCA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 ddc26d2c012098b882bf3841577e0124891a5a545d9d15244b7984a61829806d
MD5 d08aa0abb51a11e8c514596f120ede35
SHA1 c40389dedf7aff3be53e90c5f15c55d6cb549781
SHA512 15102ec68704788119395b81212b19fa9bb751b26735e57865b410a03509e325563d472bab8c2566eb1bfab5d4a6e7c81602da18a4f2fe2aef1c6f6f59da2c19
TLSH
T1B1F0277B2EF31944BCDBA3E658B194A104053C54C595EC1F116AB253A0B2225250ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3ef4df69d2a7e8181ff8ee95e4207877684b45b6ba242401191952528e567d5a
MD5 a2f696bc7ab87a399fe3833a858f921d
SHA1 fa7e69461415964465f4ba7589cf29f2b6db91c1
SHA512 a8704dbd63a9f0ad44936712da212810756e0aa0cbc16df0a22ec03acd386030f567711c7ba1889f6db5ae43b7027b852c4a6d22809653be3793e0242cf50c7e
TLSH
T193A002A5C2AA0891E0051775B4D51185A250CC155715631757B8056CA9BB1808693565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591c19.TMP
Size 72B
SHA256 7e3a4b10e357fa195c49c323e6965419789159d27d4d3ee3bfb0e6fe7af20155
MD5 d1cc6e66cae8ba0761c93a890db71e0f
SHA1 c05ff7763afbca3dfb576e15a46195204d60724f
SHA512 9ea7cbe3ecfe378b6ceb9cb592c4ffba4d027fad5c440204235470b4d1f0a8a0dfabaec2ebff624f3e65db5140527248670e4102070d079a8c526418b74d3ec7
TLSH
T119A002F4C39F5D41E40025B1300536402340E9510100130B4AA0E099ED930D15E42121
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 708a10a995ff25121b0635bb9ae8b5c28222c7fb68f7a55879bf477edc423b75
MD5 93ec33e3370caea3809ae68612a9bbb1
SHA1 4e55c707147fe70003f76028ab81957fc41d806b
SHA512 f37470dba3a132e1d6fc6e686febaaafc3bad7d999f0ae6d0532c8b0b7d6d45d7c1d6b97a27e4a19ba83e7fb13178e0696e18a3a13b27fbb4ffe45c5de651019
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931Iw:UVI1zrZi+JK9ALXEgd/
TLSH
T1D4B27C5171BA1701383D280E93B9942F164630E230EEA97B7B6931E56F67E004FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf5d94ea-4ad9-4e60-9c7f-c9836fd43ea5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf5d94ea-4ad9-4e60-9c7f-c9836fd43ea5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57196843d83eda4ba9277faaf7c6b511e8ee1118e29b6147b315a77d74265045
MD5 68c829451725c708805820d7a68b6452
SHA1 da9347558a79020d245059c0fee5757cbc5122cd
SHA512 e2e46b832d13413f60bc261d0dd89845cebd9f3b29b6bea67f5c370971e7b14fd8c648c77c1680fbb80a295316ef07eccabb1cb71f516adfa761863c1f4c8a55
SSDEEP 768:wF1j+9KJwgSAevn9FGcNZW+dBwtAmn12bfJLt:d9KqpZlwu0yJLt
TLSH
T119C24A36D894CA77ACE78FC9B74A7646EEE1026781CC59D8DAD84D0D01D72DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 994f4988427ad490463e63e25980b1805698df6dff3806fa061d85dcdd30d6e1
MD5 38e60ad2c3f3a5453a3d0197959461a8
SHA1 62c3f17a7b7cbc5cb32084285c725c893c2b658b
SHA512 3633fd3cbe50b13934cc31c77601b412e6982db7f2e51b91727fbc9b08e5c91ff840619640d84687cb67fe869f32e8cf7ed2d4df67592071922f2151bfb14ee4
SSDEEP 768:5F1j+9KnwgXjU8Fvn9FGcNZW+d2fZRCoZ29MuB:I9K5j3ZafPnZ2+uB
TLSH
T127D25B36D855CE77ACE78BD9B74A3696DEE0026385C85EC4EAC95E0C01C72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5db7241afe197f4627d1365ec872851b9d91c8abb144cfd75015ca02c9e0f0ee
MD5 62d7dcead9eb9105e7cb29293171ce5b
SHA1 ff2a7c309a99cbae9b131946f5740494b592a319
SHA512 8fcdc6014f584ca8e98c0284a6f0fcf8e3506cde1b714e49aeacab9819ac1691895856a30adc101ffc7ecbb69f75a744aaad010a7878f67384e26a6ba45e2b3a
SSDEEP 768:dF1j+9Pnwgz3U8Fvn9FGcNZW+d2fZiioZ29MuB:09PJ33ZafQHZ2+uB
TLSH
T1F7E2C3F598D78A73D8DE8B97637D2E569AFCC163B4885A84B7C44E0CCC821BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2f092baab72802a529979846592508ec8d401518aaf73f4ee8fc8902f23e0080
MD5 a80d91b81dc832e720342a661800ad12
SHA1 df27d241d64195b391c2ad7417602abe2a402d3f
SHA512 01a06d0fc74cef26b7b8a82aa2a568f5ed71e9d25c64d51b8d627431089818d52c19aa33ff4cc7c989d66c48980a9f1799415ffe168652cbcafe56f4db27fb04
SSDEEP 768:1F1j+9YnwgzoU8Fvn9FGcNZW+d2fZRCoZ29MuB:c9YJo3ZafPnZ2+uB
TLSH
T1ADD25B36D855CEB7ACE78BD9B74A3A96DEE0016385C85EC4E9C95E0C01C72DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 72bf30e44e0cdee81c17a631d8f1ea03507a4b837ad1bb2bc0b4e9abb4491a69
MD5 1379134ac9e25a9917e8d4e89a682f5b
SHA1 a0db7a53137352150488c91e76974407427607e1
SHA512 1d646def482f547d9720e13dd1eb46eada8c0cf5d570065235b5995fb78f2e2d135074e2ca8fdf968f095e8c06164c185b8eeb657b1ef7d7b9f56ee10bd14d66
TLSH
T12E3163E1993C29C1C4BE0DBFB45B39FC98E9C216F8A531396444ED58913E28E328083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bf68e938527b44f24ff29cbc568b0725f9c70c6968eff7123bd820a1ebb5695e
MD5 68a9a58a4c0cb41c7a5b811bcd56cb55
SHA1 09caddf9420d4379551224d0112002fcdba0e281
SHA512 83f53b4f65a5d0db35d96c7bcf8ef23b81fb69ac0c67d0cf369545159d10b93ca9f04fb5dc22e71b2725dd81d3f8ceda10e5003822ddc4bf2f00063c18f5f9db
TLSH
T12E3166E059383DC1C4BE09BFB45739FC98E9C216F954357D6444EC95913E14E618083F
MD5 SHA1 SHA512 TLSH

Submit Download